Search techniques

Harvesting employee names, email formats, and credentials from breach dumps and social platforms.

Detect with Monitor credential-leak feeds for corporate domains; watch for authentication attempts against accounts that never existed.

Adversaries may gather credentials that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.

Detect with Monitor for suspicious network traffic that could be indicative of probing for email addresses and/or usernames, such as large/iterative quantities of authentication requests originating from a single source (especially if the source is known to be associated with an…

Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather information about the victim's networks that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather information about the victim's network domain(s) that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather information about the victim's DNS that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather information about the victim's network trust dependencies that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather information about the victim's network topology that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather information about the victim's network security appliances that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather information about the victim's organization that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather information about the victim's business relationships that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather information about identities and roles within the victim organization that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Collecting hardware, software, and configuration details about hosts through banners, headers, and public documents.

Detect with Low signal. Reduce exposure instead: strip version banners, trim verbose error pages, scrub document metadata.

Adversaries may gather information about the victim's host hardware that can be used during targeting.

Detect with Internet scanners may be used to look for patterns associated with malicious content designed to collect host hardware information from visitors.

Adversaries may gather information about the victim's host software that can be used during targeting.

Detect with Internet scanners may be used to look for patterns associated with malicious content designed to collect host software information from visitors.

Adversaries may gather information about the victim's host firmware that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather information about the victim's client configurations that can be used during targeting.

Detect with Internet scanners may be used to look for patterns associated with malicious content designed to collect client configuration information from visitors.

Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may search social media for information about victims that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may use search engines to collect information about victims that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may search websites owned by the victim for information that can be used during targeting.

Detect with Monitor for suspicious network traffic that could be indicative of adversary reconnaissance, such as rapid successions of requests indicative of web crawling and/or large quantities of requests originating from a single source (especially if the source is known to be associated…

Port scans, vulnerability scans, and wordlist-driven directory brute forcing against hosts the target owns.

Detect with Edge firewall denies from a single source across many ports; 404 floods in web server logs with scanner user-agents.

Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses.

Detect with Monitor for suspicious network traffic that could be indicative of scanning, such as large quantities originating from a single source (especially if the source is known to be associated with an adversary/botnet).

Adversaries may scan victims for vulnerabilities that can be used during targeting.

Detect with Monitor for suspicious network traffic that could be indicative of scanning, such as large quantities originating from a single source (especially if the source is known to be associated with an adversary/botnet).

Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques.

Detect with Monitor for suspicious network traffic that could be indicative of scanning, such as large quantities originating from a single source (especially if the source is known to be associated with an adversary/botnet).

Shodan, Censys, certificate transparency, WHOIS, and DNS records used to map external attack surface.

Detect with Run the same queries yourself on a schedule. Anything you find, they already found.

Adversaries may search DNS data for information about victims that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may search within public scan databases for information about victims that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may search and gather information about victims from closed (e.g., paid, private, or otherwise not freely available) sources that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may purchase technical information about victims that can be used during targeting.

Detect with Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Messages designed to elicit information rather than deliver a payload — vendor verification, IT survey, HR pretext.

Detect with User reports; mail gateway rules for newly registered lookalike domains and reply-to mismatches.

Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting.

Detect with Monitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts).

Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting.

Detect with Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.

Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting.

Detect with Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.

Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Domains, VPS instances, botnets, web services, and serverless functions purchased for the operation.

Detect with Proxy alerting on newly observed domains (< 30 days registered); traffic to low-reputation hosting ASNs.

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses.

Detect with Domain registration information is, by design, captured in public registration logs. Consider use of services that may aid in tracking of newly acquired domains, such as WHOIS databases and/or passive DNS.

Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: Application Layer Protocol).

Detect with Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.

Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service.

Detect with Once adversaries have provisioned a VPS (ex: for use as a command and control server), internet scans may reveal servers that adversaries have acquired.

Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation.

Detect with Once adversaries have provisioned a server (ex: for use as a command and control server), internet scans may reveal servers that adversaries have acquired.

Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.

Detect with Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Adversaries may register for web services that can be used during targeting.

Detect with Once adversaries leverage the web service as infrastructure (ex: for command and control), it may be possible to look for unique characteristics associated with adversary software, if known.

Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services.

Detect with Consider monitoring for anomalous changes to domain registrant information and/or domain resolution information that may indicate the compromise of a domain.

Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.

Detect with Consider monitoring for anomalous changes to domain registrant information and/or domain resolution information that may indicate the compromise of a domain.

Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: Application Layer Protocol).

Detect with Consider monitoring for anomalous resolution changes for domain addresses. Efforts may need to be tailored to specific domains of interest as benign resolution changes are a common occurrence on the internet.

Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service.

Detect with Once adversaries have provisioned software on a compromised VPS (ex: for use as a command and control server), internet scans may reveal VPSs that adversaries have compromised.

Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation.

Detect with Once adversaries have provisioned software on a compromised server (ex: for use as a command and control server), internet scans may reveal servers that adversaries have compromised.

Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.

Detect with Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc.

Detect with Once adversaries leverage the abused web service as infrastructure (ex: for command and control), it may be possible to look for unique characteristics associated with adversary software, if known.

Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may compromise third-party network devices that can be used during targeting.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations.

Detect with Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently created/modified accounts making numerous connection requests to accounts affiliated with your organization.

Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be used to build a persona to further operations.

Detect with Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently created/modified accounts making numerous connection requests to accounts affiliated with your organization.

Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct Phishing for Information or Phishing.

Detect with Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: Phishing).

Adversaries may create accounts with cloud providers that can be used during targeting.

Detect with Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during exfiltration (ex: Transfer Data to Cloud Account).

Taking over legitimate email or social accounts so that later phishing arrives from a trusted sender.

Detect with Inbound mail passing SPF/DKIM from a real partner domain but with anomalous language or an unexpected attachment.

Adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important.

Detect with Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently modified accounts making numerous connection requests to accounts affiliated with your organization.

Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information, Phishing, or large-scale spam email campaigns.

Detect with Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: Phishing).

Adversaries may compromise cloud accounts that can be used during targeting.

Detect with Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during exfiltration (ex: Transfer Data to Cloud Account).

Building malware, exploits, and code-signing certificates in-house rather than buying them.

Detect with Not detectable at the victim. Consume threat intelligence and hunt the resulting hashes and TTPs.

Adversaries may develop malware and malware components that can be used during targeting.

Detect with Consider analyzing malware for features that may be associated with the adversary and/or their developers, such as compiler used, debugging artifacts, or code similarities.

Adversaries may create self-signed code signing certificates that can be used during targeting.

Detect with Consider analyzing self-signed code signing certificates for features that may be associated with the adversary and/or their developers, such as the thumbprint, algorithm used, validity period, and common name.

Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust.

Detect with Consider use of services that may aid in the tracking of certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.

Adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software.

Detect with Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on behaviors relating to the use of exploits (i.e.

Purchasing tooling, exploits, certificates, or already-established access to your network.

Detect with Dark-web and broker monitoring for your own domain and VPN ranges appearing for sale.

Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols.

Detect with Consider analyzing malware for features that may be associated with malware providers, such as compiler used, debugging artifacts, code similarities, or even group identifiers associated with specific MaaS offerings.

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial.

Detect with In some cases, malware repositories can also be used to identify features of tool use associated with an adversary, such as watermarks in Cobalt Strike payloads.

Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted.

Detect with Consider analyzing code signing certificates for features that may be associated with the adversary and/or their developers, such as the thumbprint, algorithm used, validity period, common name, and certificate authority.

Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust.

Detect with Consider use of services that may aid in the tracking of newly issued certificates and/or certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.

Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software.

Detect with Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on behaviors relating to the use of exploits (i.e.

Adversaries may acquire information about vulnerabilities that can be used during targeting.

Detect with Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on behaviors relating to the potential use of exploits for vulnerabilities (i.e.

Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting.

Detect with Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on behaviors relating to the potential use of generative artificial intelligence (i.e.

Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting.

Detect with If infrastructure or patterns in malware, tooling, certificates, or malicious web content have been previously identified, internet scanning may uncover when an adversary has staged their capabilities.

Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content.

Detect with If infrastructure or patterns in malware have been previously identified, internet scanning may uncover when an adversary has staged malware to make it accessible for targeting.

Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial.

Detect with If infrastructure or patterns in tooling have been previously identified, internet scanning may uncover when an adversary has staged tools to make them accessible for targeting.

Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems.

Detect with Consider use of services that may aid in the tracking of certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.

Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise.

Detect with If infrastructure or patterns in the malicious web content utilized to deliver a Drive-by Compromise have been previously identified, internet scanning may uncover when an adversary has staged web content for use in a strategic web compromise.

Adversaries may put in place resources that are referenced by a link that can be used during targeting.

Detect with If infrastructure or patterns in malicious web content have been previously identified, internet scanning may uncover when an adversary has staged web content to make it accessible for targeting.

Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may purchase or otherwise acquire an existing access to a target system or network. A variety of online services and initial access broker networks are available to sell access to previously compromised systems.

Detect with Much of this takes place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

Logging in with legitimate stolen credentials — the quietest way in and the hardest to distinguish from normal work.

Detect with Impossible travel, first-time ASN or country for the user, MFA fatigue patterns, logins outside the user's baseline hours.

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Detect with Monitor whether default accounts have been activated or logged into. These audits should also include checks on any appliances and applications for default credentials or SSH keys, and if any are discovered, they should be updated immediately.

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Detect with Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services. Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts.

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Detect with Perform regular audits of local system accounts to detect accounts that may have been created by an adversary for persistence. Look for suspicious account behavior, such as accounts logged in at odd times or outside of business hours.

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Detect with Monitor the activity of cloud accounts to detect abnormal or malicious behavior, such as accessing information outside of the normal function of the account or account usage at atypical hours.

Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.

Detect with Monitor file access on removable media. Detect processes that execute from removable media after it is mounted or when initiated by a user.

VPN, RDP gateways, Citrix, and VDI accessed directly with valid or brute-forced credentials.

Detect with VPN logins from residential proxy or VPS ranges; RDP exposed to the internet at all is a finding on its own.

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.

Detect with Firewalls and proxies can inspect URLs for potentially known-bad domains or parameters.

Abusing a vulnerability in an internet-exposed web app, VPN appliance, or file transfer product.

Detect with WAF blocks followed by a 200; a web server process spawning a shell (w3wp.exe or httpd launching cmd.exe / bash).

Trojanised software updates, poisoned dependencies, or compromised managed service providers.

Detect with Baseline what your update processes normally do, then alert when a signed updater deviates — new child processes, new destinations.

Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly.

Detect with Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity.

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.

Detect with Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity.

Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise.

Detect with Perform physical inspection of hardware to look for potential tampering. Perform integrity checking on pre-OS boot mechanisms that can be manipulated for malicious purposes.

Adversaries may breach or otherwise leverage organizations who have access to intended victims.

Detect with Establish monitoring for activity conducted by second and third party providers and other trusted entities that may be leveraged as a means to gain access to the network.

Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e.

Detect with Asset management systems may help with the detection of computer systems or network devices that should not exist on a network. Endpoint sensors may be able to detect the addition of hardware via USB, Thunderbolt, and other external device communication ports.

Attachments, links, or service-based delivery aimed at getting execution or credentials from a user.

Detect with Mail gateway detonation verdicts, user-reported phish queue, first-time-seen sender plus attachment execution on the endpoint.

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing.

Detect with Network intrusion detection systems and email gateways can be used to detect spearphishing with malicious attachments in transit. Detonation chambers may also be used to identify malicious attachments.

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing.

Detect with URL inspection within email (including expanding shortened links) can help detect links leading to known malicious sites as well as links redirecting to adversary infrastructure based by upon suspicious OAuth patterns with unusual TLDs..

Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing.

Detect with Because most common third-party services used for spearphishing via service leverage TLS encryption, SSL/TLS inspection is generally required to detect the initial communication/delivery.

Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may gain initial access to target systems by connecting to wireless networks.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

WMI used to execute commands locally or on remote hosts without dropping a new binary.

Detect with WmiPrvSE.exe as a parent of cmd or powershell; WMI event subscriptions created outside change windows.

schtasks, cron, at, and systemd timers used both to execute now and to survive a reboot.

Detect with Event ID 4698 (task created); new cron entries; tasks whose action points at a user-writable path.

Adversaries may abuse the at utility to perform task scheduling for initial or recurring execution of malicious code. The at utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date.

Detect with Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete.

Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code. The cron utility is a time-based job scheduler for Unix-like operating systems.

Detect with Monitor scheduled task creation from common utilities using command-line invocation. Legitimate scheduled tasks may be created during installation of new software or through system administration functions.

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows.

Detect with Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete.

Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension .timer that control services.

Detect with Systemd timer unit files may be detected by auditing file creation and modification events within the /etc/systemd/system , /usr/lib/systemd/system/ , and ~/.config/systemd/user/ directories, as well as associated symbolic links.

Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code.

Detect with Monitor for the anomalous creation of scheduled jobs in container orchestration environments. Use logging agents on Kubernetes nodes and retrieve logs from sidecar proxies for application and resource pods to monitor malicious container orchestration job deployments.

PowerShell, cmd, bash, Python, JavaScript, and Visual Basic used to run adversary commands.

Detect with Encoded PowerShell (-enc, -w hidden), Office applications spawning interpreters, script block logging (Event ID 4104).

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.

Detect with If proper execution policy is set, adversaries will likely be able to define their own execution policy if they obtain administrator or system access, either through the Registry or at the command line.

Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

Detect with Monitor for execution of AppleScript through osascript and usage of the NSAppleScript and OSAScript APIs that may be related to other suspicious behavior occurring on the system.

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems.

Detect with Usage of the Windows command shell may be common on administrator, developer, or power user systems depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious.

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g.

Detect with Unix shell usage may be common on administrator, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious.

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API.

Detect with Monitor for events associated with VB execution, such as Office applications spawning processes, usage of the Windows Script Host (typically cscript.exe or wscript.exe), file activity involving VB payloads or scripts, or loading of modules associated with VB languages (ex:…

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions.

Detect with Monitor systems for abnormal Python usage and python.exe behavior, which could be an indicator of malicious activity. Understanding standard usage patterns is important to avoid a high number of false positives.

Adversaries may abuse various implementations of JavaScript for execution.

Detect with Monitor for events associated with scripting execution, such as process activity, usage of the Windows Script Host (typically cscript.exe or wscript.exe), file activity involving scripts, or loading of modules associated with scripting languages (ex: JScript.dll).

Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.

Detect with Consider reviewing command history in either the console or as part of the running memory to determine if unauthorized or suspicious commands were used to modify device configuration.

Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network.

Detect with Detection methods will vary depending on the type of third-party software or system and how it is typically used.

Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

Detect with Monitoring API calls may generate a significant amount of data and may not be useful for defense unless collected under specific circumstances, since benign use of API functions are common and may be difficult to distinguish from malicious behavior.

Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API).

Detect with Monitoring DLL module loads may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances, since benign use of Windows modules load functions are common and may be difficult to distinguish from malicious…

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior.

Detect with Detecting software exploitation may be difficult depending on the tools available. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the browser or Office processes.

The user opens the attachment, mounts the ISO, runs the installer, or pastes the ClickFix command.

Detect with Process trees rooted in a mail client or browser download directory; execution from temp, Downloads, or a mounted image.

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution.

Detect with Inspect network traffic for indications that a user visited a malicious site, such as links included in phishing campaigns directed at your organization.

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution.

Detect with Monitor the execution of and command-line arguments for applications that may be used by an adversary to gain initial access that require user interaction.

Adversaries may rely on a user running a malicious image to facilitate execution.

Detect with Monitor the local image registry to make sure malicious images are not added. Track the deployment of new containers, especially from newly built images.

An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution.

Detect with Monitor for strings in files/commands, loaded DLLs/libraries, or spawned processes that are associated with abuse of IPC mechanisms.

Adversaries may use the Windows Component Object Model (COM) for local code execution.

Detect with Monitor for COM objects loading DLLs and other modules not typically associated with the application. Enumeration of COM objects, via Query Registry or PowerShell, may also proceed malicious use.

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications.

Detect with Monitor processes for abnormal behavior indicative of DDE abuse, such as Microsoft Office applications loading DLLs and other modules not typically associated with the application or these applications spawning unusual processes (such as cmd.exe).

Adversaries can provide malicious content to an XPC service daemon for local code execution.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Creating or abusing services (including PsExec-style service installs) to execute payloads as SYSTEM.

Detect with Event ID 7045 (service installed) with a random-looking service name or a binary path in ADMIN$.

Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS.

Detect with Every Launch Agent and Launch Daemon must have a corresponding plist file on disk which can be monitored. Monitor for recently modified or created plist files with a significant change to the executable path executed with the command-line launchctl command.

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( services.exe ) is an interface to manage and manipulate services.

Detect with Changes to service Registry entries and command line invocation of tools capable of modifying services that do not correlate with known software, patch cycles, etc., may be suspicious.

Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may abuse a container administration service to execute commands within a container.

Detect with Container administration service activities and executed commands can be captured through logging of process execution with command-line arguments on the container and the underlying host.

Adversaries may deploy a container into an environment to facilitate execution or evade defenses.

Detect with Monitor for suspicious or unknown container images and pods in your environment. Deploy logging agents on Kubernetes nodes and retrieve logs from sidecar proxies for application pods to detect malicious activity at the cluster level.

Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may abuse cloud management services to execute commands within virtual machines.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting…

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.

Detect with Monitor logon scripts for unusual access by abnormal users or at abnormal times. Look for files added or modified by unusual accounts outside of normal administration duties.

Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.

Detect with Monitor for changes to Registry values associated with Windows logon scrips, nameley HKCU\Environment\UserInitMprLogonScript . Monitor running process for actions that could be indicative of abnormal programs or executables running upon logon.

Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon.

Detect with Monitor logon scripts for unusual access by abnormal users or at abnormal times. Look for files added or modified by unusual accounts outside of normal administration duties.

Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence. Network logon scripts can be assigned using Active Directory or Group Policy Objects.

Detect with Monitor logon scripts for unusual access by abnormal users or at abnormal times. Look for files added or modified by unusual accounts outside of normal administration duties.

Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels.

Detect with Monitor for unexpected changes to RC scripts in the /etc/ directory. Monitor process execution resulting from RC scripts for unusual or unknown applications or behavior.

Adversaries may use startup items automatically executed at boot initialization to establish persistence.

Detect with The /Library/StartupItems folder can be monitored for changes. Similarly, the programs that are actually executed from this mechanism should be checked against a whitelist.

Adding credentials to an existing account — SSH keys, app registrations, additional MFA devices.

Detect with New MFA method registered immediately after a suspicious sign-in; new service principal credentials in cloud audit logs.

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Detect with Monitor Azure Activity Logs for Service Principal and Application modifications. Monitor for the usage of APIs that create or import SSH keys, particularly by unexpected users or accounts such as the root account.

Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.

Detect with Monitor for unusual Exchange and Office 365 email account permissions changes that may indicate excessively broad permissions being granted to compromised accounts. Enable the UpdateFolderPermissions action for all logon types.

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant.

Detect with Collect activity logs from IAM services and cloud administrator accounts to identify unusual activity in the assignment of roles to those accounts. Monitor for accounts assigned to admin roles that go over a certain threshold of known admins.

Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management.

Detect with Use file integrity monitoring to detect changes made to the authorized_keys file for each user on a system. Monitor for suspicious processes modifying the authorized_keys file.

Adversaries may register a device to an adversary-controlled account.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Detect with Modifications to the Registry are normal and occur throughout typical use of the Windows operating system.

New local, domain, or cloud accounts created to provide a durable second way in.

Detect with Event ID 4720 (account created) and 4732 (added to privileged group), especially outside business hours.

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Detect with Monitor for processes and command-line parameters associated with local account creation, such as net user /add , useradd , and dscl -create . Collect data on account creation within a network.

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain.

Detect with Monitor for processes and command-line parameters associated with domain account creation, such as net user /add /domain . Collect data on account creation within a network.

Adversaries may create a cloud account to maintain access to victim systems.

Detect with Collect usage logs from cloud user and administrator accounts to identify unusual activity in the creation of new accounts and assignment of roles to those accounts. Monitor for accounts assigned to admin roles that go over a certain threshold of known admins.

Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network.

Detect with Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes. Non-standard process execution trees may also indicate suspicious or malicious behavior.

Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles.

Detect with Many Office-related persistence mechanisms require changes to the Registry and for binaries, files, or scripts to be written to disk or existing files modified to include malicious scripts.

Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system.

Detect with Monitor for the creation of the Office Test Registry key. Many Office-related persistence mechanisms require changes to the Registry and for binaries, files, or scripts to be written to disk or existing files modified to include malicious scripts.

Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages.

Detect with Microsoft has released a PowerShell script to safely gather mail forwarding rules and custom forms in your mail environment as well as steps to interpret the output.

Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders.

Detect with Microsoft has released a PowerShell script to safely gather mail forwarding rules and custom forms in your mail environment as well as steps to interpret the output.

Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages.

Detect with Microsoft has released a PowerShell script to safely gather mail forwarding rules and custom forms in your mail environment as well as steps to interpret the output.

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs.

Detect with Monitor and validate the Office trusted locations on the file system and audit the Registry entries relevant for enabling add-ins.

Adversaries may abuse software extensions to establish persistent access to victim systems.

Detect with Inventory and monitor browser extension installations that deviate from normal, expected, and benign extensions. Process and network monitoring can be used to detect browsers communicating with a C2 server.

Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM).

Detect with BITS runs as a service and its status can be checked with the Sc query utility ( sc query bits ). Active BITS tasks can be enumerated using the BITSAdmin tool ( bitsadmin /list /allusers /verbose ).

Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control.

Detect with Record network packets sent to and from the system, looking for extraneous packets that do not belong to established flows. The Wake-on-LAN magic packet consists of 6 bytes of FF followed by sixteen repetitions of the target system's IEEE address.

Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports.

Detect with Record network packets sent to and from the system, looking for extraneous packets that do not belong to established flows.

Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control.

Detect with Identify running processes with raw sockets. Ensure processes listed have a need for an open raw socket and are in accordance with enterprise policy.

Web shells, IIS modules, and SQL stored procedures planted inside legitimate server software.

Detect with New .aspx/.php files in web roots; web server processes spawning shells; file integrity monitoring on web directories.

Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries.

Detect with On a MSSQL Server, consider monitoring for xp_cmdshell usage. Consider enabling audit features that can log malicious startup activities.

Adversaries may abuse Microsoft transport agents to establish persistent access to systems.

Detect with Consider monitoring application logs for abnormal behavior that may indicate suspicious installation of application software components.

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network.

Detect with Web shells can be difficult to detect. Unlike other forms of persistent remote access, they do not initiate connections.

Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers.

Detect with Monitor for creation and/or modification of files (especially DLLs on webservers) that could be abused as malicious ISAPI extensions/filters or IIS modules. Changes to %windir%\system32\inetsrv\config\applicationhost.config could indicate an IIS module installation.

Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts.

Detect with Monitor for changes to Registry keys associated with ServiceDll and other subkey values under HKLM\System\CurrentControlSet\services\TermService\Parameters\ . Monitor unexpected changes and/or interactions with termsrv.dll , which is typically stored in %SystemRoot%\System32\ .

Adversaries may abuse vSphere Installation Bundles (VIBs) to establish persistent access to ESXi hypervisors. VIBs are collections of files used for software distribution and virtual system management in VMware environments.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment.

Detect with Monitor interactions with images and containers by users to identify ones that are added or modified anomalously.

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system.

Detect with Perform integrity checking on pre-OS boot mechanisms that can be manipulated for malicious purposes. Take snapshots of boot records and firmware and compare against known good images.

Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software…

Detect with System firmware manipulation may be detected. Dump and inspect BIOS images on vulnerable systems and compare against known good images.

Adversaries may modify component firmware to persist on systems.

Detect with Data and telemetry from use of device drivers (i.e. processes and API calls) and/or provided by SMART (Self-Monitoring, Analysis and Reporting Technology) disk monitoring may reveal malicious manipulations of components.

Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious code to execute before a computer's operating system has loaded.

Detect with Perform integrity checking on MBR and VBR. Take snapshots of MBR and VBR and compare against known good samples.

Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect.

Detect with There are no documented means for defenders to validate the operation of the ROMMON outside of vendor support. If a network device is suspected of being compromised, contact the vendor to assist in further investigation.

Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server.

Detect with Consider comparing a copy of the network device configuration and system image against a known-good version to discover unauthorized changes to system boot, startup configuration, or the running OS.

Windows services, launch daemons, and systemd units created or hijacked for persistence.

Detect with Event ID 7045; new unit files in /etc/systemd/system; service binaries in unusual paths.

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

Detect with Monitor Launch Agent creation through additional plist files and utilities such as Objective-See’s KnockKnock application. Launch Agents also require files on disk for persistence which can also be monitored via other file monitoring applications.

Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence.

Detect with Monitor file creation and modification events of Systemd service unit configuration files in the default directory locations for root & user level permissions.

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.

Detect with Monitor processes and command-line arguments for actions that could create or modify services. Command-line invocation of tools capable of adding or modifying services may be unusual, depending on how systems are typically used in a particular environment.

Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

Detect with Monitor for new files added to the /Library/LaunchDaemons/ folder. The System LaunchDaemons are protected by SIP.

Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Detect with Monitoring for additions or modifications of mechanisms that could be used to trigger event-based execution, especially the addition of abnormal commands such as execution of unknown programs, opening network sockets, or reaching out across the network.

Adversaries may establish persistence by executing malicious content triggered by a file type association. When a file is opened, the default program used to open the file (also called the file association or handler) is checked.

Detect with Collect and analyze changes to Registry keys that associate file extensions to default applications for execution and correlate with unknown process launch activity or unusual file types for that process.

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

Detect with Monitor process execution and command-line parameters of .scr files. Monitor changes to screensaver configuration changes in the Registry that may not correlate with typical user behavior.

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

Detect with Monitor WMI event subscription entries, comparing current WMI event subscriptions to known good subscriptions for each host. Tools such as Sysinternals Autoruns may also be used to detect WMI changes that could be attempts at persistence.

Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events.

Detect with While users may customize their shell profile files, there are only certain types of commands that typically appear in these files.

Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals.

Detect with Trap commands must be registered for the shell or programs, so they appear in files. Monitoring files for suspicious or overly broad trap commands can narrow down suspicious behavior during an investigation.

Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded.

Detect with Monitor processes for those that may be used to modify binary headers. Monitor file systems for changes to application binaries and invalid checksums/signatures.

Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Detect with It is likely unusual for netsh.exe to have any child processes in most environments. Monitor process executions and investigate any child processes spawned by netsh.exe for malicious behavior.

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.

Detect with Changes to accessibility utility binaries or binary paths that do not correlate with known software, patch cycles, etc., are suspicious. Command line invocation of tools capable of modifying the Registry for associated keys are also suspicious.

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.

Detect with Monitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process. Monitor the AppCertDLLs Registry value for modifications that do not correlate with known software, patch cycles, etc.

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

Detect with Monitor DLL loads by processes that load user32.dll and look for DLLs that are not recognized or not normally loaded into a process. Monitor the AppInit_DLLs Registry values for modifications that do not correlate with known software, patch cycles, etc.

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.

Detect with There are several public tools available that will detect shims that are currently available : Shim-Process-Scanner - checks memory of every running process for any shim flags Shim-Detector-Lite - detects installation of custom shim databases Shim-Guard - monitors registry for…

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application.

Detect with Monitor for abnormal usage of the GFlags tool as well as common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as DEBUG_PROCESS and DEBUG_ONLY_THIS_PROCESS .

Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles.

Detect with Locations where profile.ps1 can be stored should be monitored for new profiles or modifications.

Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a Launch Daemon that accepts events from various services, runs them through a simple rules engine, and takes action.

Detect with Monitor emond rules creation by checking for files created or modified in /etc/emond.d/rules/ and /private/var/db/emondClients .

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.

Detect with There are opportunities to detect COM hijacking by searching for Registry references that have been replaced and through Registry operations (ex: Reg) replacing known binary paths with unknown paths or otherwise malicious content.

Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may maintain persistence through executing malicious content triggered using udev rules.

Detect with Monitor file creation and modification of Udev rule files in /etc/udev/rules.d/, /lib/udev/rules.d/, and /usr/lib/udev/rules.d/, specifically the RUN action key commands.

Run keys, startup folders, Winlogon helpers, and LSA drivers that execute on boot or logon.

Detect with Registry writes to Run/RunOnce by non-installer processes; new files in Startup folders.

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.

Detect with Monitor Registry for changes to run keys that do not correlate with known software, patch cycles, etc. Monitor the start folder for additions or changes.

Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start.

Detect with Monitor the Registry for changes to the LSA Registry keys. Monitor the LSA process for DLL loads.

Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.

Detect with Baseline values and monitor/analyze activity related to modifying W32Time information in the Registry, including application programming interface (API) calls such as RegCreateKeyEx and RegSetValueEx as well as execution of the W32tm.exe utility.

Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.

Detect with Monitor for changes to Registry entries associated with Winlogon that do not correlate with known software, patch cycles, etc.

Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start.

Detect with Monitor the Registry for changes to the SSP Registry keys. Monitor the LSA process for DLL loads.

Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.

Detect with Loading, unloading, and manipulating modules on Linux systems can be detected by monitoring for the following commands: modprobe , insmod , lsmod , rmmod , or modinfo LKMs are typically loaded into /lib/modules and have had the extension .ko ("kernel object") since version 2.6…

Adversaries may modify plist files to automatically run an application when a user logs in.

Detect with Monitoring the specific plist files associated with reopening applications can indicate when an application has registered itself to be reopened.

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain.

Detect with With LSA Protection enabled, monitor the event logs (Events 3033 and 3063) for failed attempts to load LSA plug-ins and drivers. Also monitor DLL load operations in lsass.exe.

Adversaries may create or modify shortcuts that can execute a program during system boot or user login.

Detect with Since a shortcut's target path likely will not change, modifications to shortcut files that do not correlate with known software changes, patches, removal, etc., may be suspicious.

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.

Detect with Monitor process API calls to AddMonitor . Monitor DLLs that are loaded by spoolsv.exe for DLLs that are abnormal.

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, spoolsv.exe, during boot.

Detect with Monitor process API calls to AddPrintProcessor and GetPrintProcessorDirectory . New print processor DLLs are written to the print processor directory.

Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login. XDG Autostart entries are available for any XDG-compliant Linux system.

Detect with Malicious XDG autostart entries may be detected by auditing file creation and modification events within the /etc/xdg/autostart and ~/.config/autostart directories.

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in.

Detect with Monitor Registry key additions and/or modifications to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\ .

Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.

Detect with All login items created via shared file lists are viewable by using the System Preferences GUI or in the ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm file. These locations should be monitored and audited for known good applications.

Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries.

Detect with Collect and analyze signing certificate metadata and check signature validity on software that executes within the environment. Look for changes to client software that do not correlate with known software or patch cycles.

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.

Detect with Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer.

Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.

Detect with Monitor for calls to OpenProcess that can be used to manipulate lsass.exe running on a domain controller as well as for malicious modifications to functions exported from authentication-related system DLLs (such as cryptdll.dll and samsrv.dll).

Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.

Detect with Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer.

Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts.

Detect with Monitor PAM configuration and module paths (ex: /etc/pam.d/ ) for changes. Use system-integrity tools such as AIDE and monitoring tools such as auditd to monitor PAM files.

Adversaries may use Patch System Image to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.

Detect with Consider verifying the checksum of the operating system file and verifying the image of the operating system in memory. Detection of this behavior may be difficult, detection efforts may be focused on closely related adversary behaviors, such as Modify System Image.

An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems.

Detect with Monitor property changes in Group Policy: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Store passwords using reversible encryption . By default, the property should be set to Disabled.

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credentials, and enable persistent access to accounts.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time.

Detect with Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious.

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs.

Detect with Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious.

Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime.

Detect with Monitor file systems for moving, renaming, replacing, or modifying dylibs. Changes in the set of dylibs that are loaded by a process (compared to past behavior) that do not correlate with known software, patches, etc., are suspicious.

Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions.

Detect with Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior.

Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries.

Detect with Monitor for changes to environment variables and files associated with loading shared libraries such as LD_PRELOAD and DYLD_INSERT_LIBRARIES , as well as the commands to implement these changes.

Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries.

Detect with Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable.

Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs.

Detect with Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable.

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.

Detect with Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable.

Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start.

Detect with Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior.

Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.

Detect with Service changes are reflected in the Registry. Modification to existing services should not occur frequently.

Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR.

Detect with For detecting system and user scope abuse of the COR_PROFILER, monitor the Registry for changes to COR_ENABLE_PROFILING, COR_PROFILER, and COR_PROFILER_PATH that correspond to system and user environment variables that do not correlate to known developer tools.

Adversaries may abuse the KernelCallbackTable of a process to hijack its execution flow in order to run their own payloads.

Detect with Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious behaviors that could relate to post-compromise behavior.

Adversaries may execute their own malicious payloads by hijacking how the .NET AppDomainManager loads assemblies.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.

Detect with Command-line invocation of tools capable of modifying services may be unusual and can be monitored for and alerted on, depending on how systems are typically used in a particular environment.

Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-service environment.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Writing code into another live process to run under its identity and evade process-based controls.

Detect with CreateRemoteThread and cross-process memory writes; RWX memory regions with no backing file on disk.

Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.

Detect with Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions…

Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.

Detect with Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions…

Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process.

Detect with Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions…

Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges.

Detect with Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions…

Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges.

Detect with Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions…

Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

Detect with Monitoring for Linux specific calls such as the ptrace system call should not generate large amounts of data due to their specialized nature, and can be a very effective method to detect some of the common process injection methods.

Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges.

Detect with File system monitoring can determine if /proc files are being modified. Users should not have permission to modify these in most cases.

Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges.

Detect with Monitor for API calls related to enumerating and manipulating EWM such as GetWindowLong and SetWindowLong . Malware associated with this technique have also used SendNotifyMessage to trigger the associated window procedure and eventual malicious injection.

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

Detect with Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions…

Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges.

Detect with Monitor and analyze calls to CreateTransaction , CreateFileTransacted , RollbackTransaction , and other rarely used functions indicative of TxF activity.

Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges.

Detect with Monitor for malicious usage of system calls, such as ptrace and mmap, that can be used to attach to, manipulate memory, then redirect a processes' execution path.

Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

Detect with Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions…

Kernel and driver vulnerabilities, including bring-your-own-vulnerable-driver, used to reach SYSTEM or root.

Detect with Unsigned or known-vulnerable driver loads; process integrity level jumping without a legitimate elevation path.

Stealing or impersonating another process's token to inherit its privileges.

Detect with Process access with high-privilege rights (0x1410) against SYSTEM processes; SeDebugPrivilege use by unexpected binaries.

Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using DuplicateToken or DuplicateTokenEx.

Detect with If an adversary is using a standard command-line shell, analysts can detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the runas command.

Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas .

Detect with If an adversary is using a standard command-line shell (i.e. Windows Command Shell), analysts may detect token manipulation by auditing command-line activity.

Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls.

Detect with If an adversary is using a standard command-line shell, analysts can detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the runas command.

Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified.

Detect with Look for inconsistencies between the various fields that store PPID information, such as the EventHeader ProcessId from data collected via Event Tracing for Windows (ETW), Creator Process ID/Name from Windows event logs, and the ProcessID and ParentProcessID (which are also…

Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account.

Detect with Examine data in user’s SID-History attributes using the PowerShell Get-ADUser cmdlet , especially users who have SID-History values from the same domain. Also monitor account management events on Domain Controllers for successful and failed changes to SID-History.

Group Policy and tenant-level trust changes that grant the adversary durable elevated rights.

Detect with GPO modifications outside change windows; new federated trust or domain added to the tenant.

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.

Detect with It is possible to detect GPO modifications by monitoring directory service changes using Windows event logs.

Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not…

Detect with Monitor for modifications to domain trust settings, such as when a user or application modifies the federation settings on the domain or updates domain authentication from Managed to Federated via ActionTypes Set federation settings on domain and Set domain authentication .

UAC bypasses, sudo abuse, setuid binaries, and elevated COM interfaces.

Detect with fodhelper.exe / computerdefaults.exe registry hijacks; sudo invocations by service accounts.

An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context.

Detect with Monitor the file system for files that have the setuid or setgid bits set. Monitor for execution of utilities, like chmod, and their command-line arguments to look for setuid or setguid bits being set.

Adversaries may bypass UAC mechanisms to elevate process privileges on system.

Detect with There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations.

Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.

Detect with On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo).

Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.

Detect with Consider monitoring for /usr/libexec/security_authtrampoline executions which may indicate that AuthorizationExecuteWithPrivileges is being executed. MacOS system logs may also indicate when AuthorizationExecuteWithPrivileges is being called.

Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself.

Detect with Monitor for the deployment of suspicious or unknown container images and pods in your environment, particularly containers running as root.

Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes.

Detect with Monitor handle opens on drive volumes that are made by processes to determine when they may directly access logical drives. Monitor processes and command-line arguments for actions that could be taken to copy files from the logical drive and evade common file system protections.

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.

Detect with Some rootkit protections may be built into anti-virus or operating system software. There are dedicated rootkit detection tools that look for specific types of rootkit behavior.

Base64, packing, encryption, and steganography that keep payloads unreadable to static inspection.

Detect with High-entropy command lines, long encoded blobs in script block logs, packed binaries with tiny import tables.

Adversaries may use binary padding to add junk data and change the on-disk representation of malware.

Detect with Depending on the method used to pad files, a file-based signature may be capable of detecting padding using a scanning or on-access based tool.

Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable.

Detect with Use file scanning to look for known software packers or artifacts of packing techniques. Packing is not a definitive indicator of malicious activity, because legitimate software may use packing techniques to reduce binary size or to protect proprietary code.

Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.

Detect with Detection of steganography is difficult unless artifacts are left behind by the obfuscation process that are detectable with a known signature. Look for strings or other signatures left in system artifacts related to decoding steganography.

Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries.

Detect with Monitor the execution file paths and command-line arguments for common compilers, such as csc.exe and GCC/MinGW, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.

Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed.

Detect with The first detection of a malicious tool may trigger an anti-virus or other security tool alert. Similar events may also occur at the boundary through network IDS, email scanning appliance, etc.

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files.

Detect with Detection of HTML Smuggling is difficult as HTML5 and JavaScript attributes are used by legitimate services and applications.

Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files. SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Naming malware svchost.exe, planting it outside System32, or using right-to-left override in filenames.

Detect with Known system binary names running from non-system paths; signature mismatches against the expected publisher.

Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.

Detect with Collect and analyze signing certificate metadata and check signature validity on software that executes within the environment, look for invalid signatures as well as unusual certificate characteristics and outliers.

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse.

Detect with Detection methods should include looking for common formats of RTLO characters within filenames such as \u202E , [U+202E] , and %E2%80%AE .

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities.

Detect with If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled.

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.

Detect with Look for changes to tasks and services that do not correlate with known software, patch cycles, etc. Suspicious program execution through scheduled tasks or services may show up as outlier processes that have not been seen before when compared against historical data.

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Detect with Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect.

Adversaries can hide a program's true filetype by changing the extension of a file.

Detect with It's not common for spaces to be at the end of filenames, so this is something that can easily be checked with file monitoring. From the user's perspective though, this is very hard to notice from within the Finder.app or on the command-line in Terminal.app.

Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.

Detect with Monitor for files written to disk that contain two file extensions, particularly when the second is an executable.

Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID).

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during Create Account, although accounts may also be renamed at a later date.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Deleting logs, files, and shell history, and timestomping artefacts to break timeline reconstruction.

Detect with wevtutil cl, `history -c`, mass file deletion in temp; MFT timestamps that disagree with $FILE_NAME.

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications.

Detect with Deleting Windows event logs (via native binaries , API functions , or PowerShell ) may also generate an alterable event (Event ID 1102: "The audit log was cleared").

Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs.

Detect with File system monitoring may be used to detect improper deletion or modification of indicator files. Also monitor for suspicious processes interacting with log files.

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

Detect with User authentication, especially via remote terminal services like SSH, without new entries in that user's ~/.bash_history is suspicious. Additionally, the removal/clearing of the ~/.bash_history file can be an indicator of suspicious activity.

Adversaries may delete files left behind by the actions of their intrusion activity.

Detect with It may be uncommon for events related to benign command-line functions such as DEL or third-party utilities or tools to be found in an environment, depending on the user base and how systems are typically used.

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed.

