HomeTechniques

ATT&CK Techniques

Techniques represent "how" an adversary achieves a tactical goal. The Enterprise ATT&CK Matrix contains techniques for Windows, macOS, Linux, Cloud, Network, and Container platforms.

Showing 226 of 226 techniques

T1001•C2

Data Obfuscation

Adversaries may obfuscate command and control traffic to make it more difficult to detect.

3 sub-techniques

T1003•Cred Access

OS Credential Dumping

Adversaries may attempt to dump credentials to obtain account login and credential material.

8 sub-techniques

T1005•Collection

Data from Local System

Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data.

T1006•Defense Evasion

Direct Volume Access

Adversaries may directly access a volume to bypass file access controls and file system monitoring.

T1007•Discovery

System Service Discovery

Adversaries may try to gather information about registered local system services.

T1008•C2

Fallback Channels

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible.

T1010•Discovery

Application Window Discovery

Adversaries may attempt to get a listing of open application windows.

T1011•Exfiltration

Exfiltration Over Other Network Medium

Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.

1 sub-techniques

T1012•Discovery

Query Registry

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

T1014•Defense Evasion

Rootkit

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.

T1016•Discovery

System Network Configuration Discovery

Adversaries may look for details about the network configuration and settings.

2 sub-techniques

T1018•Discovery

Remote System Discovery

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network.

T1020•Exfiltration

Automated Exfiltration

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.

1 sub-techniques

T1021•Lateral Move

Remote Services

Adversaries may use Valid Accounts to log into a service specifically designed to accept remote connections.

8 sub-techniques

T1025•Collection

Data from Removable Media

Adversaries may search connected removable media on computers they have compromised to find files of interest.

T1027•Defense Evasion

Obfuscated Files or Information

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents.

17 sub-techniques

T1029•Exfiltration

Scheduled Transfer

Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals.

T1030•Exfiltration

Data Transfer Size Limits

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds.

T1033•Discovery

System Owner/User Discovery

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.

T1036•Defense Evasion

Masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign.

12 sub-techniques

T1037•Persistence

Boot or Logon Initialization Scripts

Adversaries may use scripts automatically executed at boot or logon initialization.

5 sub-techniques

T1039•Collection

Data from Network Shared Drive

Adversaries may search network shares on computers they have compromised to find files of interest.

T1040•Discovery

Network Sniffing

Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network.

T1041•Exfiltration

Exfiltration Over C2 Channel

Adversaries may steal data by exfiltrating it over an existing command and control channel.

T1046•Discovery

Network Service Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices.

T1047•Execution

Windows Management Instrumentation

Adversaries may abuse Windows Management Instrumentation to execute malicious commands.

T1048•Exfiltration

Exfiltration Over Alternative Protocol

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel.

3 sub-techniques

T1049•Discovery

System Network Connections Discovery

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing.

T1052•Exfiltration

Exfiltration Over Physical Medium

Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive.

1 sub-techniques

T1053•Execution

Scheduled Task/Job

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution.

5 sub-techniques

T1053•Persistence

Scheduled Task/Job

Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

5 sub-techniques

T1055•Priv Esc

Process Injection

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

12 sub-techniques

T1056•Cred Access

Input Capture

Adversaries may use methods of capturing user input to obtain credentials or collect information.

4 sub-techniques

T1056•Collection

Input Capture

Adversaries may use methods of capturing user input to obtain credentials or collect information.

4 sub-techniques

T1057•Discovery

Process Discovery

Adversaries may attempt to get information about running processes on a system.

T1059•Execution

Command and Scripting Interpreter

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

13 sub-techniques

T1068•Priv Esc

Exploitation for Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

T1069•Discovery

Permission Groups Discovery

Adversaries may attempt to discover group and permission settings.

3 sub-techniques

T1070•Defense Evasion

Indicator Removal

Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence.

10 sub-techniques

T1071•C2

Application Layer Protocol

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering.

4 sub-techniques

T1072•Execution

Software Deployment Tools

Adversaries may gain access to and use third-party software suites installed within an enterprise network.

T1072•Lateral Move

Software Deployment Tools

Adversaries may gain access to and use third-party software suites installed within an enterprise network to move laterally.

T1074•Collection

Data Staged

Adversaries may stage collected data in a central location or directory prior to Exfiltration.

2 sub-techniques

T1078•Initial Access

Valid Accounts

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access.

4 sub-techniques

T1078•Persistence

Valid Accounts

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining persistence.

4 sub-techniques

T1078•Defense Evasion

Valid Accounts

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

4 sub-techniques

T1080•Lateral Move

Taint Shared Content

Adversaries may deliver payloads to remote systems by adding content to shared storage locations.

