ATT&CK

01

Reconnaissance

Gathering information to plan future adversary operations.

No techniques in this subset

02

Resource Development

Establishing resources to support operations.

No techniques in this subset

03

Initial Access

Techniques to gain an initial foothold within a network.

• T1566PhishingAdversaries send phishing messages to gain access to victim systems. Phishing can be targeted (spearphishing) or sent to large numbers of recipients.
• T1190Exploit Public-Facing ApplicationAdversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands.
• T1133External Remote ServicesAdversaries may leverage external-facing remote services to gain initial access. Remote services such as VPNs, Citrix, and other access mechanisms can be abused.

04

Execution

Running malicious code on a local or remote system.

• T1059Command and Scripting InterpreterAdversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces include PowerShell, Bash, Python, and more.
• T1204User ExecutionAdversaries may rely upon specific actions by a user in order to gain execution. Users may be tricked into opening malicious files or clicking malicious links.

05

Persistence

Maintaining presence across system restarts and credential changes.

• T1547Boot or Logon Autostart ExecutionAdversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence.
• T1053Scheduled Task/JobAdversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

06

Privilege Escalation

Gaining higher-level permissions on a system or network.

• T1068Exploitation for Privilege EscalationAdversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of vulnerabilities can take place locally or remotely.
• T1548Abuse Elevation Control MechanismAdversaries may abuse elevation control mechanisms like UAC bypass to gain higher privileges without prompting users.

07

Defense Evasion

Avoiding detection throughout an operation.

• T1070Indicator RemovalAdversaries may delete or alter artifacts generated during an intrusion to remove evidence of their presence or hinder incident response.
• T1027Obfuscated Files or InformationAdversaries may attempt to make payloads difficult to discover or analyze by encoding, encrypting, or obfuscating contents.

08

Credential Access

Stealing credentials like account names and passwords.

• T1003OS Credential DumpingAdversaries may attempt to dump credentials to obtain account login and password information, normally in hashed form.
• T1110Brute ForceAdversaries may use brute force techniques to gain access to accounts when passwords are unknown or password hashes are obtained.

09

Discovery

Gaining knowledge about the system and internal network.

No techniques in this subset

10

Lateral Movement

Moving through the environment to reach objectives.

• T1021Remote ServicesAdversaries may use Valid Accounts to log into a service specifically designed to accept remote connections, such as RDP, SSH, or SMB.
• T1550Use Alternate Authentication MaterialAdversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens to move laterally.

11

Collection

Gathering data of interest for exfiltration.

No techniques in this subset

12

Command and Control

Communicating with compromised systems to control them.

• T1071Application Layer ProtocolAdversaries may communicate using application layer protocols to avoid detection by blending in with existing traffic.
• T1105Ingress Tool TransferAdversaries may transfer tools or files from an external system into a compromised environment to stage operations.

13

Exfiltration

Stealing data from the network.

No techniques in this subset

14

Impact

Disrupting availability or compromising integrity.

• T1486Data Encrypted for ImpactAdversaries may encrypt data on target systems or on large numbers of systems to interrupt availability. This is the hallmark of ransomware attacks.
• T1489Service StopAdversaries may stop or disable services on a system to render it unusable or to hinder detection/recovery.