Detect with Network share connections may be common depending on how an network environment is used. Monitor command-line invocation of net use commands associated with establishing and removing remote shares over SMB, including following best practices for detection of Windows Admin Shares.

Adversaries may modify file time attributes to hide new files or changes to existing files.

Detect with Forensic techniques exist to detect aspects of files that have had their timestamps modified. It may be possible to detect timestomping using file modification monitoring that collects information on file handle opens and can compare timestamp values.

Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads.

Detect with Monitor for abnormal presence of these or other utilities that enable proxy execution that are typically used for development, debugging, and reverse engineering on a system that is not used for these purposes may be suspicious.

Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio.

Detect with Use process monitoring to monitor the execution and arguments of MSBuild.exe. Compare recent invocations of those binaries with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity.

Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may use JamPlus to proxy the execution of a malicious script. JamPlus is a build utility tool for code and data build systems.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it.

Detect with Detecting the action of deobfuscating or decoding files or information may be difficult depending on the implementation.

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd.

Detect with Monitor and analyze logs from host-based detection mechanisms, such as Sysmon, for events such as process creations that include or are resulting from parameters associated with invoking programs/commands/files and/or spawning child processes/network connections.

Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC).

Detect with Monitor and analyze network traffic associated with data replication (such as calls to DrsAddEntry, DrsReplicaAdd, and especially GetNCChanges) between DCs as well as to/from non DC hosts.

Adversaries may exploit a system or application vulnerability to bypass security features.

Detect with Exploitation for defense evasion may happen shortly after the system has been compromised to prevent detection during later actions for for additional tools that may be brought in and used. Detecting software exploitation may be difficult depending on the tools available.

Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files.

Detect with Monitor script processes, such as cscript, and command-line parameters for scripts like PubPrn.vbs that may be used to proxy execution of malicious files.

Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services.

Detect with Monitor script processes, such as cscript, and command-line parameters for scripts like PubPrn.vbs that may be used to proxy execution of malicious files.

Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious PowerShell commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V).

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Living-off-the-land binaries (rundll32, mshta, regsvr32, msiexec) executing payloads under trusted names.

Detect with LOLBins with network connections or unusual command lines; check the LOLBAS project for expected arguments.

Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system.

Detect with Monitor and analyze the execution and arguments of hh.exe. Compare recent invocations of hh.exe with prior history of known good arguments to determine anomalous and potentially adversarial activity (ex: obfuscated and/or malicious commands).

Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.

Detect with Monitor and analyze activity related to items associated with CPL files, such as the control.exe and the Control_RunDLL and ControlRunDLLAsUser API functions in shell32.dll.

Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles.

Detect with Use process monitoring to detect and analyze the execution and arguments of CMSTP.exe. Compare recent invocations of CMSTP.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity.

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility.

Detect with Use process monitoring to monitor the execution and arguments of InstallUtil.exe. Compare recent invocations of InstallUtil.exe with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity.

Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility.

Detect with Use process monitoring to monitor the execution and arguments of mshta.exe. Look for mshta.exe executing raw or obfuscated script within the command-line.

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).

Detect with Use process monitoring to monitor the execution and arguments of msiexec.exe. Compare recent invocations of msiexec.exe with prior history of known good arguments and executed MSI files or DLLs to determine anomalous and potentially adversarial activity.

Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.

Detect with Use process monitoring to monitor the execution and arguments of odbcconf.exe. Compare recent invocations of odbcconf.exe with prior history of known good arguments and loaded DLLs to determine anomalous and potentially adversarial activity.

Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies.

Detect with Use process monitoring to monitor the execution and arguments of Regsvcs.exe and Regasm.exe. Compare recent invocations of Regsvcs.exe and Regasm.exe with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity.

Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems.

Detect with Use process monitoring to monitor the execution and arguments of regsvr32.exe. Compare recent invocations of regsvr32.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity.

Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e.

Detect with Use process monitoring to monitor the execution and arguments of rundll32.exe. Compare recent invocations of rundll32.exe with prior history of known good arguments and loaded DLLs to determine anomalous and potentially adversarial activity.

Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.

Detect with Use process monitoring to monitor the execution and arguments of verclsid.exe. Compare recent invocations of verclsid.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity.

Adversaries may abuse mavinject.exe to proxy execution of malicious code.

Detect with Monitor the execution and arguments of mavinject.exe. Compare recent invocations of mavinject.exe with prior history of known good arguments and injected DLLs to determine anomalous and potentially adversarial activity.

Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt.

Detect with Monitor processes and command-line parameters for suspicious or malicious use of MMC. Since MMC is a signed Windows binary, verify use of MMC is legitimate and not malicious.

Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

Detect with Use process monitoring to monitor the execution and arguments of msxsl.exe and wmic.exe.

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.

Detect with Analyze process behavior to determine if user document applications (such as Office) are performing actions, such as opening network connections, reading files, spawning abnormal child processes (ex: PowerShell), or other suspicious actions that could relate to post-compromise…

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

Detect with Monitor and investigate attempts to modify ACLs and file/directory ownership.

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

Detect with Monitor and investigate attempts to modify DACLs and file/directory ownership.

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

Detect with Monitor and investigate attempts to modify ACLs and file/directory ownership.

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

Detect with Detecting the use of guardrails may be difficult depending on the implementation. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection.

Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment.

Detect with Detecting the use of environmental keying may be difficult depending on the implementation.

Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

Detect with Virtualization, sandbox, user activity, and related discovery techniques will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

Detect with Virtualization/sandbox related system checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.

Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments.

Detect with User activity-based checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.

Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments.

Detect with Time-based evasion will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.

Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.

Detect with Monitor system logs to review activities occurring across all cloud environments and regions. Configure alerting to notify of activity in normally unused regions or if the number of instances active in a region goes above a certain threshold.

Pass-the-hash, pass-the-ticket, and stolen web session cookies authenticating without the password.

Detect with NTLM logons where Kerberos is expected; a logon with no preceding interactive credential entry.

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems.

Detect with Monitor access token activity for abnormal use and permissions granted to unusual or suspicious applications and APIs.

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password.

Detect with Audit all logon and credential use events and review for discrepancies. Unusual remote logins that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity.

Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.

Detect with Audit all Kerberos authentication and credential use events and review for discrepancies. Unusual remote authentication events that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity.

Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.

Detect with Monitor for anomalous access of websites and cloud-based applications by the same user in different locations or by different systems that do not match expected configurations.

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.

Detect with Collect and analyze signing certificate metadata on software that executes within the environment to look for unusual certificate characteristics and outliers.

Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs.

Detect with The removal of the com.apple.quarantine flag by a user instead of the operating system is a suspicious action and should be examined further. Monitor and investigate attempts to modify extended file attributes with utilities such as xattr .

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with.

Detect with Collect and analyze signing certificate metadata on software that executes within the environment to look for unusual certificate characteristics and outliers.

Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks.

Detect with Periodically baseline registered SIPs and trust providers (Registry entries and files on disk), specifically looking for new, modified, or non-Microsoft entries.

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA).

Detect with A system's root certificates are unlikely to change frequently. Monitor new certificates installed on a system that could be due to malicious activity.

Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls.

Detect with Monitor compressed/archive and image files downloaded from the Internet as the contents may not be tagged with the MOTW. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities.

Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with.

Detect with Monitor processes and command-line arguments for actions that could be taken to modify the code signing policy of a system, such as bcdedit.exe -set TESTSIGNING ON .

Disabling EDR, AV, firewall rules, or logging to blind the defenders before the noisy work begins.

Detect with Event ID 1102 (audit log cleared), 104 (log cleared), Defender tamper alerts, agent heartbeat gaps.

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.

Detect with Monitor processes and command-line arguments to see if security tools/services are killed or stop running. Monitor Registry edits for modifications to services and startup programs that correspond to security tools.

Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.

Detect with Monitor processes and command-line arguments for commands that can be used to disable logging. For example, Wevtutil, auditpol, sc stop EventLog, and offensive tooling (such as Mimikatz and Invoke-Phant0m) may be used to clear logs.

Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

Detect with Correlating a user session with a distinct lack of new commands in their .bash_history can be a clue to suspicious behavior. Additionally, users checking or changing their HISTCONTROL , HISTFILE , or HISTFILESIZE environment variables may be suspicious.

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules.

Detect with Monitor processes and command-line arguments to see if firewalls are disabled or modified. Monitor Registry edits to keys that manage firewalls.

An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed.

Detect with Detect lack of reported activity from a host sensor. Different methods of blocking may cause different disruptions in reporting.

Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in Disable or Modify System Firewall.

Detect with Monitor cloud logs for modification or creation of new security groups or firewall rules.

An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection.

Detect with Monitor logs for API calls to disable logging. In AWS, monitor for: StopLogging and DeleteTrail .

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services.

Detect with Monitor Registry modification and additions for services that may start on safe mode.

Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls.

Detect with Monitor for commands or other activity that may be indicative of attempts to abuse older or deprecated technologies (ex: powershell –v 2 ).

Adversaries may spoof security alerting from tools, presenting false evidence to impair defenders’ awareness of malicious activity.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may disable or modify the Linux audit system to hide malicious activity and avoid detection. Linux admins use the Linux Audit system to track security-relevant information on a system.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.

Detect with Monitor files, processes, and command-line arguments for actions indicative of hidden artifacts. Monitor event and authentication logs for records of hidden artifacts being used.

Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file.

Detect with Monitor the file system and shell commands for files being created with a leading "." and the Windows command-line use of attrib.exe to add the hidden attribute.

Adversaries may use hidden users to hide the presence of user accounts they create or modify.

Detect with Monitor for users that may be hidden from the login screen but still present in additional artifacts of usage such as directories and authentication logs.

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden.

Detect with Monitor processes and command-line arguments for actions indicative of hidden windows. In Windows, enable and configure event logging and PowerShell logging to check for the hidden window style.

Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition.

Detect with Forensic techniques exist to identify information stored in NTFS EA. Monitor calls to the ZwSetEaFile and ZwQueryEaFile Windows API functions as well as binaries used to interact with EA, and consider regularly scanning for the presence of modified information.

Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage.

Detect with Detecting the use of a hidden file system may be exceptionally difficult depending on the implementation.

Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment.

Detect with Consider monitoring for files and processes associated with running a virtual instance, such as binary files associated with common virtualization technologies (ex: VirtualBox, VMware, QEMU, Hyper-V). Consider monitoring the size of virtual machines running on the system.

Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data. MS Office documents with embedded VBA content store source code inside of module streams.

Detect with Detection efforts should be placed finding differences between VBA source code and p-code. VBA code can be extracted from p-code before execution with tools such as the pcodedmp disassembler.

Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails.

Detect with Monitor email clients and applications for suspicious activity, such as missing messages or abnormal configuration and/or log entries. On Windows systems, monitor for creation of suspicious inbox rules through the use of the New-InboxRule and Set-InboxRule PowerShell cmdlets.

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications.

Detect with Identify files with the com.apple.ResourceFork extended attribute and large data amounts stored in resource forks.

Adversaries may attempt to hide process command-line arguments by overwriting process memory.

Detect with Detection of process argument spoofing may be difficult as adversaries may momentarily modify stored arguments used for malicious execution. These changes may bypass process creation detection and/or later process memory analysis.

Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. Many operating systems use signals to deliver messages to control process behavior.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from native utilities. A bind mount maps a directory or file from one location on the filesystem to another, similar to a shortcut on Windows.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide their malicious data in order to evade detection. Extended attributes are key-value pairs of file and directory metadata used by both macOS and Linux.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses.

Detect with Establish centralized logging for the activity of cloud compute infrastructure components.

An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume.

Detect with The creation of a snapshot is a common part of operations within many cloud environments.

An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses.

Detect with The creation of a new instance or VM is a common part of operations within many cloud environments. Events should then not be viewed in isolation, but as part of a chain of behavior that could lead to other activities.

An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence.

Detect with The deletion of a new instance or virtual machine is a common part of operations within many cloud environments. Events should then not be viewed in isolation, but as part of a chain of behavior that could lead to other activities.

An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence.

Detect with Establish centralized logging of instance activity, which can be used to monitor and review system events even after reverting to a snapshot, rolling back changes, or changing persistence/type of storage.

Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation.

Detect with Consider monitoring network traffic on both interfaces of border network devices with out-of-band packet capture or network flow data, using a different device than the one in question.

Adversaries may bridge network boundaries by modifying a network device’s Network Address Translation (NAT) configuration.

Detect with Consider monitoring network traffic on both interfaces of border network devices. Compare packets transmitted by the device between networks to look for signs of NAT being implemented.

Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.

Detect with There is no documented method for defenders to directly identify behaviors that weaken encryption. Detection efforts may be focused on closely related adversary behaviors, such as Modify System Image.

Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.

Detect with There is no documented method for defenders to directly identify behaviors that reduce encryption key space. Detection efforts may be focused on closely related adversary behaviors, such as Modify System Image and Network Device CLI.

Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data.

Detect with There is no documented method for defenders to directly identify behaviors that disable cryptographic hardware. Detection efforts may be focused on closely related adversary behaviors, such as Modify System Image and Network Device CLI.

Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves.

Detect with Most embedded network devices provide a command to print the version of the currently running operating system. Use this command to query the operating system for its version number and compare it to what is expected for the device in question.

Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.

Detect with Compare the checksum of the operating system file with the checksum of a known good copy from a trusted source. Some embedded network device platforms may have the capability to calculate the checksum of the file, while others may not.

Adversaries may install an older version of the operating system of a network device to weaken security. Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features.

Detect with Many embedded network devices provide a command to print the version of the currently running operating system. Use this command to query the operating system for its version number and compare it to what is expected for the device in question.

Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry.

Detect with Monitor for unexpected Docker image build requests to the Docker daemon on hosts in the environment. Additionally monitor for subsequent network communication with anomalous IPs that have never been seen before in the environment that indicate the download of malicious code.

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads.

Detect with Monitor for code artifacts associated with reflectively loading code, such as the abuse of .NET functions such as Assembly.Load() and Native API functions such as CreateThread() , memfd_create() , execve() , and/or execveat() . Monitor for artifacts of abnormal process execution.

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Detect with Debugger related system checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.

Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses.

Detect with Monitor for common command-line editors used to modify plist files located in auto-run locations, such as \~/LaunchAgents , ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm , and an application's Info.plist .

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may attempt to modify hierarchical structures in infrastructure-as-a-service (IaaS) environments in order to evade defenses.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers in order to establish contact with victims under false pretenses.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Mimikatz, comsvcs.dll, procdump, and NTDS extraction pulling hashes and plaintext from memory or disk.

Detect with Sysmon Event ID 10 — process access to lsass.exe with 0x1010/0x1410; volume shadow copy creation on a domain controller.

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.

Detect with Monitor for unexpected processes interacting with LSASS.exe. Common credential dumpers such as Mimikatz access LSASS.exe by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored.

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.

Detect with Hash dumpers open the Security Accounts Manager (SAM) on the local file system ( %SystemRoot%/system32/config/SAM ) or create a dump of the Registry SAM key to access stored account password hashes.

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.

Detect with Monitor processes and command-line arguments for program execution that may be indicative of credential dumping, especially attempts to access or copy the NTDS.dit.

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.

Detect with Monitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like Mimikatz.

Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.

Detect with Monitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like Mimikatz.

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync.

Detect with Monitor domain controller logs for replication requests and other unscheduled activity possibly associated with DCSync. Also monitor for network protocols and other replication requests from IPs not associated with known domain controllers.

Adversaries may gather credentials from the proc filesystem or /proc. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory.

Detect with To obtain the passwords and hashes stored in memory, processes must open a maps file in the /proc filesystem for the process being analyzed.

Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking.

Detect with The AuditD monitoring tool, which ships stock in many Linux distributions, can be used to watch for hostile processes attempting to access /etc/passwd and /etc/shadow , alerting on the pid, process name, and arguments of such programs.

Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.

Detect with Detecting the events leading up to sniffing network traffic may be the best method of detection.

Keyloggers and credential-prompt spoofing capturing what the user types.

Detect with SetWindowsHookEx usage; unexpected processes registering raw input devices.

Adversaries may log user keystrokes to intercept credentials as the user types them.

Detect with Keyloggers may take many forms, possibly involving modification to the Registry and installation of a driver, setting a hook, or polling to intercept keystrokes. Commonly used API calls include SetWindowsHook, GetKeyState, and GetAsyncKeyState.

Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt.

Detect with Monitor process execution for unusual programs as well as malicious instances of Command and Scripting Interpreter that could be used to prompt users for credentials.

Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service.

Detect with File monitoring may be used to detect changes to files in the Web directory for organization login pages that do not match with authorized updates to the Web server's content.

Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials.

Detect with Monitor for calls to the SetWindowsHookEx and SetWinEventHook functions, which install a hook procedure. Also consider analyzing hook chains (which hold pointers to hook procedures for each type of hook) using tools or by programmatically examining internal kernel structures.

Password spraying, credential stuffing, and password guessing against exposed authentication surfaces.

Detect with Event ID 4625 across many accounts from one source (spray) or many sources for one account; cloud sign-in failure spikes.

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.

Detect with Monitor authentication logs for system and application login failures of Valid Accounts. If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials.

Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.

Detect with It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network. Consider focusing efforts on detecting other adversary behavior used to acquire credential materials, such as OS Credential Dumping or Kerberoasting.

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g.

Detect with Monitor authentication logs for system and application login failures of Valid Accounts. Specifically, monitor for many failed authentication attempts across various accounts that may result from password spraying attempts.

Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap.

Detect with Monitor authentication logs for system and application login failures of Valid Accounts. If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials.

Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources.

Detect with Detecting use of proxied smart card connections by an adversary may be difficult because it requires the token to be inserted into a system; thus it is more likely to be in use by a legitimate user and blend in with other network behavior.

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.

Detect with Monitor for SMB traffic on TCP ports 139, 445 and UDP port 137 and WebDAV traffic attempting to exit the network to unknown external systems. If attempts are detected, then investigate endpoint data sources to find the root cause.

Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

Detect with Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash.

OAuth tokens and cloud session cookies stolen to bypass MFA entirely.

Detect with Same session token used from two ASNs; illicit consent grants to newly registered applications.

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

Detect with Monitor for attempts to access files and repositories on a local system that are used to store browser session cookies. Monitor for attempts by programs to inject into or dump browser process memory.

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g.

Detect with While detecting adversaries accessing credentials may be difficult without knowing they exist in the environment, it may be possible to detect adversary use of credentials they have obtained.

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

Detect with While detecting adversaries accessing these files may be difficult without knowing they exist in the first place, it may be possible to detect adversary use of credentials they have obtained.

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs.

Detect with Monitor processes for applications that can be used to query the Registry, such as Reg, and collect command parameters that may indicate credentials are being searched.

Adversaries may search the bash command history on compromised systems for insecurely stored credentials. Bash keeps track of the commands users type on the command-line with the "history" utility.

Detect with Monitoring when the user's .bash_history is read can help alert to suspicious activity. While users do typically rely on their history of commands, they often access this history through other utilities like "history" instead of commands like cat ~/.bash_history .

Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.

Detect with Monitor access to files and directories related to cryptographic keys and certificates as a means for potentially detecting access patterns that may indicate collection and exfiltration activity.

Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.

Detect with Monitor access to the Instance Metadata API and look for anomalous queries. It may be possible to detect adversary use of credentials they have obtained such as in Valid Accounts.

Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials.

Detect with Monitor for attempts to access SYSVOL that involve searching for XML files. Deploy a new XML file with permissions set to Everyone:Deny and monitor for Access Denied errors.

Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.

Detect with Establish centralized logging for the activity of container and Kubernetes cluster components.

Adversaries may directly collect unsecured credentials stored or passed through user communication services.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Browser saved passwords, keychains, and password manager databases harvested from disk.

Detect with Non-browser processes reading Login Data or logins.json; access to .kdbx and keychain files by new binaries.

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes.

Detect with Unlocking the keychain and using passwords from it is a very common process, so there is likely to be a lot of noise in any detection technique. Monitoring of system calls to the keychain can help determine if there is a suspicious process trying to access it.

An adversary with root access may gather credentials by reading securityd’s memory. securityd is a service/daemon responsible for implementing security protocols such as encryption and authorization.

Detect with Monitor processes and command-line arguments for activity surrounded users searching for credentials or using automated tools to scan memory for passwords.

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.