T1082•Discovery

System Information Discovery

An adversary may attempt to get detailed information about the operating system and hardware.

T1083•Discovery

File and Directory Discovery

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information.

T1087•Discovery

Account Discovery

Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.

4 sub-techniques

T1090•C2

Proxy

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications.

4 sub-techniques

T1091•Initial Access

Replication Through Removable Media

Adversaries may move onto systems by copying malware to removable media.

T1091•Lateral Move

Replication Through Removable Media

Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media.

T1092•Collection

Communication Through Removable Media

Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands.

T1095•C2

Non-Application Layer Protocol

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts.

T1098•Persistence

Account Manipulation

Adversaries may manipulate accounts to maintain access to victim systems.

7 sub-techniques

T1102•C2

Web Service

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.

3 sub-techniques

T1104•C2

Multi-Stage Channels

Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions.

T1105•C2

Ingress Tool Transfer

Adversaries may transfer tools or other files from an external system into a compromised environment.

T1106•Execution

Native API

Adversaries may interact with the native OS application programming interface to execute behaviors.

T1110•Cred Access

Brute Force

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.

4 sub-techniques

T1111•Cred Access

Multi-Factor Authentication Interception

Adversaries may target multi-factor authentication mechanisms to gain access to credentials that can be used to access systems.

T1112•Defense Evasion

Modify Registry

Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques.

T1113•Collection

Screen Capture

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.

T1114•Collection

Email Collection

Adversaries may target user email to collect sensitive information.

3 sub-techniques

T1115•Collection

Clipboard Data

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

T1119•Collection

Automated Collection

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

T1120•Discovery

Peripheral Device Discovery

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.

T1123•Collection

Audio Capture

An adversary can leverage a computer's peripheral devices or applications to capture audio recordings.

T1124•Discovery

System Time Discovery

An adversary may gather the system time and/or time zone from a local or remote system.

T1125•Collection

Video Capture

An adversary can leverage a computer's peripheral devices or applications to capture video recordings.

T1127•Defense Evasion

Trusted Developer Utilities Proxy Execution

Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads.

1 sub-techniques

T1129•Execution

Shared Modules

Adversaries may execute malicious payloads via loading shared modules.

T1132•C2

Data Encoding

Adversaries may encode data to make the content of command and control traffic more difficult to detect.

2 sub-techniques

T1133•Initial Access

External Remote Services

Adversaries may leverage external-facing remote services to initially access and/or persist within a network.

T1134•Priv Esc

Access Token Manipulation

Adversaries may modify access tokens to operate under a different user or system security context.

5 sub-techniques

T1135•Discovery

Network Share Discovery

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather.

T1136•Persistence

Create Account

Adversaries may create an account to maintain access to victim systems.

3 sub-techniques

T1137•Persistence

Office Application Startup

Adversaries may leverage Microsoft Office-based applications for persistence between startups.

6 sub-techniques

T1140•Defense Evasion

Deobfuscate/Decode Files or Information

Adversaries may use obfuscated files or information to hide artifacts of an intrusion from analysis.

T1176•Persistence

Browser Extensions

Adversaries may abuse Internet browser extensions to establish persistent access to victim systems.

T1185•Collection

Browser Session Hijacking

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information.

T1187•Cred Access

Forced Authentication

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information.

T1189•Initial Access

Drive-by Compromise

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.

T1190•Initial Access

Exploit Public-Facing Application

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

T1195•Initial Access

Supply Chain Compromise

Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer.

3 sub-techniques

T1197•Persistence

BITS Jobs

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks.

T1199•Initial Access

Trusted Relationship

Adversaries may breach or otherwise leverage organizations who have access to intended victims.

T1200•Initial Access

Hardware Additions

Adversaries may introduce computer accessories, networking hardware, or other computing devices into a system or network.

T1201•Discovery

Password Policy Discovery

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment.

T1202•Defense Evasion

Indirect Command Execution

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

T1203•Execution

Exploitation for Client Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

T1204•Execution

User Execution

An adversary may rely upon specific actions by a user in order to gain execution.

5 sub-techniques

T1205•Persistence

Traffic Signaling

Adversaries may use traffic signaling to hide open ports or other malicious functionality.

2 sub-techniques

T1205•C2

Traffic Signaling

Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control.

2 sub-techniques

T1207•Defense Evasion

Rogue Domain Controller

Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data using DCShadow.

T1210•Lateral Move

Exploitation of Remote Services

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

T1211•Defense Evasion

Exploitation for Defense Evasion

Adversaries may exploit a system or application vulnerability to bypass security features.

