Techniques. Explained Plainly.

T1195.002. Stage 03.

Compromise Software Supply Chain.

Compromise Software Supply Chain is a way for attackers to reach many computers through software they already trust.

• Initial Access.

MITRE ATT&CK.Technique. →

T1189. Stage 03.

Drive-by Compromise.

Drive-by Compromise is a way for attackers to gain access to a computer when a person visits a website during normal browsing.

• Initial Access.

MITRE ATT&CK.Technique. →

T1190. Stage 03.

Exploit Public-Facing Application.

Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network.

• Initial Access.

MITRE ATT&CK.Technique. →

T1566. Stage 03.

Phishing (T1566): ATT&CK Technique.

Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password.

• Initial Access.

MITRE ATT&CK.Technique. →

T1204.004. Stage 04.

ClickFix: Malicious Copy And Paste (T1204.004).

ClickFix, Malicious Copy and Paste.

Malicious Copy and Paste lets an attacker run code without an exploit and without a browser download.

• Execution.

MITRE ATT&CK.Technique. →

T1059. Stage 04.

Command And Scripting Interpreter.

Command and Scripting Interpreter is a technique where an attacker uses the built-in shells and scripting languages of a system to run commands, scripts or programs.

• Execution.

MITRE ATT&CK.Technique. →

T1053. Stage 04.

Scheduled Task/Job.

Scheduled Task/Job is a technique where an attacker uses the task scheduling feature built into an operating system.

• Execution.

MITRE ATT&CK.Technique. →

T1204. Stage 04.

User Execution.

User Execution is when an attacker gets a person to run malicious code for them.

• Execution.

MITRE ATT&CK.Technique. →

T1547. Stage 05.

Boot Or Logon Autostart Execution.

Boot or logon autostart execution is when an attacker sets up a computer so that their program starts by itself when the system boots or a user logs on.

• Persistence.

MITRE ATT&CK.Technique. →

T1133. Stage 05.

External Remote Services.

External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it.

• Persistence.

MITRE ATT&CK.Technique. →

T1546.018. Stage 05.

Python Startup Hooks: .pth And Sitecustomize.py Persistence (T1546.018).

Python Startup Hooks, .pth file persistence.

Python Startup Hooks let an attacker run code every time Python starts.

• Persistence.

MITRE ATT&CK.Technique. →

T1547.001. Stage 05.

Registry Run Keys / Startup Folder.

Windows can start programs on its own when a user logs in.

• Persistence.

MITRE ATT&CK.Technique. →

T1505.003. Stage 05.

Server Software Component: Web Shell (T1505.003).

A web shell is a small script that an attacker places on a web server.

• Persistence.

MITRE ATT&CK.Technique. →

T1068. Stage 06.

Exploitation For Privilege Escalation.

Exploitation for privilege escalation is when an attacker uses a flaw in software to gain higher permissions than they started with.

• Privilege Escalation.

MITRE ATT&CK.Technique. →

T1140. Stage 07.

Deobfuscate/Decode Files Or Information.

Deobfuscate/Decode Files or Information is a technique where attackers unpack, decode or decrypt content they had hidden earlier, so it can be used on the target system.

• Stealth.

MITRE ATT&CK.Technique. →

T1574.001. Stage 07.

DLL.

DLL hijacking is when an attacker abuses the shared library files (DLLs) that Windows programs load.

• Stealth.

MITRE ATT&CK.Technique. →

T1564. Stage 07.

Hide Artifacts.

Hide Artifacts is a technique where attackers hide the traces of their activity, such as files, folders, user accounts or running tasks.

• Stealth.

MITRE ATT&CK.Technique. →

T1070. Stage 07.

Indicator Removal.

Indicator Removal is a technique where an attacker deletes or changes the traces that their activity leaves behind.

• Stealth.

MITRE ATT&CK.Technique. →

T1036. Stage 07.

Masquerading.

Masquerading is when an attacker changes how a file, program, service or account looks so it seems legitimate.

• Stealth.

MITRE ATT&CK.Technique. →

T1027. Stage 07.

Obfuscated Files Or Information.

Obfuscated Files or Information is a technique where an attacker hides the real content of a file, program or command by encrypting, encoding or packing it.

• Stealth.

MITRE ATT&CK.Technique. →

T1055. Stage 07.

Process Injection.

Process injection is when an attacker runs their own code inside another program that is already running.

• Stealth.

MITRE ATT&CK.Technique. →

T1620. Stage 07.

Reflective Code Loading.

