CyberStrikeus/CyberStrike - Page 90

t1053-scheduled-taskjob

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

t1059-001-powershell

Adversaries may abuse PowerShell commands and scripts for execution.

t1059-002-applescript

Adversaries may abuse AppleScript for execution.

t1059-003-windows-command-shell

Adversaries may abuse the Windows command shell for execution.

t1059-004-unix-shell

Adversaries may abuse Unix shell commands and scripts for execution.

t1059-005-visual-basic

Adversaries may abuse Visual Basic (VB) for execution.

t1059-006-python

Adversaries may abuse Python commands and scripts for execution.

t1059-007-javascript

Adversaries may abuse various implementations of JavaScript for execution.

t1059-008-network-device-cli

Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.

t1059-009-cloud-api

Adversaries may abuse cloud APIs to execute malicious commands.

t1059-010-autohotkey-autoit

Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts.

t1059-011-lua

Adversaries may abuse Lua commands and scripts for execution.

t1059-012-hypervisor-cli

Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands.

t1059-013-container-cliapi

Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments.

t1059-command-and-scripting-interpreter

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

t1072-software-deployment-tools

Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network.

t1106-native-api

Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

t1129-shared-modules

Adversaries may execute malicious payloads via loading shared modules.

t1203-exploitation-for-client-execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

t1204-001-malicious-link

An adversary may rely upon a user clicking a malicious link in order to gain execution.

t1204-002-malicious-file

An adversary may rely upon a user opening a malicious file in order to gain execution.

t1204-003-malicious-image

Adversaries may rely on a user running a malicious image to facilitate execution.

t1204-004-malicious-copy-and-paste

An adversary may rely upon a user copying and pasting code in order to gain execution.

t1204-005-malicious-library

Adversaries may rely on a user installing a malicious library to facilitate execution.

t1204-user-execution

An adversary may rely upon specific actions by a user in order to gain execution.

t1559-001-component-object-model

Adversaries may use the Windows Component Object Model (COM) for local code execution.

t1559-002-dynamic-data-exchange

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands.

t1559-003-xpc-services

Adversaries can provide malicious content to an XPC service daemon for local code execution.

t1559-inter-process-communication

Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution.

t1569-001-launchctl

Adversaries may abuse launchctl to execute commands or programs.

t1569-002-service-execution

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads.

t1569-003-systemctl

Adversaries may abuse systemctl to execute commands or programs.

t1569-system-services

Adversaries may abuse system services or daemons to execute commands or programs.

t1609-container-administration-command

Adversaries may abuse a container administration service to execute commands within a container.

t1648-serverless-execution

Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments.

t1651-cloud-administration-command

Adversaries may abuse cloud management services to execute commands within virtual machines.

t1674-input-injection

Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, ...

t1675-esxi-administration-command

Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment.

t1677-poisoned-pipeline-execution

Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code into the build process.

t1037-001-logon-script-windows

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence.