CyberStrikeus/CyberStrike - Page 89

t1437-application-layer-protocol

Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.

t1481-001-dead-drop-resolver

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure.

t1481-002-bidirectional-communication

Adversaries may use an existing, legitimate external Web service channel as a means for sending commands to and receiving output from a compromised system.

t1481-003-one-way-communication

Adversaries may use an existing, legitimate external Web service channel as a means for sending commands to a compromised system without receiving return output.

t1481-web-service

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.

t1509-non-standard-port

Adversaries may generate network traffic using a protocol and port pairing that are typically not associated.

t1521-001-symmetric-cryptography

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic, rather than relying on any inherent protections provided by a communication protocol.

t1521-002-asymmetric-cryptography

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic, rather than relying on any inherent protections provided by a communication protocol.

t1521-003-ssl-pinning

Adversaries may use SSL Pinning to protect the C2 traffic from being intercepted and analyzed.

t1521-encrypted-channel

Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

t1544-ingress-tool-transfer

Adversaries may transfer tools or other files from an external system onto a compromised device to facilitate follow-on actions.

t1637-001-domain-generation-algorithms

Adversaries may use Domain Generation Algorithms (DGAs) to procedurally generate domain names for uses such as command and control communication or malicious application distribution.

t1637-dynamic-resolution

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations.

t1644-out-of-band-data

Adversaries may communicate with compromised devices using out of band data streams.

t1663-remote-access-software

Adversaries may use legitimate remote access software, such as `VNC`, `TeamViewer`, `AirDroid`, `AirMirror`, etc., to establish an interactive command and control channel to target mobile devices.

t1603-scheduled-taskjob

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

t1623-001-unix-shell

Adversaries may abuse Unix shell commands and scripts for execution.

t1623-command-and-scripting-interpreter

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

t1658-exploitation-for-client-execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

t1189-drive-by-compromise

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.

t1190-exploit-public-facing-application

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

t1195-001-compromise-software-dependencies-and-development-tools

Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise.

t1195-002-compromise-software-supply-chain

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.

t1195-003-compromise-hardware-supply-chain

Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise.

t1195-supply-chain-compromise

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.

t1199-trusted-relationship

Adversaries may breach or otherwise leverage organizations who have access to intended victims.

t1200-hardware-additions

Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access.

t1566-001-spearphishing-attachment

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.

t1566-002-spearphishing-link

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

t1566-003-spearphishing-via-service

Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems.

t1566-004-spearphishing-voice

Adversaries may use voice communications to ultimately gain access to victim systems.

t1566-phishing

Adversaries may send phishing messages to gain access to victim systems.

t1659-content-injection

Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.

t1669-wi-fi-networks

Adversaries may gain initial access to target systems by connecting to wireless networks.

t1047-windows-management-instrumentation

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

t1053-002-at

Adversaries may abuse the at utility to perform task scheduling for initial or recurring execution of malicious code.

t1053-003-cron

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code.

t1053-005-scheduled-task

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.

t1053-006-systemd-timers

Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code.

t1053-007-container-orchestration-job

Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code.