CyberStrikeus/CyberStrike - Page 93

t1546-001-change-default-file-association

Adversaries may establish persistence by executing malicious content triggered by a file type association.

t1546-002-screensaver

Adversaries may establish persistence by executing malicious content triggered by user inactivity.

t1546-003-windows-management-instrumentation-event-subscription

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

t1546-004-unix-shell-configuration-modification

Adversaries may establish persistence through executing malicious commands triggered by a user’s shell.

t1546-005-trap

Adversaries may establish persistence by executing malicious content triggered by an interrupt signal.

t1546-006-lcloaddylib-addition

Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries.

t1546-007-netsh-helper-dll

Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs.

t1546-008-accessibility-features

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.

t1546-009-appcert-dlls

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.

t1546-010-appinit-dlls

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

t1546-011-application-shimming

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.

t1546-012-image-file-execution-options-injection

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers.

t1546-013-powershell-profile

Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles.

t1546-014-emond

Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond).

t1546-015-component-object-model-hijacking

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

t1546-016-installer-packages

Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content.

t1546-event-triggered-execution

Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

t1548-001-setuid-and-setgid

An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context.

t1548-002-bypass-user-account-control

Adversaries may bypass UAC mechanisms to elevate process privileges on system.

t1548-003-sudo-and-sudo-caching

Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges.

t1548-004-elevated-execution-with-prompt

Adversaries may leverage the <code>AuthorizationExecuteWithPrivileges</code> API to escalate privileges by prompting the user for credentials.

t1548-005-temporary-elevated-cloud-access

Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources.

t1548-abuse-elevation-control-mechanism

Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions.

t1611-escape-to-host

Adversaries may break out of a container or virtualized environment to gain access to the underlying host.

t1006-direct-volume-access

Adversaries may directly access a volume to bypass file access controls and file system monitoring.

t1014-rootkit

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.

t1027-001-binary-padding

Adversaries may use binary padding to add junk data and change the on-disk representation of malware.

t1027-002-software-packing

Adversaries may perform software packing or virtual machine software protection to conceal their code.

t1027-003-steganography

Adversaries may use steganography techniques in order to prevent the detection of hidden information.

t1027-004-compile-after-delivery

Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code.

t1027-005-indicator-removal-from-tools

Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed.

t1027-006-html-smuggling

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files.

t1027-007-dynamic-api-resolution

Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis.

t1027-008-stripped-payloads

Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information.

t1027-009-embedded-payloads

Adversaries may embed payloads within other files to conceal malicious content from defenses.

t1027-010-command-obfuscation

Adversaries may obfuscate content during command execution to impede detection.

t1027-011-fileless-storage

Adversaries may store data in "fileless" formats to conceal malicious activity from defenses.

t1027-012-lnk-icon-smuggling

Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files.

t1027-013-encryptedencoded-file

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.

t1027-014-polymorphic-code

Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection.