CyberStrikeus/CyberStrike - 第 96 页

t1218-014-mmc

Adversaries may abuse mmc.exe to proxy execution of malicious .msc files.

原文语言：英语

t1218-015-electron-applications

Adversaries may abuse components of the Electron framework to execute malicious code.

原文语言：英语

t1218-system-binary-proxy-execution

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

原文语言：英语

t1220-xsl-script-processing

Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files.

原文语言：英语

t1221-template-injection

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.

原文语言：英语

t1222-001-windows-file-and-directory-permissions-modification

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

原文语言：英语

t1222-file-and-directory-permissions-modification

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

原文语言：英语

t1480-001-environmental-keying

Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment.

原文语言：英语

t1480-002-mutual-exclusion

Adversaries may constrain execution or actions based on the presence of a mutex associated with malware.

原文语言：英语

t1480-execution-guardrails

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

原文语言：英语

t1484-001-group-policy-modification

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.

原文语言：英语

t1484-002-trust-modification

Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses an...

原文语言：英语

t1484-domain-or-tenant-policy-modification

Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments.

原文语言：英语

t1497-001-system-checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

原文语言：英语

t1497-002-user-activity-based-checks

Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments.

原文语言：英语

t1497-003-time-based-checks

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time.

原文语言：英语

t1497-virtualizationsandbox-evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

原文语言：英语

t1535-unusedunsupported-cloud-regions

Adversaries may create cloud instances in unused geographic service regions in order to evade detection.

原文语言：英语

t1542-004-rommonkit

Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect.

原文语言：英语

t1542-005-tftp-boot

Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server.

原文语言：英语

t1542-pre-os-boot

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.

原文语言：英语

t1548-006-tcc-manipulation

Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions.

原文语言：英语

t1550-001-application-access-token

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems.

原文语言：英语

t1550-002-pass-the-hash

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls.

原文语言：英语

t1550-003-pass-the-ticket

Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.

原文语言：英语

t1550-004-web-session-cookie

Adversaries can use stolen session cookies to authenticate to web applications and services.

原文语言：英语

t1550-use-alternate-authentication-material

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal s...

原文语言：英语

t1553-001-gatekeeper-bypass

Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs.

原文语言：英语

t1553-002-code-signing

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.

原文语言：英语

t1553-003-sip-and-trust-provider-hijacking

Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks.

原文语言：英语

t1553-004-install-root-certificate

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

原文语言：英语

t1553-005-mark-of-the-web-bypass

Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls.

原文语言：英语

t1553-006-code-signing-policy-modification

Adversaries may modify code signing policies to enable execution of unsigned or self-signed code.

原文语言：英语

t1553-subvert-trust-controls

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.

原文语言：英语

t1562-001-disable-or-modify-tools

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.

原文语言：英语

t1562-002-disable-windows-event-logging

Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits.

原文语言：英语

t1562-003-impair-command-history-logging

Adversaries may impair command history logging to hide commands they run on a compromised system.

原文语言：英语

t1562-004-disable-or-modify-system-firewall

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.

原文语言：英语

t1562-006-indicator-blocking

An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed.

原文语言：英语

t1562-007-disable-or-modify-cloud-firewall

Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.

原文语言：英语