CyberStrikeus/CyberStrike - Page 94

t1027-015-compression

Adversaries may use compression to obfuscate their payloads or files.

t1027-016-junk-code-insertion

Adversaries may use junk code / dead code to obfuscate a malware’s functionality.

t1027-017-svg-smuggling

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.

t1027-obfuscated-files-or-information

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

t1036-001-invalid-code-signature

Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.

t1036-002-right-to-left-override

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign.

t1036-003-rename-legitimate-utilities

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities.

t1036-004-masquerade-task-or-service

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.

t1036-005-match-legitimate-resource-name-or-location

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.

t1036-006-space-after-filename

Adversaries can hide a program's true filetype by changing the extension of a file.

t1036-007-double-file-extension

Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.

t1036-008-masquerade-file-type

Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents.

t1036-009-break-process-trees

An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID).

t1036-010-masquerade-account-name

Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign.

t1036-011-overwrite-process-arguments

Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process.

t1036-012-browser-fingerprint

Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc.

t1036-masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

t1055-001-dynamic-link-library-injection

Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.

t1055-002-portable-executable-injection

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges.

t1055-003-thread-execution-hijacking

Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

t1055-004-asynchronous-procedure-call

Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges.

t1055-005-thread-local-storage

Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges.

t1055-008-ptrace-system-calls

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

t1055-009-proc-memory

Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges.

t1055-011-extra-window-memory-injection

Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges.

t1055-012-process-hollowing

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses.

t1055-013-process-doppelgnging

Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges.

t1055-014-vdso-hijacking

Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges.

t1055-015-listplanting

Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

t1055-process-injection

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

t1070-001-clear-windows-event-logs

Adversaries may clear Windows Event Logs to hide the activity of an intrusion.

t1070-002-clear-linux-or-mac-system-logs

Adversaries may clear system logs to hide evidence of an intrusion.

t1070-003-clear-command-history

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

t1070-004-file-deletion

Adversaries may delete files left behind by the actions of their intrusion activity.

t1070-005-network-share-connection-removal

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

t1070-006-timestomp

Adversaries may modify file time attributes to hide new files or changes to existing files.

t1070-007-clear-network-connection-history-and-configurations

Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations.

t1070-008-clear-mailbox-data

Adversaries may modify mail and mail application data to remove evidence of their activity.

t1070-009-clear-persistence

Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity.

t1070-010-relocate-malware

Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses.