Skip to content

Latest commit

 

History

History
141 lines (141 loc) · 44.4 KB

File metadata and controls

141 lines (141 loc) · 44.4 KB

All Atomic Tests by ATT&CK Tactic & Technique

initial-access execution persistence privilege-escalation defense-evasion credential-access discovery lateral-movement collection exfiltration command-and-control impact
Cloud Accounts CONTRIBUTE A TEST AppleScript .bash_profile and .bashrc .bash_profile and .bashrc Abuse Elevation Control Mechanism CONTRIBUTE A TEST /etc/passwd and /etc/shadow CONTRIBUTE A TEST Account Discovery CONTRIBUTE A TEST Application Access Token CONTRIBUTE A TEST Archive Collected Data Automated Exfiltration Application Layer Protocol CONTRIBUTE A TEST Account Access Removal
Compromise Hardware Supply Chain CONTRIBUTE A TEST At (Linux) Accessibility Features Abuse Elevation Control Mechanism CONTRIBUTE A TEST Access Token Manipulation CONTRIBUTE A TEST Bash History Application Window Discovery Component Object Model and Distributed COM CONTRIBUTE A TEST Archive via Custom Method CONTRIBUTE A TEST Data Transfer Size Limits Asymmetric Cryptography CONTRIBUTE A TEST Application Exhaustion Flood CONTRIBUTE A TEST
Compromise Software Dependencies and Development Tools CONTRIBUTE A TEST At (Windows) Account Manipulation Access Token Manipulation CONTRIBUTE A TEST Application Access Token CONTRIBUTE A TEST Brute Force CONTRIBUTE A TEST Browser Bookmark Discovery Distributed Component Object Model Archive via Library CONTRIBUTE A TEST Exfiltration Over Alternative Protocol Bidirectional Communication CONTRIBUTE A TEST Application or System Exploitation CONTRIBUTE A TEST
Compromise Software Supply Chain CONTRIBUTE A TEST Command and Scripting Interpreter CONTRIBUTE A TEST Add Office 365 Global Administrator Role CONTRIBUTE A TEST Accessibility Features Asynchronous Procedure Call Cached Domain Credentials CONTRIBUTE A TEST Cloud Account CONTRIBUTE A TEST Exploitation of Remote Services CONTRIBUTE A TEST Archive via Utility Exfiltration Over Asymmetric Encrypted Non-C2 Protocol CONTRIBUTE A TEST Commonly Used Port CONTRIBUTE A TEST Data Destruction
Default Accounts Component Object Model CONTRIBUTE A TEST Add-ins CONTRIBUTE A TEST AppCert DLLs CONTRIBUTE A TEST BITS Jobs Cloud Instance Metadata API CONTRIBUTE A TEST Cloud Groups CONTRIBUTE A TEST Internal Spearphishing CONTRIBUTE A TEST Audio Capture Exfiltration Over Bluetooth CONTRIBUTE A TEST Communication Through Removable Media CONTRIBUTE A TEST Data Encrypted for Impact CONTRIBUTE A TEST
Domain Accounts CONTRIBUTE A TEST Component Object Model and Distributed COM CONTRIBUTE A TEST Additional Azure Service Principal Credentials CONTRIBUTE A TEST AppInit DLLs Binary Padding Credential API Hooking Cloud Service Dashboard CONTRIBUTE A TEST Lateral Tool Transfer CONTRIBUTE A TEST Automated Collection Exfiltration Over C2 Channel CONTRIBUTE A TEST DNS Data Manipulation CONTRIBUTE A TEST
Drive-by Compromise CONTRIBUTE A TEST Cron AppCert DLLs CONTRIBUTE A TEST Application Shimming Bootkit CONTRIBUTE A TEST Credential Stuffing CONTRIBUTE A TEST Cloud Service Discovery CONTRIBUTE A TEST Pass the Hash Clipboard Data Exfiltration Over Other Network Medium CONTRIBUTE A TEST DNS Calculation CONTRIBUTE A TEST Defacement CONTRIBUTE A TEST
Exploit Public-Facing Application CONTRIBUTE A TEST Dynamic Data Exchange AppInit DLLs Asynchronous Procedure Call Bypass User Access Control Credentials In Files Domain Account Pass the Ticket Confluence CONTRIBUTE A TEST Exfiltration Over Physical Medium CONTRIBUTE A TEST Data Encoding CONTRIBUTE A TEST Direct Network Flood CONTRIBUTE A TEST
