CyberStrikeus/CyberStrike - Page 106

t1592-001-hardware

Adversaries may gather information about the victim's host hardware that can be used during targeting.

t1592-002-software

Adversaries may gather information about the victim's host software that can be used during targeting.

t1592-003-firmware

Adversaries may gather information about the victim's host firmware that can be used during targeting.

t1592-004-client-configurations

Adversaries may gather information about the victim's client configurations that can be used during targeting.

t1592-gather-victim-host-information

Adversaries may gather information about the victim's hosts that can be used during targeting.

t1593-001-social-media

Adversaries may search social media for information about victims that can be used during targeting.

t1593-002-search-engines

Adversaries may use search engines to collect information about victims that can be used during targeting.

t1593-003-code-repositories

Adversaries may search public code repositories for information about victims that can be used during targeting.

t1593-search-open-websitesdomains

Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting.

t1594-search-victim-owned-websites

Adversaries may search websites owned by the victim for information that can be used during targeting.

t1595-001-scanning-ip-blocks

Adversaries may scan victim IP blocks to gather information that can be used during targeting.

t1595-002-vulnerability-scanning

Adversaries may scan victims for vulnerabilities that can be used during targeting.

t1595-003-wordlist-scanning

Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques.

t1595-active-scanning

Adversaries may execute active reconnaissance scans to gather information that can be used during targeting.

t1596-001-dnspassive-dns

Adversaries may search DNS data for information about victims that can be used during targeting.

t1596-002-whois

Adversaries may search public WHOIS data for information about victims that can be used during targeting.

t1596-003-digital-certificates

Adversaries may search public digital certificate data for information about victims that can be used during targeting.

t1596-004-cdns

Adversaries may search content delivery network (CDN) data about victims that can be used during targeting.

t1596-005-scan-databases

Adversaries may search within public scan databases for information about victims that can be used during targeting.

t1596-search-open-technical-databases

Adversaries may search freely available technical databases for information about victims that can be used during targeting.

t1597-001-threat-intel-vendors

Adversaries may search private data from threat intelligence vendors for information that can be used during targeting.

t1597-002-purchase-technical-data

Adversaries may purchase technical information about victims that can be used during targeting.

t1597-search-closed-sources

Adversaries may search and gather information about victims from closed (e.g., paid, private, or otherwise not freely available) sources that can be used during targeting.

t1598-001-spearphishing-service

Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting.

t1598-002-spearphishing-attachment

Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting.

t1598-003-spearphishing-link

Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting.

t1598-004-spearphishing-voice

Adversaries may use voice communications to elicit sensitive information that can be used during targeting.

t1598-phishing-for-information

Adversaries may send phishing messages to elicit sensitive information that can be used during targeting.

t1681-search-threat-vendor-data

Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with...

adverse-event-analysis-de-ae-adverse-event-analysis

Anomalies, indicators of compromise, and other potentially adverse events are analyzed to characterize the events and detect cybersecurity incidents

continuous-monitoring-de-cm-continuous-monitoring

Assets are monitored to find anomalies, indicators of compromise, and other potentially adverse events

de-ae-01-deae-01

A baseline of network operations and expected data flows for users and systems is established and managed

de-ae-02-deae-02

Potentially adverse events are analyzed to better understand associated activities

de-ae-03-deae-03

Information is correlated from multiple sources

de-ae-04-deae-04

The estimated impact and scope of adverse events are understood

de-ae-05-deae-05

Incident alert thresholds are established

de-ae-06-deae-06

Information on adverse events is provided to authorized staff and tools

de-ae-07-deae-07

Cyber threat intelligence and other contextual information are integrated into the analysis

de-ae-08-deae-08

Incidents are declared when adverse events meet the defined incident criteria

de-cm-01-decm-01

Networks and network services are monitored to find potentially adverse events