Detections
Analytics

Attack Path Techniques Search

IDNamePlatformFamilyFramework
T1204.002_AWSUser Execution: Malicious File (AWS)AWSExecutionMITRE ATT&CK
T1210_WindowsExploitation of Remote Services (Windows)WindowsLateral MovementMITRE ATT&CK
T1482_WindowsDomain Trust DiscoveryWindowsDiscoveryMITRE ATT&CK
T1484.001_WindowsDomain Policy Modification: Group Policy ModificationWindowsDefense Evasion, Privilege EscalationMITRE ATT&CK
T1548Abuse Elevation Control MechanismPrivilege Escalation, Defense EvasionMITRE ATT&CK
T1558.003_WindowsSteal or Forge Kerberos Tickets: KerberoastingWindowsCredential AccessMITRE ATT&CK
T1619_AWSCloud Storage Object Discovery(AWS)AWSDiscoveryMITRE ATT&CK
T1037.003Network Logon ScriptPersistence, Privilege EscalationMITRE ATT&CK
T1040Network SniffingCredential Access, DiscoveryMITRE ATT&CK
T1078Valid AccountsDefense Evasion, Persistence, Privilege Escalation, Initial AccessMITRE ATT&CK
T1203Exploitation for Client ExecutionExecutionMITRE ATT&CK
T1528Steal Application Access TokenCollectionMITRE ATT&CK
T1547.005Security Support ProviderPersistence, Privilege EscalationMITRE ATT&CK
T1552.005Cloud Instance Metadata APICredential AccessMITRE ATT&CK
T1556.001Domain Controller AuthenticationCredential Access, Defense Evasion, PersistenceMITRE ATT&CK
T1606.002SAML TokensCredential AccessMITRE ATT&CK
T0888Remote System Information DiscoveryDiscoveryMITRE ATT&CK
T1550.003Pass the TicketDefense Evasion, Lateral MovementMITRE ATT&CK
T1012Query RegistryDiscoveryMITRE ATT&CK
T1048.001Exfiltration Over Symmetric Encrypted Non-C2 ProtocolExfiltrationMITRE ATT&CK
T1059.001PowershellExecutionMITRE ATT&CK
T1059Command and Scripting InterpreterExecutionMITRE ATT&CK
T1078.003Local AccountsDefense Evasion, Persistence, Privilege Escalation, Initial AccessMITRE ATT&CK
T1098.001Additional Cloud CredentialsPersistenceMITRE ATT&CK
T1098.004SSH Authorized KeysPrivilege Escalation, PersistenceMITRE ATT&CK
T1218.007MsiexecDefense EvasionMITRE ATT&CK
T1482Domain Trust DiscoveryDiscoveryMITRE ATT&CK
T1495Firmware CorruptionImpactMITRE ATT&CK
T1537Transfer Data to Cloud AccountExfiltrationMITRE ATT&CK
T1558.003KerberoastingCredential AccessMITRE ATT&CK
T1619Cloud Storage Object DiscoveryDiscoveryMITRE ATT&CK
T1648Serverless ExecutionExecutionMITRE ATT&CK
T1003.006_WindowsOS Credential Dumping: DCSyncWindowsCredential AccessMITRE ATT&CK
T1048.001_WindowsExfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol (Windows)WindowsExfiltrationMITRE ATT&CK
T1078.001_ICSValid Accounts: Default AccountsAzure AD, Containers, Google Workspace, IaaS, Linux, Office 365, SaaS, Windows, macOSDefense Evasion, Persistence, Privilege Escalation, Initial AccessMITRE ATT&CK
T1212_WindowsExploitation for Credential Access (Windows)WindowsCredential AccessMITRE ATT&CK
T1218.007_WindowsSystem Binary Proxy Execution: MsiexecWindowsDefense EvasionMITRE ATT&CK
T1548_WindowsAbuse Elevation Control MechanismWindowsPrivilege Escalation, Defense EvasionMITRE ATT&CK
T1558.004_WindowsSteal or Forge Kerberos Tickets: AS-REP RoastingWindowsCredential AccessMITRE ATT&CK
T1574.007_WindowsPath Interception by PATH Environment VariableWindowsPersistence, Privilege Escalation, Defense EvasionMITRE ATT&CK
T1648_AWSServerless ExecutionAWSExecutionMITRE ATT&CK
T1003.004LSA SecretsCredential AccessMITRE ATT&CK
T1574.010_WindowsHijack Execution Flow: Services File Permissions WeaknessWindowsPersistence, Privilege Escalation, Defense EvasionMITRE ATT&CK
T0812Default CredentialsLateral MovementMITRE ATT&CK
T0891Hardcoded CredentialsLateral Movement, PersistenceMITRE ATT&CK
T1003.003NTDSCredential AccessMITRE ATT&CK
T1087.004Cloud AccountDiscoveryMITRE ATT&CK
T1580Cloud Infrastructure DiscoveryDiscoveryMITRE ATT&CK
T1098.003_AzureAccount Manipulation: Additional Cloud Roles (Azure)Entra IDPersistence, Privilege EscalationMITRE ATT&CK
T1484.002_AzureDomain Policy Modification: Trust Modification(Azure)Entra IDDefense Evasion, Privilege EscalationMITRE ATT&CK