External Remote Services CONTRIBUTE A TEST Exploitation for Client Execution CONTRIBUTE A TEST Application Shimming At (Linux) CMSTP Credentials from Password Stores CONTRIBUTE A TEST Domain Groups RDP Hijacking Credential API Hooking Exfiltration Over Symmetric Encrypted Non-C2 Protocol CONTRIBUTE A TEST Data Obfuscation CONTRIBUTE A TEST Disk Content Wipe CONTRIBUTE A TEST
Hardware Additions CONTRIBUTE A TEST Graphical User Interface CONTRIBUTE A TEST At (Linux) At (Windows) COR_PROFILER Credentials from Web Browsers Domain Trust Discovery Remote Desktop Protocol Data Staged CONTRIBUTE A TEST Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol Dead Drop Resolver CONTRIBUTE A TEST Disk Structure Wipe CONTRIBUTE A TEST
Local Accounts CONTRIBUTE A TEST Inter-Process Communication CONTRIBUTE A TEST At (Windows) Authentication Package CONTRIBUTE A TEST Clear Command History Credentials in Registry Email Account CONTRIBUTE A TEST Remote Service Session Hijacking CONTRIBUTE A TEST Data from Cloud Storage Object CONTRIBUTE A TEST Exfiltration Over Web Service CONTRIBUTE A TEST Domain Fronting CONTRIBUTE A TEST Disk Wipe CONTRIBUTE A TEST
Phishing CONTRIBUTE A TEST JavaScript/JScript CONTRIBUTE A TEST Authentication Package CONTRIBUTE A TEST Boot or Logon Autostart Execution CONTRIBUTE A TEST Clear Linux or Mac System Logs DCSync CONTRIBUTE A TEST File and Directory Discovery Remote Services CONTRIBUTE A TEST Data from Information Repositories CONTRIBUTE A TEST Exfiltration over USB CONTRIBUTE A TEST Domain Generation Algorithms CONTRIBUTE A TEST Endpoint Denial of Service CONTRIBUTE A TEST
Replication Through Removable Media CONTRIBUTE A TEST Launchctl BITS Jobs Boot or Logon Initialization Scripts CONTRIBUTE A TEST Clear Windows Event Logs Domain Controller Authentication CONTRIBUTE A TEST Local Account Replication Through Removable Media CONTRIBUTE A TEST Data from Local System CONTRIBUTE A TEST Exfiltration to Cloud Storage CONTRIBUTE A TEST Dynamic Resolution CONTRIBUTE A TEST External Defacement CONTRIBUTE A TEST
Spearphishing Attachment Launchd Boot or Logon Autostart Execution CONTRIBUTE A TEST Bypass User Access Control Cloud Accounts CONTRIBUTE A TEST Exploitation for Credential Access CONTRIBUTE A TEST Local Groups SMB/Windows Admin Shares Data from Network Shared Drive CONTRIBUTE A TEST Exfiltration to Code Repository CONTRIBUTE A TEST Encrypted Channel Firmware Corruption CONTRIBUTE A TEST
Spearphishing Link CONTRIBUTE A TEST Malicious File Boot or Logon Initialization Scripts CONTRIBUTE A TEST COR_PROFILER Code Signing CONTRIBUTE A TEST Forced Authentication CONTRIBUTE A TEST Network Service Scanning SSH CONTRIBUTE A TEST Data from Removable Media CONTRIBUTE A TEST Scheduled Transfer CONTRIBUTE A TEST External Proxy CONTRIBUTE A TEST Inhibit System Recovery
Spearphishing via Service CONTRIBUTE A TEST Malicious Link CONTRIBUTE A TEST Bootkit CONTRIBUTE A TEST Change Default File Association Compile After Delivery GUI Input Capture Network Share Discovery SSH Hijacking CONTRIBUTE A TEST Email Collection CONTRIBUTE A TEST Transfer Data to Cloud Account CONTRIBUTE A TEST Fallback Channels CONTRIBUTE A TEST Internal Defacement CONTRIBUTE A TEST
Supply Chain Compromise CONTRIBUTE A TEST Native API Browser Extensions Cloud Accounts CONTRIBUTE A TEST Compiled HTML File Golden Ticket CONTRIBUTE A TEST Network Sniffing Shared Webroot CONTRIBUTE A TEST Email Forwarding Rule CONTRIBUTE A TEST Fast Flux DNS CONTRIBUTE A TEST Network Denial of Service CONTRIBUTE A TEST
Trusted Relationship CONTRIBUTE A TEST PowerShell COR_PROFILER Component Object Model Hijacking CONTRIBUTE A TEST Component Firmware CONTRIBUTE A TEST Group Policy Preferences Password Policy Discovery Software Deployment Tools CONTRIBUTE A TEST GUI Input Capture File Transfer Protocols CONTRIBUTE A TEST OS Exhaustion Flood CONTRIBUTE A TEST