T1212•Cred Access

Exploitation for Credential Access

Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

T1213•Collection

Data from Information Repositories

Adversaries may leverage information repositories to mine valuable information.

4 sub-techniques

T1216•Defense Evasion

System Script Proxy Execution

Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files.

2 sub-techniques

T1217•Discovery

Browser Information Discovery

Adversaries may enumerate information about browsers to learn more about compromised environments.

T1218•Defense Evasion

System Binary Proxy Execution

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed binaries.

15 sub-techniques

T1219•C2

Remote Access Software

An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel.

T1220•Defense Evasion

XSL Script Processing

Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files.

T1221•Defense Evasion

Template Injection

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.

T1222•Defense Evasion

File and Directory Permissions Modification

Adversaries may modify file or directory permissions/attributes to evade access control lists.

2 sub-techniques

T1480•Defense Evasion

Execution Guardrails

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions.

2 sub-techniques

T1482•Discovery

Domain Trust Discovery

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities.

T1484•Priv Esc

Domain/Tenant Policy Modification

Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges.

2 sub-techniques

T1485•Impact

Data Destruction

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

T1486•Impact

Data Encrypted for Impact

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

T1489•Impact

Service Stop

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

T1490•Impact

Inhibit System Recovery

Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system.

T1491•Impact

Defacement

Adversaries may modify visual content available internally or externally to an enterprise network.

2 sub-techniques

T1495•Impact

Firmware Corruption

Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system.

T1496•Impact

Resource Hijacking

Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems.

3 sub-techniques

T1497•Defense Evasion

Virtualization/Sandbox Evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

3 sub-techniques

T1497•Discovery

Virtualization/Sandbox Evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

3 sub-techniques

T1498•Impact

Network Denial of Service

Adversaries may perform Network Denial of Service attacks to degrade or block the availability of targeted resources to users.

2 sub-techniques

T1499•Impact

Endpoint Denial of Service

Adversaries may perform Endpoint Denial of Service attacks to degrade or block the availability of services to users.

4 sub-techniques

T1505•Persistence

Server Software Component

Adversaries may abuse legitimate extensible development features of servers to establish persistent access.

6 sub-techniques

T1518•Discovery

Software Discovery

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment.

1 sub-techniques

T1525•Persistence

Implant Internal Image

Adversaries may implant cloud or container images with malicious code to establish persistence.

T1526•Discovery

Cloud Service Discovery

An adversary may attempt to enumerate the cloud services running on a system after gaining access.

T1528•Cred Access

Steal Application Access Token

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

T1529•Impact

System Shutdown/Reboot

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

T1530•Collection

Data from Cloud Storage

Adversaries may access data from improperly secured cloud storage.

T1531•Impact

Account Access Removal

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.

T1534•Lateral Move

Internal Spearphishing

Adversaries may use internal spearphishing to gain access to additional information or exploit other users within the same organization.

T1535•Defense Evasion

Unused/Unsupported Cloud Regions

Adversaries may create cloud instances in unused geographic service regions in order to evade detection.

T1537•Exfiltration

Transfer Data to Cloud Account

Adversaries may exfiltrate data by transferring the data, including backups of cloud environments, to another cloud account they control.

T1538•Discovery

Cloud Service Dashboard

An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment.

T1539•Cred Access

Steal Web Session Cookie

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services.

T1542•Persistence

Pre-OS Boot

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.

5 sub-techniques

T1543•Persistence

Create or Modify System Process

Adversaries may create or modify system-level processes to repeatedly execute malicious payloads.

5 sub-techniques

T1546•Persistence

Event Triggered Execution

Adversaries may establish persistence using system mechanisms that trigger execution based on specific events.

18 sub-techniques

T1547•Persistence

Boot or Logon Autostart Execution

Adversaries may configure system settings to automatically execute a program during system boot or logon.

14 sub-techniques

T1548•Priv Esc

Abuse Elevation Control Mechanism

Adversaries may circumvent mechanisms designed to control elevated privileges to gain higher-level permissions.

6 sub-techniques

T1550•Defense Evasion

Use Alternate Authentication Material

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens.

4 sub-techniques

T1550•Lateral Move

Use Alternate Authentication Material

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens.

4 sub-techniques

T1552•Cred Access

Unsecured Credentials

Adversaries may search compromised systems to find and obtain insecurely stored credentials.

8 sub-techniques

T1553•Defense Evasion

Subvert Trust Controls

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.

6 sub-techniques

T1554•Persistence

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations.