Detect with Identify web browser files that contain credentials such as Google Chrome’s Login Data database file: AppData\Local\Google\Chrome\User Data\Default\Login Data .

Adversaries may acquire credentials from the Windows Credential Manager.

Detect with Monitor process and command-line parameters of vaultcmd.exe for suspicious activity, such as listing credentials from the Windows Credentials locker (i.e., vaultcmd /listcreds:“Windows Credentials” ).

Adversaries may acquire user credentials from third-party password managers. Password managers are applications designed to store user credentials, normally in an encrypted database.

Detect with Consider monitoring API calls, file read events, and processes for suspicious activity that could indicate searching in process memory of password managers. Consider monitoring file reads surrounding known password manager applications.

Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for…

Detect with Monitor network traffic for anomalies associated with known AiTM behavior. Consider monitoring for modifications to system configuration files involved in shaping network traffic flow.

By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.

Detect with Monitor HKLM\Software\Policies\Microsoft\Windows NT\DNSClient for changes to the "EnableMulticast" DWORD value. A value of “0” indicates LLMNR is disabled.

Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices.

Detect with Monitor network traffic for unusual ARP traffic, gratuitous ARP replies may be suspicious. Consider collecting changes to ARP caches across endpoints for signs of ARP poisoning.

Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network.

Detect with Monitor network traffic for suspicious/malicious behavior involving DHCP, such as changes in DNS and/or gateway parameters.

Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or Input Capture.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Kerberoasting, AS-REP roasting, golden and silver tickets abusing Kerberos design.

Detect with Event ID 4769 with RC4 encryption (0x17) for many SPNs from one account; TGTs with implausible lifetimes.

Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket. Golden tickets enable adversaries to generate authentication material for any account in Active Directory.

Detect with Monitor for anomalous Kerberos activity, such as malformed or blank fields in Windows logon/logoff events (Event ID 4624, 4672, 4634), RC4 encryption within TGTs, and TGS requests without preceding TGT requests.

Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets.

Detect with Monitor for anomalous Kerberos activity, such as malformed or blank fields in Windows logon/logoff events (Event ID 4624, 4634, 4672). Monitor for unexpected processes interacting with lsass.exe.

Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.

Detect with Enable Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests.

Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Password Cracking Kerberos messages. Preauthentication offers protection against offline Password Cracking.

Detect with Enable Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests.

Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may forge credential materials that can be used to gain access to web applications or Internet services.

Detect with Monitor for anomalous authentication activity, such as logons or other user session activity associated with unknown accounts.

Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.

Detect with Monitor for anomalous authentication activity, such as logons or other user session activity associated with unknown accounts.

An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.

Detect with This technique may be difficult to detect as SAML tokens are signed by a trusted certificate. The forging process may not be detectable since it is likely to happen outside of a defender's visibility, but subsequent usage of the forged token may be seen.

Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.

Detect with Monitor user account logs as well as 2FA/MFA application logs for suspicious events: unusual login attempt source location, mismatch in location of login attempt and smart device receiving 2FA/MFA request prompts, and high volume of repeated login attempts, all of which may…

Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query , tasklist /svc , systemctl --type=service , and net start .

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, tracert , and GET requests to websites.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Detect with This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Finding other hosts by IP, hostname, or Active Directory to plan lateral movement.

Detect with Sequential SMB or ICMP connections to many internal hosts from one workstation in a short window.

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Listing running processes, usually to identify security tooling before disabling it.

Detect with tasklist and ps output followed quickly by attempts to stop security services.

Enumerating group membership to identify who holds the keys to the domain or the tenant.

Detect with Repeated LDAP queries for privileged group membership from a single non-administrative host.

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may attempt to find cloud groups and permission settings.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Enumerating local, domain, and cloud accounts to find privileged targets.

Detect with net user /domain, net group "Domain Admins", Get-ADUser bursts from non-admin workstations.

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

Detect with Monitor processes, command-line arguments, and logs for actions that could be taken to gather information about cloud accounts, including the use of calls to cloud APIs that perform account discovery.

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.

Detect with Command-line interface monitoring may be useful to detect instances of net.exe or other command-line utilities being used to gather system time or time zone.

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force.

Detect with Monitor logs and processes for tools and command line arguments that may indicate they're being used for password policy discovery.

Adversaries may enumerate information about browsers to learn more about compromised environments.

Detect with Monitor processes and command-line arguments for actions that could be taken to gather browser bookmark information. Remote access tools with built-in features may interact directly using APIs to gather information.

Mapping trust relationships to find paths into other domains and forests.

Detect with nltest /domain_trusts, Get-DomainTrust, and BloodHound collector activity (SharpHound signatures).

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS).

Detect with Cloud service discovery techniques will likely occur throughout an operation where an adversary is targeting cloud-based systems and services.

An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features.

Detect with Monitor account activity logs to see actions performed and activity associated with the cloud service management console. Some cloud providers, such as AWS, provide distinct log events for login attempts to the management console.

An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment.

Detect with Establish centralized logging for the activity of cloud infrastructure components.

Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.

Detect with Establish centralized logging for the activity of container and Kubernetes cluster components. This can be done by deploying logging agents on Kubernetes nodes and retrieving logs from sidecar proxies for application pods to detect malicious activity at the cluster level.

Adversaries may gather information in an attempt to calculate the geographical location of a victim host.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage.

Detect with System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may enumerate system and service logs to find useful data.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a Hypervisor CLI such as esxcli or vim-cmd (e.g.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

RDP, SMB admin shares, WinRM, SSH, and VNC used with valid credentials to reach new hosts.

Detect with Event ID 4624 Type 3 and Type 10 from unusual source workstations; new admin share access patterns.

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Detect with Use of RDP may be legitimate, depending on the network environment and how it is used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with RDP.

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Detect with Ensure that proper logging of accounts used to log into systems is turned on and centrally collected. Windows logging is able to collect success/failure for accounts that may be used to move laterally and can be collected using tools such as Windows Event Forwarding.

Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.

Detect with Monitor for COM objects loading DLLs and other modules not typically associated with the application. Enumeration of COM objects, via Query Registry or PowerShell, may also proceed malicious use.

Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.

Detect with Use of SSH may be legitimate depending on the environment and how it’s used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with SSH.

Adversaries may use Valid Accounts to remotely control machines using Virtual Network Computing (VNC).

Detect with Use of VNC may be legitimate depending on the environment and how it’s used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior using VNC.

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

Detect with Monitor use of WinRM within an environment by tracking service execution. If it is not normally used or is disabled, then this may be an indicator of suspicious behavior.

Adversaries may log into accessible cloud services within a compromised environment using Valid Accounts that are synchronized with or federated to on-premises user identities.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may leverage Valid Accounts to log directly into accessible cloud hosted compute infrastructure through cloud native methods.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Planting malicious files or shortcuts on network shares so other users execute them.

Detect with New executables and .lnk files on shares, followed by execution from a UNC path on multiple hosts.

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

Detect with Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash.

After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization.

Detect with Network intrusion detection systems and email gateways usually do not scan internal email, but an organization can leverage the journaling-based solution which sends a copy of emails to a security service for offline analysis or incorporate service-integrated solutions using…

Taking over an existing RDP or SSH session that is already authenticated.

Detect with tscon.exe use; a session reconnecting from a different source address mid-session.

Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems.

Detect with Use of SSH may be legitimate, depending upon the network environment and how it is used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with SSH.

Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems.

Detect with Consider monitoring processes for tscon.exe usage and monitor service creation that uses cmd.exe /k or cmd.exe /c in its arguments to detect RDP session hijacking. Use of RDP may be legitimate, depending on the network environment and how it is used.

Copying tooling between internal hosts over SMB or a remote management channel.

Detect with Executables written to C$ or ADMIN$ followed within seconds by a service creation on the same host.

Files, configs, and credentials harvested from the compromised host itself.

Detect with Mass file reads by a single non-indexing process; recursive directory traversal in command lines.

Adversaries may search connected removable media on computers they have compromised to find files of interest.

Detect with Monitor processes and command-line arguments for actions that could be taken to collect files from a system's connected removable media. Remote access tools with built-in features may interact directly with the Windows API to gather data.

Bulk reads from file servers and departmental shares.

Detect with One account opening thousands of files across shares in minutes; file server audit spikes.

Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data.

Detect with Processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as 7zip, RAR, ZIP, or zlib.

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data.

Detect with Processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as 7zip, RAR, ZIP, or zlib.

Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data.

Detect with Processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as 7zip, RAR, ZIP, or zlib.

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations.

Detect with Monitoring for screen capture behavior will depend on the method used to obtain data from the operating system and write output files.

Mailbox exports, forwarding rules, and delegated access used to siphon correspondence.

Detect with New inbox rules forwarding externally; New-MailboxExportRequest in Exchange audit logs.

Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.

Detect with Monitor processes and command-line arguments for actions that could be taken to gather local email files. Monitor for unusual processes accessing local email files.

Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network.

Detect with Monitor for unusual login activity from unknown or abnormal locations, especially for privileged accounts (ex: Exchange administrator account).

Adversaries may setup email forwarding rules to collect sensitive information.

Detect with Detection is challenging because all messages forwarded because of an auto-forwarding rule have the same presentation as a manually forwarded message.

Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard .

Detect with Access to the clipboard is a legitimate function of many applications on an operating system. If an organization chooses to monitor for this behavior, then the data will likely need to be correlated against other suspicious or non-user-driven activity.

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Detect with Depending on the method used, actions could include common file system commands and parameters on the command-line interface within batch files or scripts. A sequence of actions like this may be unusual, depending on the system and network environment.

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.

Detect with Detection of this technique may be difficult due to the various APIs that may be used. Telemetry data regarding API use may not be useful depending on how a system is normally used, but may provide context to other potentially malicious activity occurring on a system.

An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information.

Detect with Detection of this technique may be difficult due to the various APIs that may be used. Telemetry data regarding API use may not be useful depending on how a system is normally used, but may provide context to other potentially malicious activity occurring on a system.

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

Detect with This may be a difficult technique to detect because adversary traffic may be masked by normal user traffic. New processes may not be created and no additional software dropped to disk.

Adversaries may leverage information repositories to mine valuable information.

Detect with As information repositories generally have a considerably large user base, detection of malicious use can be non-trivial.

Adversaries may leverage Confluence repositories to mine valuable information.

