CyberStrikeus/CyberStrike - Page 96

t1218-014-mmc

Adversaries may abuse mmc.exe to proxy execution of malicious .msc files.

Langue du texte source : anglais

t1218-015-electron-applications

Adversaries may abuse components of the Electron framework to execute malicious code.

Langue du texte source : anglais

t1218-system-binary-proxy-execution

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

Langue du texte source : anglais

t1220-xsl-script-processing

Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files.

Langue du texte source : anglais

t1221-template-injection

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.

Langue du texte source : anglais

t1222-001-windows-file-and-directory-permissions-modification

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

Langue du texte source : anglais

t1222-file-and-directory-permissions-modification

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

Langue du texte source : anglais

t1480-001-environmental-keying

Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment.

Langue du texte source : anglais

t1480-002-mutual-exclusion

Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.

Langue du texte source : anglais

t1480-execution-guardrails

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

Langue du texte source : anglais

t1484-001-group-policy-modification

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.

Langue du texte source : anglais

t1484-002-trust-modification

Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses an...

Langue du texte source : anglais

t1484-domain-or-tenant-policy-modification

Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments.

Langue du texte source : anglais

t1497-001-system-checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

Langue du texte source : anglais

t1497-002-user-activity-based-checks

Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments.

Langue du texte source : anglais

t1497-003-time-based-checks

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time.

Langue du texte source : anglais

t1497-virtualizationsandbox-evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

Langue du texte source : anglais

t1535-unusedunsupported-cloud-regions

Adversaries may create cloud instances in unused geographic service regions in order to evade detection.

Langue du texte source : anglais

t1542-004-rommonkit

Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect.

Langue du texte source : anglais

t1542-005-tftp-boot

Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server.

Langue du texte source : anglais

t1542-pre-os-boot

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.

Langue du texte source : anglais

t1548-006-tcc-manipulation

Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions.

Langue du texte source : anglais

t1550-001-application-access-token

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems.

Langue du texte source : anglais

t1550-002-pass-the-hash

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls.

Langue du texte source : anglais

t1550-003-pass-the-ticket

Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.

Langue du texte source : anglais

t1550-004-web-session-cookie

Adversaries can use stolen session cookies to authenticate to web applications and services.

Langue du texte source : anglais

t1550-use-alternate-authentication-material

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal s...

Langue du texte source : anglais

t1553-001-gatekeeper-bypass

Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs.

Langue du texte source : anglais

t1553-002-code-signing

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.

Langue du texte source : anglais

t1553-003-sip-and-trust-provider-hijacking

Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks.

Langue du texte source : anglais

t1553-004-install-root-certificate

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Langue du texte source : anglais

t1553-005-mark-of-the-web-bypass

Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls.

Langue du texte source : anglais

t1553-006-code-signing-policy-modification

Adversaries may modify code signing policies to enable execution of unsigned or self-signed code.

Langue du texte source : anglais

t1553-subvert-trust-controls

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.

Langue du texte source : anglais

t1562-001-disable-or-modify-tools

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.

Langue du texte source : anglais

t1562-002-disable-windows-event-logging

Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits.

Langue du texte source : anglais

t1562-003-impair-command-history-logging

Adversaries may impair command history logging to hide commands they run on a compromised system.

Langue du texte source : anglais

t1562-004-disable-or-modify-system-firewall

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.

Langue du texte source : anglais

t1562-006-indicator-blocking

An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed.

Langue du texte source : anglais

t1562-007-disable-or-modify-cloud-firewall

Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.

Langue du texte source : anglais