3 sub-techniques

T1569•Execution

System Services

Adversaries may abuse system services or daemons to execute commands or programs.

3 sub-techniques

T1570•Lateral Move

Lateral Tool Transfer

Adversaries may transfer tools or other files between systems in a compromised environment.

T1571•C2

Non-Standard Port

Adversaries may communicate using a protocol and port pairing that are typically not associated.

T1572•C2

Protocol Tunneling

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering.

T1573•C2

Encrypted Channel

Adversaries may employ a known encryption algorithm to conceal command and control traffic.

2 sub-techniques

T1574•Persistence

Hijack Execution Flow

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.

12 sub-techniques

T1578•Defense Evasion

Modify Cloud Compute Infrastructure

Adversaries may modify cloud compute infrastructure to evade defenses.

Container Administration Command

Adversaries may abuse a container administration service to execute commands within a container.

T1610•Execution

Deploy Container

Adversaries may deploy a container into an environment to facilitate execution or evade defenses.

T1611•Priv Esc

Escape to Host

Adversaries may break out of a container to gain access to the underlying host.

T1612•Impact

Build Image on Host

Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry.

T1613•Discovery

Container and Resource Discovery

Adversaries may attempt to discover containers and other resources that are available within a containers environment.

T1614•Discovery

System Location Discovery

Adversaries may gather information in an attempt to calculate the geographical location of a victim host.

1 sub-techniques

T1615•Discovery

Group Policy Discovery

Adversaries may gather information on Group Policy settings to identify paths for privilege escalation.

T1619•Discovery

Cloud Storage Object Discovery

Adversaries may enumerate objects in cloud storage infrastructure to identify targets for data collection.

T1620•Defense Evasion

Reflective Code Loading

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads.

T1621•Cred Access

Multi-Factor Authentication Request Generation

Adversaries may attempt to bypass multi-factor authentication mechanisms and gain access to accounts by generating MFA requests sent to users.

T1622•Discovery

Debugger Evasion

Adversaries may employ various means to detect and avoid debuggers.

T1647•Defense Evasion

Plist File Modification

Adversaries may modify property list files to enable other malicious activity, while also potentially evading and bypassing system defenses.

T1648•Execution

ESXi Administration Command

Adversaries may abuse ESXi administration commands to execute commands on virtual machines.

T1649•Cred Access

Steal or Forge Authentication Certificates

Adversaries may steal or forge certificates used for authentication to access remote systems or resources.

T1650•Resource Dev

Acquire Access

Adversaries may purchase or otherwise acquire an existing access to a target system or network.

T1651•Execution

Cloud Administration Command

Adversaries may abuse cloud management services to execute commands within virtual machines.

T1652•Discovery

Device Driver Discovery

Adversaries may attempt to enumerate local device drivers on a victim host.

T1653•Impact

Power Settings

Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines.

T1654•Discovery

Log Enumeration

Adversaries may enumerate system and service logs to find useful data.

T1656•Defense Evasion

Impersonation

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf.

T1657•Impact

Financial Theft

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods.

T1659•Initial Access

Content Injection

Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.

T1665•Defense Evasion

Hide Infrastructure

Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure.

T1666•Defense Evasion

Modify Cloud Resource Hierarchy

Adversaries may attempt to modify hierarchical structures in infrastructure-as-a-service environments in order to evade defenses.

T1667•Impact

Email Bombing

Adversaries may flood targeted email addresses with an overwhelming volume of messages to bury legitimate emails and disrupt business operations.

T1668•Impact

Compromise Accounts

Adversaries may compromise accounts with services that can be used during targeting.

4 sub-techniques

T1669•Initial Access

Wi-Fi Networks

Adversaries may gain access to a system through a wireless network.

T1671•Impact

Email Spoofing

Adversaries may send messages with a spoofed sender address to targets.

T1672•Impact

Email Bombing

Adversaries may flood targeted email addresses with an overwhelming volume of messages.

T1673•Execution

Input Injection

Adversaries may inject malicious input to execute commands or code.

T1674•Execution

Input Injection

Adversaries may simulate keystrokes on a victim's computer by various means to perform any type of action on behalf of the user.

T1675•Execution

ESXi Administration Command

Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment.

T1677•Impact

Encrypted Channel

Adversaries may employ a known encryption algorithm to conceal command and control traffic.

T1678•Defense Evasion

Delay Execution

Adversaries may employ various time-based methods to evade detection and analysis.

T1679•Impact

Exploitation for Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

T1680•Discovery

Local Storage Discovery

Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.

T1681•Impact

Masquerade Task or Service

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.