CyberStrikeus/CyberStrike - 102ページ

t1560-archive-collected-data

An adversary may compress and/or encrypt data that is collected prior to exfiltration.

原文の言語: 英語

t1602-001-snmp-mib-dump

Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).

原文の言語: 英語

t1602-002-network-device-configuration-dump

Adversaries may access network configuration files to collect sensitive data about the device and the network.

原文の言語: 英語

t1602-data-from-configuration-repository

Adversaries may collect data related to managed devices from configuration repositories.

原文の言語: 英語

t1011-001-exfiltration-over-bluetooth

Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel.

原文の言語: 英語

t1011-exfiltration-over-other-network-medium

Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.

原文の言語: 英語

t1020-001-traffic-duplication

Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure.

原文の言語: 英語

t1020-automated-exfiltration

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.

原文の言語: 英語

t1029-scheduled-transfer

Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals.

原文の言語: 英語

t1030-data-transfer-size-limits

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds.

原文の言語: 英語

t1041-exfiltration-over-c2-channel

Adversaries may steal data by exfiltrating it over an existing command and control channel.

原文の言語: 英語

t1048-001-exfiltration-over-symmetric-encrypted-non-c2-protocol

Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel.

原文の言語: 英語

t1048-002-exfiltration-over-asymmetric-encrypted-non-c2-protocol

Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel.

原文の言語: 英語

t1048-003-exfiltration-over-unencrypted-non-c2-protocol

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

原文の言語: 英語

t1048-exfiltration-over-alternative-protocol

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel.

原文の言語: 英語

t1052-001-exfiltration-over-usb

Adversaries may attempt to exfiltrate data over a USB connected physical device.

原文の言語: 英語

t1052-exfiltration-over-physical-medium

Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive.

原文の言語: 英語

t1537-transfer-data-to-cloud-account

Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.

原文の言語: 英語

t1567-001-exfiltration-to-code-repository

Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel.

原文の言語: 英語

t1567-002-exfiltration-to-cloud-storage

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.

原文の言語: 英語

t1567-003-exfiltration-to-text-storage-sites

Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel.

原文の言語: 英語

t1567-004-exfiltration-over-webhook

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel.

原文の言語: 英語

t1567-exfiltration-over-web-service

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

原文の言語: 英語

t1001-001-junk-data

Adversaries may add junk data to protocols used for command and control to make detection more difficult.

原文の言語: 英語

t1001-002-steganography

Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.

原文の言語: 英語

t1001-003-protocol-or-service-impersonation

Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.

原文の言語: 英語

t1001-data-obfuscation

Adversaries may obfuscate command and control traffic to make it more difficult to detect.

原文の言語: 英語

t1008-fallback-channels

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thre

原文の言語: 英語

t1071-001-web-protocols

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.

原文の言語: 英語

t1071-002-file-transfer-protocols

Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.

原文の言語: 英語

t1071-003-mail-protocols

Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic.

原文の言語: 英語

t1071-004-dns

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.

原文の言語: 英語

t1071-005-publishsubscribe-protocols

Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic.

原文の言語: 英語

t1071-application-layer-protocol

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.

原文の言語: 英語

t1090-001-internal-proxy

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.

原文の言語: 英語

t1090-002-external-proxy

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

原文の言語: 英語

t1090-003-multi-hop-proxy

Adversaries may chain together multiple proxies to disguise the source of malicious traffic.

原文の言語: 英語

t1090-004-domain-fronting

Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffi...

原文の言語: 英語

t1090-proxy

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to ...

原文の言語: 英語

t1092-communication-through-removable-media

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.

原文の言語: 英語