CyberStrikeus/CyberStrike - Seite 102

t1560-archive-collected-data

An adversary may compress and/or encrypt data that is collected prior to exfiltration.

Quellsprache: Englisch

t1602-001-snmp-mib-dump

Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).

Quellsprache: Englisch

t1602-002-network-device-configuration-dump

Adversaries may access network configuration files to collect sensitive data about the device and the network.

Quellsprache: Englisch

t1602-data-from-configuration-repository

Adversaries may collect data related to managed devices from configuration repositories.

Quellsprache: Englisch

t1011-001-exfiltration-over-bluetooth

Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel.

Quellsprache: Englisch

t1011-exfiltration-over-other-network-medium

Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.

Quellsprache: Englisch

t1020-001-traffic-duplication

Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure.

Quellsprache: Englisch

t1020-automated-exfiltration

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.

Quellsprache: Englisch

t1029-scheduled-transfer

Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals.

Quellsprache: Englisch

t1030-data-transfer-size-limits

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds.

Quellsprache: Englisch

t1041-exfiltration-over-c2-channel

Adversaries may steal data by exfiltrating it over an existing command and control channel.

Quellsprache: Englisch

t1048-001-exfiltration-over-symmetric-encrypted-non-c2-protocol

Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel.

Quellsprache: Englisch

t1048-002-exfiltration-over-asymmetric-encrypted-non-c2-protocol

Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel.

Quellsprache: Englisch

t1048-003-exfiltration-over-unencrypted-non-c2-protocol

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

Quellsprache: Englisch

t1048-exfiltration-over-alternative-protocol

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel.

Quellsprache: Englisch

t1052-001-exfiltration-over-usb

Adversaries may attempt to exfiltrate data over a USB connected physical device.

Quellsprache: Englisch

t1052-exfiltration-over-physical-medium

Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive.

Quellsprache: Englisch

t1537-transfer-data-to-cloud-account

Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.

Quellsprache: Englisch

t1567-001-exfiltration-to-code-repository

Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel.

Quellsprache: Englisch

t1567-002-exfiltration-to-cloud-storage

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.

Quellsprache: Englisch

t1567-003-exfiltration-to-text-storage-sites

Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel.

Quellsprache: Englisch

t1567-004-exfiltration-over-webhook

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel.

Quellsprache: Englisch

t1567-exfiltration-over-web-service

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

Quellsprache: Englisch

t1001-001-junk-data

Adversaries may add junk data to protocols used for command and control to make detection more difficult.

Quellsprache: Englisch

t1001-002-steganography

Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.

Quellsprache: Englisch

t1001-003-protocol-or-service-impersonation

Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.

Quellsprache: Englisch

t1001-data-obfuscation

Adversaries may obfuscate command and control traffic to make it more difficult to detect.

Quellsprache: Englisch

t1008-fallback-channels

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thre

Quellsprache: Englisch

t1071-001-web-protocols

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.

Quellsprache: Englisch

t1071-002-file-transfer-protocols

Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.

Quellsprache: Englisch

t1071-003-mail-protocols

Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic.

Quellsprache: Englisch

t1071-004-dns

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.

Quellsprache: Englisch

t1071-005-publishsubscribe-protocols

Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic.

Quellsprache: Englisch

t1071-application-layer-protocol

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.

Quellsprache: Englisch

t1090-001-internal-proxy

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.

Quellsprache: Englisch

t1090-002-external-proxy

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

Quellsprache: Englisch

t1090-003-multi-hop-proxy

Adversaries may chain together multiple proxies to disguise the source of malicious traffic.

Quellsprache: Englisch

t1090-004-domain-fronting

Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffi...

Quellsprache: Englisch

t1090-proxy

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to ...

Quellsprache: Englisch

t1092-communication-through-removable-media

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.

Quellsprache: Englisch