Detect with Monitor access to Confluence repositories performed by privileged users (for example, Active Directory Domain, Enterprise, or Schema Administrators) as these types of accounts should generally not be used to access information repositories.

Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems.

Detect with The user access logging within Microsoft's SharePoint can be configured to report access to certain pages and documents. .

Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds.

Detect with Monitor access to code repositories, especially performed by privileged users such as Active Directory Domain or Enterprise Administrators as these types of accounts should generally not be used to access code repositories.

Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage.

Detect with Monitor for unusual queries to the cloud provider's storage service. Activity originating from unexpected sources may indicate improper permissions are set that is allowing access to data.

Compressing and encrypting the staged data to shrink it and hide its contents.

Detect with rar.exe / 7z.exe with a password flag; large archives written to temp or ProgramData.

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.

Detect with Common utilities that may be present on the system or brought in by an adversary may be detectable through process monitoring and monitoring for command-line arguments for known archival utilities.

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including Python rarfile , libzip , and zlib .

Detect with Monitor processes for accesses to known archival libraries. This may yield a significant number of benign events, depending on how systems in the environment are typically used.

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method.

Detect with Custom archival methods can be very difficult to detect, since many of them use standard programming language concepts, such as bitwise operations.

Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems.

Detect with Identify network traffic sent or received by untrusted hosts or networks that solicits and obtains the configuration information of the queried device.

Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).

Detect with Identify network traffic sent or received by untrusted hosts or networks that expose MIB content or use unauthorized protocols.

Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device.

Detect with Identify network traffic sent or received by untrusted hosts or networks. Configure signatures to identify strings that may be found in a network device configuration.

Adversaries may obfuscate command and control traffic to make it more difficult to detect.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may add junk data to protocols used for command and control to make detection more difficult.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

HTTP, HTTPS, DNS, and mail protocols carrying command traffic inside ordinary-looking sessions.

Detect with Beaconing intervals with low jitter, uniform payload sizes, long-lived connections to rare destinations.

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Multi-hop proxies, Tor, and domain fronting used to hide the true C2 destination.

Detect with Tor entry-node connections; internal hosts acting as relays for other internal hosts.

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap.

Detect with Analyze network data for uncommon data flows between clients that should not or often do not communicate with one another. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

Detect with Analyze network data for uncommon data flows, such as a client sending significantly more data than it receives from an external server. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may chain together multiple proxies to disguise the source of malicious traffic.

Detect with When observing use of Multi-hop proxies, network data from the actual command and control servers could allow correlating incoming and outgoing flows to trace malicious traffic back to its source.

Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS.

Detect with If SSL inspection is in place or the traffic is not encrypted, the Host field of the HTTP header can be checked if it matches the HTTPS SNI or against a blocklist or allowlist of domain names.

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.

Detect with Monitor file access on removable media. Detect processes that execute when removable media is mounted.

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.

Detect with Analyze network traffic for ICMP messages or other protocols that contain abnormal data or are not normally seen within or exiting the network. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server).

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.

Detect with Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption.

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure.

Detect with Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption.

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel.

Detect with Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption.

Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel.

Detect with Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption.

Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.

Detect with Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure.

Pulling additional tooling into the environment after the initial payload lands.

Detect with certutil -urlcache, bitsadmin, curl, and PowerShell downloads writing executables to disk.

Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

AnyDesk, TeamViewer, ScreenConnect, and similar tools installed by the adversary as their C2.

Detect with RMM binaries on hosts outside IT's approved inventory; traffic to RMM vendor domains from unmanaged endpoints.

Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations.

Detect with Detecting dynamically generated C2 can be challenging due to the number of different algorithms, constantly evolving malware families, and the increasing complexity of the algorithms.

Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution.

Detect with In general, detecting usage of fast flux DNS is difficult due to web traffic load balancing that services client requests quickly. In single flux cases only IP addresses change for static domain names.

Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains.

Detect with Detecting dynamically generated domains can be challenging due to the number of different DGA algorithms, constantly evolving malware families, and the increasing complexity of the algorithms.

Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address.

Detect with Detection for this technique is difficult because it would require knowledge of the specific implementation of the port calculation algorithm. Detection may be possible by analyzing DNS records if the algorithm is known.

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443.

Detect with Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server).

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems.

Detect with Monitoring for systems listening and/or establishing external connections using ports/protocols commonly associated with tunneling, such as SSH (port 22). Also monitor for processes commonly associated with tunneling, such as Plink and the OpenSSH client.

TLS or custom crypto wrapping the C2 channel so content inspection sees nothing.

Detect with JA3/JA3S fingerprints, self-signed certificates, TLS to IP addresses with no SNI.

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Detect with With symmetric encryption, it may be possible to obtain the algorithm and key from samples and use them to decode network traffic to detect malware communications signatures.

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Detect with SSL/TLS inspection is one way of detecting command and control traffic within some encrypted communication channels.

Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.

Detect with Monitor for processes utilizing the network that do not normally have network communication or have never been seen before.

Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel.

Detect with Monitor for processes utilizing the network that do not normally have network communication or have never been seen before.

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.

Detect with Monitor process file access patterns and network behavior. Unrecognized processes or scripts that appear to be traversing file systems and sending network traffic may be suspicious.

Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis.

Detect with Monitor network traffic for uncommon data flows (e.g. unusual network communications, suspicious communications that have never been seen before, communications sending fixed size data packets at regular intervals).

Exfiltration timed to blend into backup windows or normal business traffic patterns.

Detect with Recurring outbound transfers at fixed offsets; egress that continues on weekends when users are absent.

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server).

Data sent out through the same channel already used for control.

Detect with Upload volume far exceeding download on a long-lived session; sustained outbound to a single rare host.

DNS tunnelling, FTP, and ICMP used to carry data around web-focused controls.

Detect with Abnormal DNS TXT query volume and length; internal hosts sending FTP outbound at all.

Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

USB drives and other removable media used where the network is monitored.

Detect with Removable device insertion events (Event ID 6416) followed by bulk file copies.

Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user.

Detect with Monitor file access on removable media. Detect processes that execute when removable media are mounted.

Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.

Detect with Monitor account activity for attempts to share data, snapshots, or backups with untrusted or unusual accounts on the same cloud service provider. Monitor for anomalous file transfer activity between accounts and to untrusted VPCs.

Dropbox, Google Drive, Mega, Discord, and pastebin-style services used as drop points.

Detect with Large uploads to personal cloud storage from servers; DLP policies on unsanctioned storage domains.

Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com).

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server) to code repositories. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

Detect with Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server) to known cloud storage services.

Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com , are commonly used by developers to share code and other information.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Wipers and secure-delete operations that destroy data with no intent of recovery.

Detect with Raw disk writes by unexpected processes; SDelete-style patterns across many hosts at once.

Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Ransomware encrypting files across endpoints and servers to force payment.

Detect with Mass file rename/write bursts, ransom note creation, canary file modification.

Stopping databases, backup agents, and security services so files can be encrypted cleanly.

Detect with net stop / sc stop against database and backup services in rapid sequence.

Deleting shadow copies, disabling recovery mode, and destroying backups before encrypting.

Detect with vssadmin delete shadows, wbadmin delete catalog, bcdedit recovery flags — treat every one as critical.

Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content.

Detect with Monitor internal and external websites for unplanned content changes. Monitor application logs for abnormal behavior that may indicate attempted or successful exploitation.

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.

Detect with Monitor internal and websites for unplanned content changes. Monitor application logs for abnormal behavior that may indicate attempted or successful exploitation.

An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users.

Detect with Monitor external websites for unplanned content changes. Monitor application logs for abnormal behavior that may indicate attempted or successful exploitation.

Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.

Detect with System firmware manipulation may be detected. Log attempts to read/write to BIOS and compare against known patching behavior.

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms.

Detect with Consider monitoring process resource usage to determine anomalous activity associated with malicious hijacking of computer resources such as CPU, memory, and graphics processing resources.

Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Flooding the network or an application to make it unavailable, sometimes as a distraction.

Detect with Bandwidth saturation, connection-table exhaustion, upstream provider alerts.

Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. This DoS attack may also reduce the availability and functionality of the targeted system(s) and network.

Detect with Detection of a network flood can sometimes be achieved before the traffic volume is sufficient to cause impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness or services provided by an upstream network…

Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target.

Detect with Detection of reflection amplification can sometimes be achieved before the traffic volume is sufficient to cause impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness or services provided by an…

Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.

Detect with Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness.

Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS).

Detect with Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness.

Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). Adversaries often target the availability of DNS and web services, however others have been targeted as well.

Detect with Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness.

Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive.

Detect with Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness.

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Detect with Attacks targeting web applications may generate logs in the web server, application server, and/or database server that can be used to identify the type of attack. Externally monitor the availability of services that may be targeted by an Endpoint DoS.

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device.

Detect with Use process monitoring to monitor the execution and command line parameters of binaries involved in shutting down or rebooting systems. Windows event logs may also designate activity associated with a shutdown/reboot, ex.

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.

Detect with Use process monitoring to monitor the execution and command line parameters of binaries involved in deleting accounts or changing passwords, such as use of Net.

Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data.

Detect with Look for attempts to read/write to sensitive locations like the partition boot sector, master boot record, disk partition table, or BIOS parameter block/superblock. Monitor for direct access read/write attempts using the \\\\.\\ notation.

Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.

Detect with Look for attempts to read/write to sensitive locations like the partition boot sector or BIOS parameter block/superblock. Monitor for direct access read/write attempts using the \\\\.\\ notation.

Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.

Detect with Look for attempts to read/write to sensitive locations like the master boot record and the disk partition table. Monitor for direct access read/write attempts using the \\\\.\\ notation.

Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

Detect with Where applicable, inspect important file hashes, locations, and modifications for suspicious/unexpected values. With some critical processes involving transmission of data, manual or out-of-band integrity checking may be useful for identifying manipulated data.

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

Detect with Where applicable, inspect important file hashes, locations, and modifications for suspicious/unexpected values.

Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.

Detect with Detecting the manipulation of data as at passes over a network can be difficult without the appropriate tools. In some cases integrity verification checks, such as file hashing, may be used on critical files as they transit a network.

Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.

Detect with Inspect important application binary file hashes, locations, and modifications for suspicious/unexpected values.

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may flood targeted email addresses with an overwhelming volume of messages. This may bury legitimate emails in a flood of spam and disrupt business operations.

Detect with No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.