Valid Accounts CONTRIBUTE A TEST Python CONTRIBUTE A TEST Change Default File Association Create Process with Token CONTRIBUTE A TEST Control Panel Input Capture CONTRIBUTE A TEST Peripheral Device Discovery CONTRIBUTE A TEST Taint Shared Content CONTRIBUTE A TEST Input Capture CONTRIBUTE A TEST Ingress Tool Transfer Reflection Amplification CONTRIBUTE A TEST
Scheduled Task Cloud Account CONTRIBUTE A TEST Create or Modify System Process CONTRIBUTE A TEST Create Cloud Instance CONTRIBUTE A TEST Kerberoasting Permission Groups Discovery CONTRIBUTE A TEST Use Alternate Authentication Material CONTRIBUTE A TEST Keylogging Internal Proxy Resource Hijacking
Scheduled Task/Job CONTRIBUTE A TEST Cloud Accounts CONTRIBUTE A TEST Cron Create Process with Token CONTRIBUTE A TEST Keychain Process Discovery VNC CONTRIBUTE A TEST LLMNR/NBT-NS Poisoning and SMB Relay CONTRIBUTE A TEST Junk Data CONTRIBUTE A TEST Runtime Data Manipulation CONTRIBUTE A TEST
Scripting CONTRIBUTE A TEST Component Firmware CONTRIBUTE A TEST DLL Search Order Hijacking Create Snapshot CONTRIBUTE A TEST Keylogging Query Registry Web Session Cookie CONTRIBUTE A TEST Local Data Staging Mail Protocols CONTRIBUTE A TEST Service Exhaustion Flood CONTRIBUTE A TEST
Service Execution Component Object Model Hijacking CONTRIBUTE A TEST DLL Side-Loading DLL Search Order Hijacking LLMNR/NBT-NS Poisoning and SMB Relay CONTRIBUTE A TEST Remote System Discovery Windows Remote Management Local Email Collection Multi-Stage Channels CONTRIBUTE A TEST Service Stop
Shared Modules CONTRIBUTE A TEST Compromise Client Software Binary CONTRIBUTE A TEST Default Accounts DLL Side-Loading LSA Secrets Security Software Discovery Man in the Browser CONTRIBUTE A TEST Multi-hop Proxy CONTRIBUTE A TEST Stored Data Manipulation CONTRIBUTE A TEST
Software Deployment Tools CONTRIBUTE A TEST Create Account CONTRIBUTE A TEST Domain Accounts CONTRIBUTE A TEST Default Accounts LSASS Memory Software Discovery Man-in-the-Middle CONTRIBUTE A TEST Multiband Communication CONTRIBUTE A TEST System Shutdown/Reboot
Source CONTRIBUTE A TEST Create or Modify System Process CONTRIBUTE A TEST Dylib Hijacking CONTRIBUTE A TEST Delete Cloud Instance CONTRIBUTE A TEST Man-in-the-Middle CONTRIBUTE A TEST System Checks CONTRIBUTE A TEST Remote Data Staging CONTRIBUTE A TEST Non-Application Layer Protocol Transmitted Data Manipulation CONTRIBUTE A TEST
System Services CONTRIBUTE A TEST Cron Dynamic-link Library Injection CONTRIBUTE A TEST Deobfuscate/Decode Files or Information Modify Authentication Process CONTRIBUTE A TEST System Information Discovery Remote Email Collection CONTRIBUTE A TEST Non-Standard Encoding CONTRIBUTE A TEST
Unix Shell DLL Search Order Hijacking Elevated Execution with Prompt CONTRIBUTE A TEST Direct Volume Access CONTRIBUTE A TEST NTDS System Network Configuration Discovery Screen Capture Non-Standard Port
User Execution CONTRIBUTE A TEST DLL Side-Loading Emond Disable Windows Event Logging Network Sniffing System Network Connections Discovery Sharepoint CONTRIBUTE A TEST One-Way Communication CONTRIBUTE A TEST
Visual Basic Default Accounts Event Triggered Execution CONTRIBUTE A TEST Disable or Modify Cloud Firewall CONTRIBUTE A TEST OS Credential Dumping System Owner/User Discovery Video Capture CONTRIBUTE A TEST Port Knocking CONTRIBUTE A TEST
Windows Command Shell Domain Account CONTRIBUTE A TEST Executable Installer File Permissions Weakness CONTRIBUTE A TEST Disable or Modify System Firewall Password Cracking System Service Discovery Web Portal Capture CONTRIBUTE A TEST Protocol Impersonation CONTRIBUTE A TEST
