CyberStrikeus/CyberStrike - Page 92

t1543-002-systemd-service

Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence.

t1543-003-windows-service

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.

t1543-004-launch-daemon

Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence.

t1543-005-container-service

Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts.

t1543-create-or-modify-system-process

Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.

t1546-017-udev-rules

Adversaries may maintain persistence through executing malicious content triggered using udev rules.

t1546-018-python-startup-hooks

Adversaries may achieve persistence by leveraging Python’s startup mechanisms, including path configuration (`.pth`) files and the `sitecustomize.py` or `usercustomize.py` modules.

t1547-001-registry-run-keys-startup-folder

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

t1547-002-authentication-package

Adversaries may abuse authentication packages to execute DLLs when the system boots.

t1547-003-time-providers

Adversaries may abuse time providers to execute DLLs when the system boots.

t1547-004-winlogon-helper-dll

Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.

t1547-005-security-support-provider

Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots.

t1547-006-kernel-modules-and-extensions

Adversaries may modify the kernel to automatically execute programs on system boot.

t1547-007-re-opened-applications

Adversaries may modify plist files to automatically run an application when a user logs in.

t1547-008-lsass-driver

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

t1547-009-shortcut-modification

Adversaries may create or modify shortcuts that can execute a program during system boot or user login.

t1547-010-port-monitors

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

t1547-012-print-processors

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

t1547-013-xdg-autostart-entries

Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login.

t1547-014-active-setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

t1547-015-login-items

Adversaries may add login items to execute upon user login to gain persistence or escalate privileges.

t1547-boot-or-logon-autostart-execution

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

t1554-compromise-host-software-binary

Adversaries may modify host software binaries to establish persistent access to systems.

t1574-001-dll

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses.

t1574-004-dylib-hijacking

Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime.

t1574-005-executable-installer-file-permissions-weakness

Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer.

t1574-006-dynamic-linker-hijacking

Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries.

t1574-007-path-interception-by-path-environment-variable

Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries.

t1574-008-path-interception-by-search-order-hijacking

Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs.

t1574-009-path-interception-by-unquoted-path

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.

t1574-010-services-file-permissions-weakness

Adversaries may execute their own malicious payloads by hijacking the binaries used by services.

t1574-011-services-registry-permissions-weakness

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.

t1574-012-corprofiler

Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR.

t1574-013-kernelcallbacktable

Adversaries may abuse the <code>KernelCallbackTable</code> of a process to hijack its execution flow in order to run their own payloads.

t1574-014-appdomainmanager

Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` loads assemblies.

t1574-hijack-execution-flow

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.

t1653-power-settings

Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines.

t1668-exclusive-control

Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing o...

t1671-cloud-application-integration

Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-service environment.

t1068-exploitation-for-privilege-escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.