CyberStrikeus/CyberStrike - 94페이지

t1027-015-compression

Adversaries may use compression to obfuscate their payloads or files.

원문 언어: 영어

t1027-016-junk-code-insertion

Adversaries may use junk code / dead code to obfuscate a malware’s functionality.

원문 언어: 영어

t1027-017-svg-smuggling

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.

원문 언어: 영어

t1027-obfuscated-files-or-information

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

원문 언어: 영어

t1036-001-invalid-code-signature

Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.

원문 언어: 영어

t1036-002-right-to-left-override

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign.

원문 언어: 영어

t1036-003-rename-legitimate-utilities

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities.

원문 언어: 영어

t1036-004-masquerade-task-or-service

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.

원문 언어: 영어

t1036-005-match-legitimate-resource-name-or-location

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.

원문 언어: 영어

t1036-006-space-after-filename

Adversaries can hide a program's true filetype by changing the extension of a file.

원문 언어: 영어

t1036-007-double-file-extension

Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.

원문 언어: 영어

t1036-008-masquerade-file-type

Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents.

원문 언어: 영어

t1036-009-break-process-trees

An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID).

원문 언어: 영어

t1036-010-masquerade-account-name

Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign.

원문 언어: 영어

t1036-011-overwrite-process-arguments

Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process.

원문 언어: 영어

t1036-012-browser-fingerprint

Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc.

원문 언어: 영어

t1036-masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

원문 언어: 영어

t1055-001-dynamic-link-library-injection

Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.

원문 언어: 영어

t1055-002-portable-executable-injection

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges.

원문 언어: 영어

t1055-003-thread-execution-hijacking

Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

원문 언어: 영어

t1055-004-asynchronous-procedure-call

Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges.

원문 언어: 영어

t1055-005-thread-local-storage

Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges.

원문 언어: 영어

t1055-008-ptrace-system-calls

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

원문 언어: 영어

t1055-009-proc-memory

Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges.

원문 언어: 영어

t1055-011-extra-window-memory-injection

Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges.

원문 언어: 영어

t1055-012-process-hollowing

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses.

원문 언어: 영어

t1055-013-process-doppelgnging

Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges.

원문 언어: 영어

t1055-014-vdso-hijacking

Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges.

원문 언어: 영어

t1055-015-listplanting

Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

원문 언어: 영어

t1055-process-injection

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

원문 언어: 영어

t1070-001-clear-windows-event-logs

Adversaries may clear Windows Event Logs to hide the activity of an intrusion.

원문 언어: 영어

t1070-002-clear-linux-or-mac-system-logs

Adversaries may clear system logs to hide evidence of an intrusion.

원문 언어: 영어

t1070-003-clear-command-history

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

원문 언어: 영어

t1070-004-file-deletion

Adversaries may delete files left behind by the actions of their intrusion activity.

원문 언어: 영어

t1070-005-network-share-connection-removal

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

원문 언어: 영어

t1070-006-timestomp

Adversaries may modify file time attributes to hide new files or changes to existing files.

원문 언어: 영어

t1070-007-clear-network-connection-history-and-configurations

Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations.

원문 언어: 영어

t1070-008-clear-mailbox-data

Adversaries may modify mail and mail application data to remove evidence of their activity.

원문 언어: 영어

t1070-009-clear-persistence

Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity.

원문 언어: 영어

t1070-010-relocate-malware

Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses.

원문 언어: 영어