CyberStrikeus/CyberStrike - Page 103

t1095-non-application-layer-protocol

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network.

t1102-001-dead-drop-resolver

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure.

t1102-002-bidirectional-communication

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel.

t1102-003-one-way-communication

Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel.

t1102-web-service

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.

t1104-multi-stage-channels

Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions.

t1105-ingress-tool-transfer

Adversaries may transfer tools or other files from an external system into a compromised environment.

t1132-001-standard-encoding

Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect.

t1132-002-non-standard-encoding

Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect.

t1132-data-encoding

Adversaries may encode data to make the content of command and control traffic more difficult to detect.

t1219-001-ide-tunneling

Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network.

t1219-002-remote-desktop-software

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks.

t1219-003-remote-access-hardware

An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks.

t1219-remote-access-tools

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.

t1568-001-fast-flux-dns

Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution.

t1568-002-domain-generation-algorithms

Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or ...

t1568-003-dns-calculation

Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number o...

t1568-dynamic-resolution

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations.

t1571-non-standard-port

Adversaries may communicate using a protocol and port pairing that are typically not associated.

t1572-protocol-tunneling

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems.

t1573-001-symmetric-cryptography

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

t1573-002-asymmetric-cryptography

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

t1573-encrypted-channel

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

t1665-hide-infrastructure

Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure.

t1485-001-lifecycle-triggered-deletion

Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.

t1485-data-destruction

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

t1486-data-encrypted-for-impact

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

t1489-service-stop

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

t1490-inhibit-system-recovery

Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

t1491-001-internal-defacement

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.

t1491-002-external-defacement

An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users.

t1491-defacement

Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content.

t1495-firmware-corruption

Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying th...

t1496-001-compute-hijacking

Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

t1496-002-bandwidth-hijacking

Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

t1496-003-sms-pumping

Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.

t1496-004-cloud-service-hijacking

Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability.

t1496-resource-hijacking

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

t1498-001-direct-network-flood

Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target.

t1498-002-reflection-amplification

Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target.