CyberStrikeus/CyberStrike - Page 86

t0864-transient-cyber-asset

Adversaries may target devices that are transient across ICS networks and external networks.

t0865-spearphishing-attachment

Adversaries may use a spearphishing attachment, a variant of spearphishing, as a form of a social engineering attack against specific targets.

t0866-exploitation-of-remote-services

Adversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating system software or kernel itself to enable remote service ab...

t0883-internet-accessible-device

Adversaries may gain access into industrial environments through systems exposed directly to the internet for remote access rather than through External Remote Services.

t0886-remote-services

Adversaries may leverage remote services to move between assets and network segments.

t0812-default-credentials

Adversaries may leverage manufacturer or supplier set default credentials on control system devices.

t0843-program-download

Adversaries may perform a program download to transfer a user program to a controller.

t0867-lateral-tool-transfer

Adversaries may transfer tools or other files from one system to another to stage adversary tools or other files over the course of an operation.

t0891-hardcoded-credentials

Adversaries may leverage credentials that are hardcoded in software or firmware to gain an unauthorized interactive user session to an asset.

t0839-module-firmware

Adversaries may install malicious or vulnerable firmware onto modular hardware devices.

t0857-system-firmware

System firmware on modern assets is often designed with an update feature.

t0859-valid-accounts

Adversaries may steal the credentials of a specific user or service account using credential access techniques.

t0873-project-file-infection

Adversaries may attempt to infect project files with malicious code.

t0889-modify-program

Adversaries may modify or add a program on a controller to affect how it interacts with the physical process, peripheral devices and other hosts on the network.

t0890-exploitation-for-privilege-escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

t1451-sim-card-swap

Adversaries may gain access to mobile devices through transfers or swaps from victims’ phone numbers to adversary-controlled SIM cards and mobile devices.

t1456-drive-by-compromise

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.

t1458-replication-through-removable-media

Adversaries may move onto devices by exploiting or copying malware to devices connected via USB.

t1461-lockscreen-bypass

An adversary with physical access to a mobile device may seek to bypass the device’s lockscreen.

t1474-001-compromise-software-dependencies-and-development-tools

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.

t1474-002-compromise-hardware-supply-chain

Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise.

t1474-003-compromise-software-supply-chain

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.

t1474-supply-chain-compromise

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.

t1660-phishing

Adversaries may send malicious content to users in order to gain access to their mobile devices.

t1661-application-versioning

An adversary may push an update to a previously benign application to add malicious code.

t1664-exploitation-for-initial-access

Adversaries may exploit software vulnerabilities to gain initial access to a mobile device.

t1398-boot-or-logon-initialization-scripts

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.

t1577-compromise-application-executable

Adversaries may modify applications installed on a device to establish persistent access to a victim.

t1624-001-broadcast-receivers

Adversaries may establish persistence using system mechanisms that trigger execution based on specific events.

t1624-event-triggered-execution

Adversaries may establish persistence using system mechanisms that trigger execution based on specific events.

t1625-001-system-runtime-api-hijacking

Adversaries may execute their own malicious payloads by hijacking the way an operating system runs applications.

t1625-hijack-execution-flow

Adversaries may execute their own malicious payloads by hijacking the way operating systems run applications.

t1645-compromise-client-software-binary

Adversaries may modify system software binaries to establish persistent access to devices.

t1404-exploitation-for-privilege-escalation

Adversaries may exploit software vulnerabilities in order to elevate privileges.

t1626-001-device-administrator-permissions

Adversaries may abuse Android’s device administration API to obtain a higher degree of control over the device.

t1626-abuse-elevation-control-mechanism

Adversaries may circumvent mechanisms designed to control elevated privileges to gain higher-level permissions.

t1406-001-steganography

Adversaries may use steganography techniques in order to prevent the detection of hidden information.

t1406-002-software-packing

Adversaries may perform software packing to conceal their code.

t1406-obfuscated-files-or-information

Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit.

t1407-download-new-code-at-runtime

Adversaries may download and execute dynamic code not included in the original application package after installation.