CyberStrikeus/CyberStrike - Seite 101

t1080-taint-shared-content

Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories.

Quellsprache: Englisch

t1091-replication-through-removable-media

Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted i...

Quellsprache: Englisch

t1210-exploitation-of-remote-services

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

Quellsprache: Englisch

t1534-internal-spearphishing

After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within th...

Quellsprache: Englisch

t1563-001-ssh-hijacking

Adversaries may hijack a legitimate user's SSH session to move laterally within an environment.

Quellsprache: Englisch

t1563-002-rdp-hijacking

Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment.

Quellsprache: Englisch

t1563-remote-service-session-hijacking

Adversaries may take control of preexisting sessions with remote services to move laterally in an environment.

Quellsprache: Englisch

t1570-lateral-tool-transfer

Adversaries may transfer tools or other files between systems in a compromised environment.

Quellsprache: Englisch

t1005-data-from-local-system

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior...

Quellsprache: Englisch

t1025-data-from-removable-media

Adversaries may search connected removable media on computers they have compromised to find files of interest.

Quellsprache: Englisch

t1039-data-from-network-shared-drive

Adversaries may search network shares on computers they have compromised to find files of interest.

Quellsprache: Englisch

t1056-001-keylogging

Adversaries may log user keystrokes to intercept credentials as the user types them.

Quellsprache: Englisch

t1056-002-gui-input-capture

Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt.

Quellsprache: Englisch

t1056-003-web-portal-capture

Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service.

Quellsprache: Englisch

t1056-004-credential-api-hooking

Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials.

Quellsprache: Englisch

t1056-input-capture

Adversaries may use methods of capturing user input to obtain credentials or collect information.

Quellsprache: Englisch

t1074-001-local-data-staging

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration.

Quellsprache: Englisch

t1074-002-remote-data-staging

Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration.

Quellsprache: Englisch

t1074-data-staged

Adversaries may stage collected data in a central location or directory prior to Exfiltration.

Quellsprache: Englisch

t1113-screen-capture

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.

Quellsprache: Englisch

t1114-001-local-email-collection

Adversaries may target user email on local systems to collect sensitive information.

Quellsprache: Englisch

t1114-002-remote-email-collection

Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information.

Quellsprache: Englisch

t1114-003-email-forwarding-rule

Adversaries may setup email forwarding rules to collect sensitive information.

Quellsprache: Englisch

t1114-email-collection

Adversaries may target user email to collect sensitive information.

Quellsprache: Englisch

t1115-clipboard-data

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Quellsprache: Englisch

t1119-automated-collection

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Quellsprache: Englisch

t1123-audio-capture

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listen...

Quellsprache: Englisch

t1125-video-capture

An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering ...

Quellsprache: Englisch

t1185-browser-session-hijacking

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various brow...

Quellsprache: Englisch

t1213-001-confluence

Adversaries may leverage Confluence repositories to mine valuable information.

Quellsprache: Englisch

t1213-002-sharepoint

Adversaries may leverage the SharePoint repository as a source to mine valuable information.

Quellsprache: Englisch

t1213-003-code-repositories

Adversaries may leverage code repositories to collect valuable information.

Quellsprache: Englisch

t1213-004-customer-relationship-management-software

Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information.

Quellsprache: Englisch

t1213-005-messaging-applications

Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.

Quellsprache: Englisch

t1213-006-databases

Adversaries may leverage databases to mine valuable information.

Quellsprache: Englisch

t1213-data-from-information-repositories

Adversaries may leverage information repositories to mine valuable information.

Quellsprache: Englisch

t1530-data-from-cloud-storage

Adversaries may access data from cloud storage.

Quellsprache: Englisch

t1560-001-archive-via-utility

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.

Quellsprache: Englisch

t1560-002-archive-via-library

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries.

Quellsprache: Englisch

t1560-003-archive-via-custom-method

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method.

Quellsprache: Englisch