CyberStrikeus/CyberStrike - Page 91

t1037-002-login-hook

Adversaries may use a Login Hook to establish persistence executed upon user logon.

t1037-003-network-logon-script

Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence.

t1037-004-rc-scripts

Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup.

t1037-005-startup-items

Adversaries may use startup items automatically executed at boot initialization to establish persistence.

t1037-boot-or-logon-initialization-scripts

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.

t1098-001-additional-cloud-credentials

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

t1098-002-additional-email-delegate-permissions

Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.

t1098-003-additional-cloud-roles

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant.

t1098-004-ssh-authorized-keys

Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host.

t1098-005-device-registration

Adversaries may register a device to an adversary-controlled account.

t1098-006-additional-container-cluster-roles

An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system.

t1098-007-additional-local-or-domain-groups

An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain.

t1098-account-manipulation

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

t1133-external-remote-services

Adversaries may leverage external-facing remote services to initially access and/or persist within a network.

t1136-001-local-account

Adversaries may create a local account to maintain access to victim systems.

t1136-002-domain-account

Adversaries may create a domain account to maintain access to victim systems.

t1136-003-cloud-account

Adversaries may create a cloud account to maintain access to victim systems.

t1136-create-account

Adversaries may create an account to maintain access to victim systems.

t1137-001-office-template-macros

Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system.

t1137-002-office-test

Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system.

t1137-003-outlook-forms

Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system.

t1137-004-outlook-home-page

Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system.

t1137-005-outlook-rules

Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system.

t1137-006-add-ins

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system.

t1137-office-application-startup

Adversaries may leverage Microsoft Office-based applications for persistence between startups.

t1176-001-browser-extensions

Adversaries may abuse internet browser extensions to establish persistent access to victim systems.

t1176-002-ide-extensions

Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems.

t1176-software-extensions

Adversaries may abuse software extensions to establish persistent access to victim systems.

t1505-001-sql-stored-procedures

Adversaries may abuse SQL stored procedures to establish persistent access to systems.

t1505-002-transport-agent

Adversaries may abuse Microsoft transport agents to establish persistent access to systems.

t1505-003-web-shell

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

t1505-004-iis-components

Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence.

t1505-005-terminal-services-dll

Adversaries may abuse components of Terminal Services to enable persistent access to systems.

t1505-006-vsphere-installation-bundles

Adversaries may abuse vSphere Installation Bundles (VIBs) to establish persistent access to ESXi hypervisors.

t1505-server-software-component

Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.

t1525-implant-internal-image

Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment.

t1542-001-system-firmware

Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are exa...

t1542-002-component-firmware

Adversaries may modify component firmware to persist on systems.

t1542-003-bootkit

Adversaries may use bootkits to persist on systems.

t1543-001-launch-agent

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.