CyberStrikeus/CyberStrike - Page 95

t1070-indicator-removal

Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses.

t1078-001-default-accounts

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

t1078-002-domain-accounts

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

t1078-003-local-accounts

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

t1078-004-cloud-accounts

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

t1078-valid-accounts

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

t1112-modify-registry

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

t1127-001-msbuild

Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility.

t1127-002-clickonce

Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility.

t1127-003-jamplus

Adversaries may use `JamPlus` to proxy the execution of a malicious script.

t1127-trusted-developer-utilities-proxy-execution

Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads.

t1134-001-token-impersonationtheft

Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls.

t1134-002-create-process-with-token

Adversaries may create a new process with an existing token to escalate privileges and bypass access controls.

t1134-003-make-and-impersonate-token

Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls.

t1134-004-parent-pid-spoofing

Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges.

t1134-005-sid-history-injection

Adversaries may use SID-History Injection to escalate privileges and bypass access controls.

t1134-access-token-manipulation

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.

t1140-deobfuscatedecode-files-or-information

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.

t1197-bits-jobs

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks.

t1202-indirect-command-execution

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

t1205-001-port-knocking

Adversaries may use port knocking to hide open ports used for persistence or command and control.

t1205-002-socket-filters

Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control.

t1205-traffic-signaling

Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control.

t1207-rogue-domain-controller

Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data.

t1211-exploitation-for-defense-evasion

Adversaries may exploit a system or application vulnerability to bypass security features.

t1216-001-pubprn

Adversaries may use PubPrn to proxy execution of malicious remote files.

t1216-002-syncappvpublishingserver

Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious PowerShell commands.

t1216-system-script-proxy-execution

Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files.

t1218-001-compiled-html-file

Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code.

t1218-002-control-panel

Adversaries may abuse control.exe to proxy execution of malicious payloads.

t1218-003-cmstp

Adversaries may abuse CMSTP to proxy execution of malicious code.

t1218-004-installutil

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility.

t1218-005-mshta

Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility.

t1218-007-msiexec

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.

t1218-008-odbcconf

Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads.

t1218-009-regsvcsregasm

Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility.

t1218-010-regsvr32

Adversaries may abuse Regsvr32.exe to proxy execution of malicious code.

t1218-011-rundll32

Adversaries may abuse rundll32.exe to proxy execution of malicious code.

t1218-012-verclsid

Adversaries may abuse verclsid.exe to proxy execution of malicious code.

t1218-013-mavinject

Adversaries may abuse mavinject.exe to proxy execution of malicious code.