CyberStrikeus/CyberStrike - 第 94 页

t1027-015-compression

Adversaries may use compression to obfuscate their payloads or files.

原文语言：英语

t1027-016-junk-code-insertion

Adversaries may use junk code / dead code to obfuscate a malware’s functionality.

原文语言：英语

t1027-017-svg-smuggling

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.

原文语言：英语

t1027-obfuscated-files-or-information

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

原文语言：英语

t1036-001-invalid-code-signature

Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.

原文语言：英语

t1036-002-right-to-left-override

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign.

原文语言：英语

t1036-003-rename-legitimate-utilities

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities.

原文语言：英语

t1036-004-masquerade-task-or-service

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.

原文语言：英语

t1036-005-match-legitimate-resource-name-or-location

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.

原文语言：英语

t1036-006-space-after-filename

Adversaries can hide a program's true filetype by changing the extension of a file.

原文语言：英语

t1036-007-double-file-extension

Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.

原文语言：英语

t1036-008-masquerade-file-type

Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents.

原文语言：英语

t1036-009-break-process-trees

An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID).

原文语言：英语

t1036-010-masquerade-account-name

Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign.

原文语言：英语

t1036-011-overwrite-process-arguments

Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process.

原文语言：英语

t1036-012-browser-fingerprint

Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc.

原文语言：英语

t1036-masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

原文语言：英语

t1055-001-dynamic-link-library-injection

Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.

原文语言：英语

t1055-002-portable-executable-injection

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges.

原文语言：英语

t1055-003-thread-execution-hijacking

Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

原文语言：英语

t1055-004-asynchronous-procedure-call

Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges.

原文语言：英语

t1055-005-thread-local-storage

Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges.

原文语言：英语

t1055-008-ptrace-system-calls

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

原文语言：英语

t1055-009-proc-memory

Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges.

原文语言：英语

t1055-011-extra-window-memory-injection

Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges.

原文语言：英语

t1055-012-process-hollowing

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses.

原文语言：英语

t1055-013-process-doppelgnging

Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges.

原文语言：英语

t1055-014-vdso-hijacking

Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges.

原文语言：英语

t1055-015-listplanting

Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

原文语言：英语

t1055-process-injection

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

原文语言：英语

t1070-001-clear-windows-event-logs

Adversaries may clear Windows Event Logs to hide the activity of an intrusion.

原文语言：英语

t1070-002-clear-linux-or-mac-system-logs

Adversaries may clear system logs to hide evidence of an intrusion.

原文语言：英语

t1070-003-clear-command-history

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

原文语言：英语

t1070-004-file-deletion

Adversaries may delete files left behind by the actions of their intrusion activity.

原文语言：英语

t1070-005-network-share-connection-removal

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

原文语言：英语

t1070-006-timestomp

Adversaries may modify file time attributes to hide new files or changes to existing files.

原文语言：英语

t1070-007-clear-network-connection-history-and-configurations

Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations.

原文语言：英语

t1070-008-clear-mailbox-data

Adversaries may modify mail and mail application data to remove evidence of their activity.

原文语言：英语

t1070-009-clear-persistence

Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity.

原文语言：英语

t1070-010-relocate-malware

Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses.

原文语言：英语