CyberStrikeus/CyberStrike - Page 96

t1218-014-mmc

Adversaries may abuse mmc.exe to proxy execution of malicious .msc files.

t1218-015-electron-applications

Adversaries may abuse components of the Electron framework to execute malicious code.

t1218-system-binary-proxy-execution

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

t1220-xsl-script-processing

Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files.

t1221-template-injection

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.

t1222-001-windows-file-and-directory-permissions-modification

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

t1222-file-and-directory-permissions-modification

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

t1480-001-environmental-keying

Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment.

t1480-002-mutual-exclusion

Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.

t1480-execution-guardrails

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

t1484-001-group-policy-modification

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.

t1484-002-trust-modification

Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses an...

t1484-domain-or-tenant-policy-modification

Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments.

t1497-001-system-checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

t1497-002-user-activity-based-checks

Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments.

t1497-003-time-based-checks

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time.

t1497-virtualizationsandbox-evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

t1535-unusedunsupported-cloud-regions

Adversaries may create cloud instances in unused geographic service regions in order to evade detection.

t1542-004-rommonkit

Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect.

t1542-005-tftp-boot

Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server.

t1542-pre-os-boot

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.

t1548-006-tcc-manipulation

Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions.

t1550-001-application-access-token

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems.

t1550-002-pass-the-hash

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls.

t1550-003-pass-the-ticket

Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.

t1550-004-web-session-cookie

Adversaries can use stolen session cookies to authenticate to web applications and services.

t1550-use-alternate-authentication-material

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal s...

t1553-001-gatekeeper-bypass

Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs.

t1553-002-code-signing

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.

t1553-003-sip-and-trust-provider-hijacking

Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks.

t1553-004-install-root-certificate

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

t1553-005-mark-of-the-web-bypass

Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls.

t1553-006-code-signing-policy-modification

Adversaries may modify code signing policies to enable execution of unsigned or self-signed code.

t1553-subvert-trust-controls

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.

t1562-001-disable-or-modify-tools

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.

t1562-002-disable-windows-event-logging

Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits.

t1562-003-impair-command-history-logging

Adversaries may impair command history logging to hide commands they run on a compromised system.

t1562-004-disable-or-modify-system-firewall

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.

t1562-006-indicator-blocking

An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed.

t1562-007-disable-or-modify-cloud-firewall

Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.