CyberStrikeus/CyberStrike - Page 99

t1555-006-cloud-secrets-management-stores

Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.

t1555-credentials-from-password-stores

Adversaries may search for common password storage locations to obtain user credentials.

t1556-001-domain-controller-authentication

Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.

t1556-002-password-filter-dll

Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.

t1556-003-pluggable-authentication-modules

Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts.

t1556-004-network-device-authentication

Adversaries may use Patch System Image to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.

t1556-005-reversible-encryption

An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems.

t1556-006-multi-factor-authentication

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

t1556-007-hybrid-identity

Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credent...

t1556-008-network-provider-dll

Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process.

t1556-009-conditional-access-policies

Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts.

t1556-modify-authentication-process

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.

t1557-001-llmnrnbt-ns-poisoning-and-smb-relay

By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system.

t1557-002-arp-cache-poisoning

Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices.

t1557-003-dhcp-spoofing

Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network.

t1557-004-evil-twin

Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Da...

t1557-adversary-in-the-middle

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Trans...

t1558-001-golden-ticket

Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.

t1558-002-silver-ticket

Adversaries who have the password hash of a target service account (e.g.

t1558-003-kerberoasting

Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.

t1558-004-as-rep-roasting

Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Password Cracking Kerberos messages.

t1558-005-ccache-files

Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache).

t1558-steal-or-forge-kerberos-tickets

Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket.

t1606-001-web-cookies

Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.

t1606-002-saml-tokens

An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.

t1606-forge-web-credentials

Adversaries may forge credential materials that can be used to gain access to web applications or Internet services.

t1621-multi-factor-authentication-request-generation

Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.

t1649-steal-or-forge-authentication-certificates

Adversaries may steal or forge certificates used for authentication to access remote systems or resources.

t1007-system-service-discovery

Adversaries may try to gather information about registered local system services.

t1010-application-window-discovery

Adversaries may attempt to get a listing of open application windows.

t1012-query-registry

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

t1016-001-internet-connection-discovery

Adversaries may check for Internet connectivity on compromised systems.

t1016-002-wi-fi-discovery

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

t1016-system-network-configuration-discovery

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

t1018-remote-system-discovery

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

t1033-system-owneruser-discovery

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.

t1046-network-service-discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

t1049-system-network-connections-discovery

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

t1057-process-discovery

Adversaries may attempt to get information about running processes on a system.

t1069-001-local-groups

Adversaries may attempt to find local system groups and permission settings.