Detections
Analytics

Attack Path Techniques Search

IDNamePlatformFamilyFramework
T1007System Service DiscoveryDiscoveryMITRE ATT&CK
T1021.001Remote Desktop ProtocolLateral MovementMITRE ATT&CK
T1021.006Windows Remote ManagementLateral MovementMITRE ATT&CK
T1053.005Scheduled TaskExecution, Persistence, Privilege EscalationMITRE ATT&CK
T1059.004Unix ShellExecutionMITRE ATT&CK
T1059.006PythonExecutionMITRE ATT&CK
T1069.001Local GroupsDiscoveryMITRE ATT&CK
T1114.002Remote Email CollectionCollectionMITRE ATT&CK
T1203Exploitation for Client ExecutionExecutionMITRE ATT&CK
T1518.001Security Software DiscoveryDiscoveryMITRE ATT&CK
T1547.002Authentication PackagePersistence, Privilege EscalationMITRE ATT&CK
T1552.005Cloud Instance Metadata APICredential AccessMITRE ATT&CK
T1003.004_WindowsOS Credential Dumping: LSA SecretsWindowsCredential AccessMITRE ATT&CK
T1003.008_WindowsOS Credential Dumping: /etc/passwd and /etc/shadowLinuxCredential AccessMITRE ATT&CK
T1059.005_WindowsCommand and Scripting Interpreter: Visual BasicWindowsExecutionMITRE ATT&CK
T1059.006_WindowsCommand and Scripting Interpreter: Python (Windows)WindowsExecutionMITRE ATT&CK
T1059.009_AzureCommand and Scripting Interpreter: Cloud APIEntra IDExecutionMITRE ATT&CK
T1078.001_ICSValid Accounts: Default AccountsAzure AD, Containers, Google Workspace, IaaS, Linux, Office 365, SaaS, Windows, macOSDefense Evasion, Persistence, Privilege Escalation, Initial AccessMITRE ATT&CK
T1087.004_AzureAccount Discovery:Cloud Account(Azure)Entra IDDiscoveryMITRE ATT&CK
T1110.004_WindowsBrute Force: Credential Stuffing (Windows)WindowsCredential AccessMITRE ATT&CK
T1210_WindowsExploitation of Remote Services (Windows)WindowsLateral MovementMITRE ATT&CK
T1218.007_WindowsSystem Binary Proxy Execution: MsiexecWindowsDefense EvasionMITRE ATT&CK
T1219_WindowsRemote Access SoftwareWindowsCommand and ControlMITRE ATT&CK
T1552.002_WindowsUnsecured Credentials: Credentials in Registry WindowsCredential AccessMITRE ATT&CK
T1558.001_WindowsSteal or Forge Kerberos Tickets: Golden TicketWindowsCredential AccessMITRE ATT&CK
T1574.009_WindowsPath Interception by Unquoted PathWindowsPersistence, Privilege Escalation, Defense EvasionMITRE ATT&CK
T1606.002_AzureForge Web Credentials:SAML Tokens(Azure)Entra IDCredential AccessMITRE ATT&CK
T1021.003Distributed Component Object ModelLateral MovementMITRE ATT&CK
T1040Network SniffingCredential Access, DiscoveryMITRE ATT&CK
T1047Windows Management InstrumentationExecutionMITRE ATT&CK
T1048.003Exfiltration Over Symmetric Encrypted Non-C2 ProtocolExfiltrationMITRE ATT&CK
T1059.005Windows Command ShellExecutionMITRE ATT&CK
T1207Rogue Domain ControllerDefense EvasionMITRE ATT&CK
T1211Exploitation for Defense EvasionDefense EvasionMITRE ATT&CK
T1218.007MsiexecDefense EvasionMITRE ATT&CK
T1219Remote Access SoftwareCommand and ControlMITRE ATT&CK
T1484.001Group Policy ModificationDefense Evasion, Privilege EscalationMITRE ATT&CK
T1547.005Security Support ProviderPersistence, Privilege EscalationMITRE ATT&CK
T1550.003Pass the TicketDefense Evasion, Lateral MovementMITRE ATT&CK
T1552.002Credentials in RegistryCredential AccessMITRE ATT&CK
T1574.009Path Interception by Unquoted PathPersistence, Privilege Escalation, Defense EvasionMITRE ATT&CK
T1615Group Policy DiscoveryDiscoveryMITRE ATT&CK
T1592.002_PREGather Victim Host Information: SoftwarePREReconnaissanceMITRE ATT&CK
WAS.112684Client Side Template InjectionWeb ApplicationInjectionOWASP
T1592.002SoftwareReconnaissanceMITRE ATT&CK
WAS.113634Server-Side Inclusion InjectionInjectionOWASP
WAS.98117Blind SQL Injection (differential analysis)InjectionOWASP
WAS.98118Blind SQL Injection (timing attack)InjectionOWASP
WAS.98127LDAP InjectionInjectionOWASP
T1012_WindowsQuery RegistryWindowsDiscoveryMITRE ATT&CK