Attack Path Techniques

As part of a typical attack, adversaries leverage different tools and techniques to accomplish their objectives. Usually, a hacker attains an initial foothold over the network, whether by a phishing attack or exploiting a publicly exposed vulnerability. Hackers may then seem to maintain access over the machine (Persistence), elevate their privileges, and laterally pivot between network devices (Lateral Movement). Last, the hacker tries to complete their objective, for example, a denial of service of critical infrastructure, exfiltration of sensitive information, or distraction of existing services. This event is known as Attack Path. An attack path contains one or more Attack Techniques, allowing the hacker to accomplish his objective.

Search

IDNamePlatformFamilyFramework
T0846_ICSRemote System DiscoveryNoneDiscoveryMITRE ATT&CK
T0814_ICSDenial of ServiceNoneInhibit Response FunctionMITRE ATT&CK
T0891_ICSHardcoded CredentialsNoneLateral Movement, PersistenceMITRE ATT&CK
T1615_WindowsGroup Policy DiscoveryWindowsDiscoveryMITRE ATT&CK
T0812_ICSDefault CredentialsNoneLateral MovementMITRE ATT&CK
T0843_ICSProgram DownloadNoneLateral MovementMITRE ATT&CK
T0866_ICSExploitation of Remote ServicesNoneInitial Access, Lateral MovementMITRE ATT&CK
1078.001Valid Accounts: Default AccountsAzure AD, Containers, Google Workspace, IaaS, Linux, Office 365, SaaS, Windows, macOSDefense Evasion, Persistence, Privilege Escalation, Initial AccessMITRE ATT&CK
T1499.004Endpoint Denial of Service: Application or System ExploitationAzure AD, Google Workspace, IaaS, Linux, Office 365, SaaS, Windows, macOSImpactMITRE ATT&CK
T0820_ICSExploitation for EvasionNoneEvasionMITRE ATT&CK
T1133_AzureExploit Public-Facing Application (Azure)AzureInitial Access, PersistenceMITRE ATT&CK
T1592.002_PREGather Victim Host Information: SoftwarePREReconnaissanceMITRE ATT&CK
T1059.004_LinuxCommand and Scripting Interpreter: Unix ShellLinuxExecutionMITRE ATT&CK
T1218.007_WindowsSystem Binary Proxy Execution: MsiexecWindowsDefense EvasionMITRE ATT&CK
T1219_WindowsRemote Access SoftwareWindowsCommand and ControlMITRE ATT&CK
T1003.008_WindowsOS Credential Dumping: /etc/passwd and /etc/shadowLinuxCredential AccessMITRE ATT&CK
T1552.002_WindowsUnsecured Credentials: Credentials in Registry WindowsCredential AccessMITRE ATT&CK
T1574.010_WindowsHijack Execution Flow: Services File Permissions WeaknessWindowsPersistence, Privilege Escalation, Defense EvasionMITRE ATT&CK
T1053.005_WindowsScheduled Task/Job: Scheduled TaskWindowsExecution, Persistence, Privilege EscalationMITRE ATT&CK
T1059.003_WindowsCommand and Scripting Interpreter: Windows Command ShellWindowsExecutionMITRE ATT&CK
T1550.001_WindowsMaterial: Application Access TokenWindowsLateral Movement, Defense EvasionMITRE ATT&CK
T1580_AWSCloud Infrastructure Discovery(AWS)AWSDiscoveryMITRE ATT&CK
T1552.005_AWSCloud Instance Metadata APIAWSCredential AccessMITRE ATT&CK
T1555.004_WindowsCredentials from Password Stores: Windows Credential ManagerWindowsCredential AccessMITRE ATT&CK
T1059.005_WindowsCommand and Scripting Interpreter: Visual BasicWindowsExecutionMITRE ATT&CK
T1110.004_WindowsBrute Force: Credential Stuffing (Windows)WindowsCredential AccessMITRE ATT&CK
T1098.001_AWSAccount Manipulation: Additional Cloud CredentialsAWSPersistenceMITRE ATT&CK
T1619_AWSCloud Storage Object Discovery(AWS)AWSDiscoveryMITRE ATT&CK
T1530_AWSData from Cloud Storage Object (AWS)AWSCollectionMITRE ATT&CK
T1648_AWSServerless ExecutionAWSExecutionMITRE ATT&CK
T1049_WindowsSystem Network Connections Discovery (Windows)WindowsDiscoveryMITRE ATT&CK
T1537_AWSTransfer Data to Cloud AccountAWSExfiltrationMITRE ATT&CK
T1133_AWSExternal Remote ServicesWindowsInitial Access, PersistenceMITRE ATT&CK
T1136.003_AWSCreate Account: Cloud AccountAWSPersistenceMITRE ATT&CK
T1204_AWSUser ExecutionAWSExecutionMITRE ATT&CK
T1069.003_AWSPermission Groups Discovery: Cloud Groups (AWS)AWSDiscoveryMITRE ATT&CK
T1528_AWSSteal Application Access Token (AWS)AWSCollectionMITRE ATT&CK
T1087.004_AWSAccount Discovery: Cloud Account (AWS)AWSDiscoveryMITRE ATT&CK
T1204.002_AWSUser Execution: Malicious File (AWS)AWSExecutionMITRE ATT&CK
T1098.003_AWSAccount Manipulation: Additional Cloud Roles (AWS)AWSCollectionMITRE ATT&CK
T1133_WindowsExternal Remote Services (Windows)WindowsPersistence, Initial AccessMITRE ATT&CK
T1048.002_WindowsExfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (Windows)WindowsExfiltrationMITRE ATT&CK
T1048.003_WindowsExfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol (Windows)WindowsExfiltrationMITRE ATT&CK
T1048.001_WindowsExfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol (Windows)WindowsExfiltrationMITRE ATT&CK
T1211_WindowsExploitation for Defense Evasion (Windows)WindowsDefense EvasionMITRE ATT&CK
T1110.001_WindowsBrute Force: Password Guessing (Windows)WindowsCredential AccessMITRE ATT&CK
T1110.003_WindowsBrute Force: Password Spraying (Windows)WindowsCredential AccessMITRE ATT&CK
T1047_WindowsWindows Management InstrumentationWindowsExecutionMITRE ATT&CK
T1021.002_WindowsRemote Services: SMB/Windows Admin SharesWindowsLateral MovementMITRE ATT&CK
T1203_WindowsExploitation for Client Execution (Windows)WindowsExecutionMITRE ATT&CK