CyberStrikeus/CyberStrike - Seite 96

t1218-014-mmc

Adversaries may abuse mmc.exe to proxy execution of malicious .msc files.

Quellsprache: Englisch

t1218-015-electron-applications

Adversaries may abuse components of the Electron framework to execute malicious code.

Quellsprache: Englisch

t1218-system-binary-proxy-execution

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

Quellsprache: Englisch

t1220-xsl-script-processing

Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files.

Quellsprache: Englisch

t1221-template-injection

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.

Quellsprache: Englisch

t1222-001-windows-file-and-directory-permissions-modification

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

Quellsprache: Englisch

t1222-file-and-directory-permissions-modification

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

Quellsprache: Englisch

t1480-001-environmental-keying

Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment.

Quellsprache: Englisch

t1480-002-mutual-exclusion

Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.

Quellsprache: Englisch

t1480-execution-guardrails

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

Quellsprache: Englisch

t1484-001-group-policy-modification

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.

Quellsprache: Englisch

t1484-002-trust-modification

Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses an...

Quellsprache: Englisch

t1484-domain-or-tenant-policy-modification

Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments.

Quellsprache: Englisch

t1497-001-system-checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

Quellsprache: Englisch

t1497-002-user-activity-based-checks

Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments.

Quellsprache: Englisch

t1497-003-time-based-checks

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time.

Quellsprache: Englisch

t1497-virtualizationsandbox-evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

Quellsprache: Englisch

t1535-unusedunsupported-cloud-regions

Adversaries may create cloud instances in unused geographic service regions in order to evade detection.

Quellsprache: Englisch

t1542-004-rommonkit

Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect.

Quellsprache: Englisch

t1542-005-tftp-boot

Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server.

Quellsprache: Englisch

t1542-pre-os-boot

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.

Quellsprache: Englisch

t1548-006-tcc-manipulation

Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions.

Quellsprache: Englisch

t1550-001-application-access-token

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems.

Quellsprache: Englisch

t1550-002-pass-the-hash

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls.

Quellsprache: Englisch

t1550-003-pass-the-ticket

Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.

Quellsprache: Englisch

t1550-004-web-session-cookie

Adversaries can use stolen session cookies to authenticate to web applications and services.

Quellsprache: Englisch

t1550-use-alternate-authentication-material

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal s...

Quellsprache: Englisch

t1553-001-gatekeeper-bypass

Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs.

Quellsprache: Englisch

t1553-002-code-signing

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.

Quellsprache: Englisch

t1553-003-sip-and-trust-provider-hijacking

Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks.

Quellsprache: Englisch

t1553-004-install-root-certificate

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Quellsprache: Englisch

t1553-005-mark-of-the-web-bypass

Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls.

Quellsprache: Englisch

t1553-006-code-signing-policy-modification

Adversaries may modify code signing policies to enable execution of unsigned or self-signed code.

Quellsprache: Englisch

t1553-subvert-trust-controls

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.

Quellsprache: Englisch

t1562-001-disable-or-modify-tools

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.

Quellsprache: Englisch

t1562-002-disable-windows-event-logging

Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits.

Quellsprache: Englisch

t1562-003-impair-command-history-logging

Adversaries may impair command history logging to hide commands they run on a compromised system.

Quellsprache: Englisch

t1562-004-disable-or-modify-system-firewall

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.

Quellsprache: Englisch

t1562-006-indicator-blocking

An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed.

Quellsprache: Englisch

t1562-007-disable-or-modify-cloud-firewall

Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.

Quellsprache: Englisch