CyberStrikeus/CyberStrike - Page 102

t1560-archive-collected-data

An adversary may compress and/or encrypt data that is collected prior to exfiltration.

t1602-001-snmp-mib-dump

Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).

t1602-002-network-device-configuration-dump

Adversaries may access network configuration files to collect sensitive data about the device and the network.

t1602-data-from-configuration-repository

Adversaries may collect data related to managed devices from configuration repositories.

t1011-001-exfiltration-over-bluetooth

Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel.

t1011-exfiltration-over-other-network-medium

Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.

t1020-001-traffic-duplication

Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure.

t1020-automated-exfiltration

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.

t1029-scheduled-transfer

Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals.

t1030-data-transfer-size-limits

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds.

t1041-exfiltration-over-c2-channel

Adversaries may steal data by exfiltrating it over an existing command and control channel.

t1048-001-exfiltration-over-symmetric-encrypted-non-c2-protocol

Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel.

t1048-002-exfiltration-over-asymmetric-encrypted-non-c2-protocol

Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel.

t1048-003-exfiltration-over-unencrypted-non-c2-protocol

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

t1048-exfiltration-over-alternative-protocol

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel.

t1052-001-exfiltration-over-usb

Adversaries may attempt to exfiltrate data over a USB connected physical device.

t1052-exfiltration-over-physical-medium

Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive.

t1537-transfer-data-to-cloud-account

Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.

t1567-001-exfiltration-to-code-repository

Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel.

t1567-002-exfiltration-to-cloud-storage

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.

t1567-003-exfiltration-to-text-storage-sites

Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel.

t1567-004-exfiltration-over-webhook

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel.

t1567-exfiltration-over-web-service

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

t1001-001-junk-data

Adversaries may add junk data to protocols used for command and control to make detection more difficult.

t1001-002-steganography

Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.

t1001-003-protocol-or-service-impersonation

Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.

t1001-data-obfuscation

Adversaries may obfuscate command and control traffic to make it more difficult to detect.

t1008-fallback-channels

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thre

t1071-001-web-protocols

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.

t1071-002-file-transfer-protocols

Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.

t1071-003-mail-protocols

Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic.

t1071-004-dns

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.

t1071-005-publishsubscribe-protocols

Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic.

t1071-application-layer-protocol

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.

t1090-001-internal-proxy

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.

t1090-002-external-proxy

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

t1090-003-multi-hop-proxy

Adversaries may chain together multiple proxies to disguise the source of malicious traffic.

t1090-004-domain-fronting

Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffi...

t1090-proxy

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to ...

t1092-communication-through-removable-media

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.