CyberStrikeus/CyberStrike - Page 97

t1562-008-disable-or-modify-cloud-logs

An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection.

t1562-009-safe-mode-boot

Adversaries may abuse Windows safe mode to disable endpoint defenses.

t1562-010-downgrade-attack

Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls.

t1562-011-spoof-security-alerting

Adversaries may spoof security alerting from tools, presenting false evidence to impair defenders’ awareness of malicious activity.

t1562-012-disable-or-modify-linux-audit-system

Adversaries may disable or modify the Linux audit system to hide malicious activity and avoid detection.

t1562-013-disable-or-modify-network-device-firewall

Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage.

t1562-impair-defenses

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

t1564-001-hidden-files-and-directories

Adversaries may set files and directories to be hidden to evade detection mechanisms.

t1564-002-hidden-users

Adversaries may use hidden users to hide the presence of user accounts they create or modify.

t1564-003-hidden-window

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.

t1564-004-ntfs-file-attributes

Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection.

t1564-005-hidden-file-system

Adversaries may use a hidden file system to conceal malicious activity from users and security tools.

t1564-006-run-virtual-instance

Adversaries may carry out malicious operations using a virtual instance to avoid detection.

t1564-007-vba-stomping

Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.

t1564-008-email-hiding-rules

Adversaries may use email rules to hide inbound emails in a compromised user's mailbox.

t1564-009-resource-forking

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications.

t1564-010-process-argument-spoofing

Adversaries may attempt to hide process command-line arguments by overwriting process memory.

t1564-011-ignore-process-interrupts

Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals.

t1564-012-filepath-exclusions

Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities.

t1564-013-bind-mounts

Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from native utilities.

t1564-014-extended-attributes

Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide their malicious data in order to evade detection.

t1564-hide-artifacts

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.

t1578-001-create-snapshot

An adversary may create a snapshot or data backup within a cloud account to evade defenses.

t1578-002-create-cloud-instance

An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses.

t1578-003-delete-cloud-instance

An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence.

t1578-004-revert-cloud-instance

An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence.

t1578-005-modify-cloud-compute-configurations

Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses.

t1578-modify-cloud-compute-infrastructure

An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses.

t1599-001-network-address-translation-traversal

Adversaries may bridge network boundaries by modifying a network device’s Network Address Translation (NAT) configuration.

t1599-network-boundary-bridging

Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation.

t1600-001-reduce-key-space

Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.

t1600-002-disable-crypto-hardware

Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manip...

t1600-weaken-encryption

Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.

t1601-001-patch-system-image

Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.

t1601-002-downgrade-system-image

Adversaries may install an older version of the operating system of a network device to weaken security.

t1601-modify-system-image

Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves.

t1610-deploy-container

Adversaries may deploy a container into an environment to facilitate execution or evade defenses.

t1612-build-image-on-host

Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry.

t1620-reflective-code-loading

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads.

t1622-debugger-evasion

Adversaries may employ various means to detect and avoid debuggers.