CyberStrikeus/CyberStrike - Page 88

t1423-network-service-scanning

Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation.

t1424-process-discovery

Adversaries may attempt to get information about running processes on a device.

t1426-system-information-discovery

Adversaries may attempt to get detailed information about a device’s operating system and hardware, including versions, patches, and architecture.

t1428-exploitation-of-remote-services

Adversaries may exploit remote services of enterprise servers, workstations, or other resources to gain unauthorized access to internal systems once inside of a network.

t1464-network-denial-of-service

Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users.

t1471-data-encrypted-for-impact

An adversary may encrypt files stored on a mobile device to prevent the user from accessing them.

t1582-sms-control

Adversaries may delete, alter, or send SMS messages without user authorization.

t1640-account-access-removal

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.

t1641-001-transmitted-data-manipulation

Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity.

t1641-data-manipulation

Adversaries may insert, delete, or alter data in order to manipulate external outcomes or hide activity.

t1642-endpoint-denial-of-service

Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.

t1643-generate-traffic-from-victim

Adversaries may generate outbound traffic from devices.

t1662-data-destruction

Adversaries may destroy data and files on specific devices or in large numbers to interrupt availability to systems, services, and network resources.

t1409-stored-application-data

Adversaries may try to access and collect application data resident on the device.

t1414-clipboard-data

Adversaries may abuse clipboard manager APIs to obtain sensitive information copied to the device clipboard.

t1417-001-keylogging

Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.

t1417-input-capture

Adversaries may use methods of capturing user input to obtain credentials or collect information.

t1429-audio-capture

Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device.

t1430-001-remote-device-management-services

An adversary may use access to cloud services (e.g.

t1430-002-impersonate-ss7-nodes

Adversaries may exploit the lack of authentication in signaling system network nodes to track the location of mobile devices by impersonating a node.

t1430-location-tracking

Adversaries may track a device’s physical location through use of standard operating system APIs via malicious or exploited applications on the compromised device.

t1453-abuse-accessibility-features

Adversaries may abuse accessibility features in Android devices to steal sensitive data and to spread malware to other devices.

t1512-video-capture

An adversary can leverage a device’s cameras to gather information by capturing video recordings.

t1513-screen-capture

Adversaries may use screen capture to collect additional information about a target device, such as applications running in the foreground, user data, credentials, or other sensitive information.

t1517-access-notifications

Adversaries may collect data within notifications sent by the operating system or other applications.

t1532-archive-collected-data

Adversaries may compress and/or encrypt data that is collected prior to exfiltration.

t1533-data-from-local-system

Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to exfiltration.

t1616-call-control

Adversaries may make, forward, or block phone calls without user authorization.

t1636-001-calendar-entries

Adversaries may utilize standard operating system APIs to gather calendar entry data.

t1636-002-call-log

Adversaries may utilize standard operating system APIs to gather call log data.

t1636-003-contact-list

Adversaries may utilize standard operating system APIs to gather contact list data.

t1636-004-sms-messages

Adversaries may utilize standard operating system APIs to gather SMS messages.

t1636-005-accounts

Adversaries may utilize standard operating system APIs to gather account data.

t1636-protected-user-data

Adversaries may utilize standard operating system APIs to collect data from permission-backed data stores on a device, such as the calendar or contact list.

t1638-adversary-in-the-middle

Adversaries may attempt to position themselves between two or more networked devices to support follow-on behaviors such as Transmitted Data Manipulation or Endpoint Denial of Service.

t1676-linked-devices

Adversaries may abuse the “linked devices” feature on messaging applications, such as Signal and WhatsApp, to register the user’s account to an adversary-controlled device.

t1639-001-exfiltration-over-unencrypted-non-c2-protocol

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

t1639-exfiltration-over-alternative-protocol

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel.

t1646-exfiltration-over-c2-channel

Adversaries may steal data by exfiltrating it over an existing command and control channel.

t1437-001-web-protocols

Adversaries may communicate using application layer protocols associated with web protocols traffic to avoid detection/network filtering by blending in with existing traffic.