CyberStrikeus/CyberStrike - Page 94

t1027-015-compression

Adversaries may use compression to obfuscate their payloads or files.

Langue du texte source : anglais

t1027-016-junk-code-insertion

Adversaries may use junk code / dead code to obfuscate a malware’s functionality.

Langue du texte source : anglais

t1027-017-svg-smuggling

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.

Langue du texte source : anglais

t1027-obfuscated-files-or-information

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Langue du texte source : anglais

t1036-001-invalid-code-signature

Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.

Langue du texte source : anglais

t1036-002-right-to-left-override

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign.

Langue du texte source : anglais

t1036-003-rename-legitimate-utilities

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities.

Langue du texte source : anglais

t1036-004-masquerade-task-or-service

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.

Langue du texte source : anglais

t1036-005-match-legitimate-resource-name-or-location

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.

Langue du texte source : anglais

t1036-006-space-after-filename

Adversaries can hide a program's true filetype by changing the extension of a file.

Langue du texte source : anglais

t1036-007-double-file-extension

Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.

Langue du texte source : anglais

t1036-008-masquerade-file-type

Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents.

Langue du texte source : anglais

t1036-009-break-process-trees

An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID).

Langue du texte source : anglais

t1036-010-masquerade-account-name

Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign.

Langue du texte source : anglais

t1036-011-overwrite-process-arguments

Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process.

Langue du texte source : anglais

t1036-012-browser-fingerprint

Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc.

Langue du texte source : anglais

t1036-masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Langue du texte source : anglais

t1055-001-dynamic-link-library-injection

Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.

Langue du texte source : anglais

t1055-002-portable-executable-injection

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges.

Langue du texte source : anglais

t1055-003-thread-execution-hijacking

Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

Langue du texte source : anglais

t1055-004-asynchronous-procedure-call

Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges.

Langue du texte source : anglais

t1055-005-thread-local-storage

Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges.

Langue du texte source : anglais

t1055-008-ptrace-system-calls

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

Langue du texte source : anglais

t1055-009-proc-memory

Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges.

Langue du texte source : anglais

t1055-011-extra-window-memory-injection

Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges.

Langue du texte source : anglais

t1055-012-process-hollowing

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses.

Langue du texte source : anglais

t1055-013-process-doppelgnging

Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges.

Langue du texte source : anglais

t1055-014-vdso-hijacking

Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges.

Langue du texte source : anglais

t1055-015-listplanting

Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

Langue du texte source : anglais

t1055-process-injection

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

Langue du texte source : anglais

t1070-001-clear-windows-event-logs

Adversaries may clear Windows Event Logs to hide the activity of an intrusion.

Langue du texte source : anglais

t1070-002-clear-linux-or-mac-system-logs

Adversaries may clear system logs to hide evidence of an intrusion.

Langue du texte source : anglais

t1070-003-clear-command-history

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

Langue du texte source : anglais

t1070-004-file-deletion

Adversaries may delete files left behind by the actions of their intrusion activity.

Langue du texte source : anglais

t1070-005-network-share-connection-removal

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

Langue du texte source : anglais

t1070-006-timestomp

Adversaries may modify file time attributes to hide new files or changes to existing files.

Langue du texte source : anglais

t1070-007-clear-network-connection-history-and-configurations

Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations.

Langue du texte source : anglais

t1070-008-clear-mailbox-data

Adversaries may modify mail and mail application data to remove evidence of their activity.

Langue du texte source : anglais

t1070-009-clear-persistence

Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity.

Langue du texte source : anglais

t1070-010-relocate-malware

Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses.

Langue du texte source : anglais