Reflective code loading is a way for malware to run a program straight from memory, without starting a new process or putting the program on disk as a normal file.

• Stealth.

MITRE ATT&CK.Technique. →

T1078. Stage 07.

Valid Accounts.

Valid Accounts means an attacker logs in with real credentials that were stolen or bought.

• Stealth.

MITRE ATT&CK.Technique. →

T1497. Stage 07.

Virtualization/Sandbox Evasion.

Virtualization/Sandbox Evasion is when malware checks whether it is running inside a virtual machine or an analysis sandbox, and changes what it does if it is.

• Stealth.

MITRE ATT&CK.Technique. →

T1112. Stage 08.

Modify Registry.

Modify Registry is a technique where an attacker changes settings in the Windows Registry.

• Defense Impairment.

MITRE ATT&CK.Technique. →

T1555. Stage 09.

Credentials From Password Stores.

Credentials from password stores is when an attacker looks in the places where passwords are saved and takes the logins they find.

• Credential Access.

MITRE ATT&CK.Technique. →

T1552.001. Stage 09.

Credentials In Files: Stealing Secrets From Config Files (T1552.001).

Credentials in Files, Unsecured Credentials: Credentials In Files.

Credentials in Files means an attacker reads passwords, keys and tokens that sit in ordinary files on a disk or a file share.

• Credential Access.

MITRE ATT&CK.Technique. →

T1003. Stage 09.

OS Credential Dumping.

OS credential dumping is when an attacker pulls account login material out of a computer.

• Credential Access.

MITRE ATT&CK.Technique. →

T1087. Stage 10.

Account Discovery.

Account Discovery is when an attacker builds a list of valid accounts, usernames or email addresses on a system or inside a compromised environment.

• Discovery.

MITRE ATT&CK.Technique. →

T1083. Stage 10.

File And Directory Discovery.

File and Directory Discovery is a technique where an attacker lists files and folders on a system or a network share to learn what is there.

• Discovery.

MITRE ATT&CK.Technique. →

T1057. Stage 10.

Process Discovery.

Process Discovery is a technique where attackers list the programs running on a system.

• Discovery.

MITRE ATT&CK.Technique. →

T1082. Stage 10.

System Information Discovery.

System Information Discovery is when an attacker collects details about a device, such as its operating system version, patch level and hardware.

• Discovery.

MITRE ATT&CK.Technique. →

T1021. Stage 11.

Remote Services.

Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC.

• Lateral Movement.

MITRE ATT&CK.Technique. →

T1560. Stage 12.

Archive Collected Data.

Archive collected data is when an attacker packs stolen files into compressed or encrypted bundles before sending them out.

• Collection.

MITRE ATT&CK.Technique. →

T1005. Stage 12.

Data From Local System.

Data from local system is when an attacker searches a computer they already control to find files and other data worth taking.

• Collection.

MITRE ATT&CK.Technique. →

T1056. Stage 12.

Input Capture.

Input capture is when an attacker records what a user types or enters, to steal passwords or other information.

• Collection.

MITRE ATT&CK.Technique. →

T1071. Stage 13.

Application Layer Protocol.

Application Layer Protocol is a technique where attackers talk to a system they control using ordinary network protocols, such as those used for web browsing, file transfer, email or DNS.

• Command and Control.

MITRE ATT&CK.Technique. →

T1102.001. Stage 13.

Dead Drop Resolver: Hiding C2 Addresses On Public Web Services (T1102.001).

Dead Drop Resolver, Web Service: Dead Drop Resolver.

A dead drop resolver is a page on a legitimate web service that holds the address of the attacker's real command and control server.

• Command and Control.

MITRE ATT&CK.Technique. →

T1573. Stage 13.

Encrypted Channel.

Encrypted Channel is a technique where attackers encrypt the traffic they use to control a compromised system.

• Command and Control.

MITRE ATT&CK.Technique. →

T1105. Stage 13.

Ingress Tool Transfer.

Ingress Tool Transfer is a technique where attackers bring tools or other files from outside into a network they have already broken into.

• Command and Control.

MITRE ATT&CK.Technique. →

T1041. Stage 14.

Exfiltration Over C2 Channel.

Exfiltration over a C2 channel is when an attacker sends stolen data out through the same channel they already use to control the infected system.

• Exfiltration.

MITRE ATT&CK.Technique. →

T1486. Stage 15.

Data Encrypted For Impact.

Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key.

• Impact.

MITRE ATT&CK.Technique. →