Windows Management Instrumentation Domain Accounts CONTRIBUTE A TEST Exploitation for Privilege Escalation CONTRIBUTE A TEST Disable or Modify Tools Password Filter DLL System Time Discovery Protocol Tunneling CONTRIBUTE A TEST
Dylib Hijacking CONTRIBUTE A TEST Extra Window Memory Injection CONTRIBUTE A TEST Domain Accounts CONTRIBUTE A TEST Password Guessing Time Based Evasion CONTRIBUTE A TEST Proxy CONTRIBUTE A TEST
Emond Group Policy Modification CONTRIBUTE A TEST Domain Controller Authentication CONTRIBUTE A TEST Password Spraying User Activity Based Checks CONTRIBUTE A TEST Remote Access Software
Event Triggered Execution CONTRIBUTE A TEST Hijack Execution Flow CONTRIBUTE A TEST Dylib Hijacking CONTRIBUTE A TEST Pluggable Authentication Modules CONTRIBUTE A TEST Virtualization/Sandbox Evasion CONTRIBUTE A TEST Standard Encoding
Exchange Email Delegate Permissions CONTRIBUTE A TEST Image File Execution Options Injection Dynamic-link Library Injection CONTRIBUTE A TEST Private Keys Steganography CONTRIBUTE A TEST
Executable Installer File Permissions Weakness CONTRIBUTE A TEST Kernel Modules and Extensions Elevated Execution with Prompt CONTRIBUTE A TEST Proc Filesystem CONTRIBUTE A TEST Symmetric Cryptography CONTRIBUTE A TEST
External Remote Services CONTRIBUTE A TEST LC_LOAD_DYLIB Addition CONTRIBUTE A TEST Environmental Keying CONTRIBUTE A TEST Security Account Manager Traffic Signaling CONTRIBUTE A TEST
Hijack Execution Flow CONTRIBUTE A TEST LD_PRELOAD Executable Installer File Permissions Weakness CONTRIBUTE A TEST Securityd Memory CONTRIBUTE A TEST Web Protocols
Hypervisor CONTRIBUTE A TEST LSASS Driver CONTRIBUTE A TEST Execution Guardrails CONTRIBUTE A TEST Silver Ticket CONTRIBUTE A TEST Web Service CONTRIBUTE A TEST
Image File Execution Options Injection Launch Agent Exploitation for Defense Evasion CONTRIBUTE A TEST Steal Application Access Token CONTRIBUTE A TEST
Implant Container Image CONTRIBUTE A TEST Launch Daemon Extra Window Memory Injection CONTRIBUTE A TEST Steal Web Session Cookie CONTRIBUTE A TEST
Kernel Modules and Extensions Launchd File Deletion Steal or Forge Kerberos Tickets CONTRIBUTE A TEST
LC_LOAD_DYLIB Addition CONTRIBUTE A TEST Local Accounts CONTRIBUTE A TEST File and Directory Permissions Modification CONTRIBUTE A TEST Two-Factor Authentication Interception CONTRIBUTE A TEST
LD_PRELOAD Logon Script (Mac) Gatekeeper Bypass Unsecured Credentials CONTRIBUTE A TEST
LSASS Driver CONTRIBUTE A TEST Logon Script (Windows) Group Policy Modification CONTRIBUTE A TEST Web Portal Capture CONTRIBUTE A TEST
Launch Agent Make and Impersonate Token CONTRIBUTE A TEST HISTCONTROL
Launch Daemon Netsh Helper DLL Hidden File System CONTRIBUTE A TEST
Launchd Network Logon Script CONTRIBUTE A TEST Hidden Files and Directories
Local Account Parent PID Spoofing Hidden Users
Local Accounts CONTRIBUTE A TEST Path Interception CONTRIBUTE A TEST Hidden Window
Logon Script (Mac) Path Interception by PATH Environment Variable CONTRIBUTE A TEST Hide Artifacts CONTRIBUTE A TEST
Logon Script (Windows) Path Interception by Search Order Hijacking CONTRIBUTE A TEST Hijack Execution Flow CONTRIBUTE A TEST
Netsh Helper DLL Path Interception by Unquoted Path Impair Defenses CONTRIBUTE A TEST
Network Logon Script CONTRIBUTE A TEST Plist Modification Indicator Blocking CONTRIBUTE A TEST
Office Application Startup CONTRIBUTE A TEST Port Monitors CONTRIBUTE A TEST Indicator Removal from Tools CONTRIBUTE A TEST
Office Template Macros CONTRIBUTE A TEST Portable Executable Injection CONTRIBUTE A TEST Indicator Removal on Host
Office Test CONTRIBUTE A TEST PowerShell Profile Indirect Command Execution
Outlook Forms CONTRIBUTE A TEST Proc Memory CONTRIBUTE A TEST Install Root Certificate
Outlook Home Page CONTRIBUTE A TEST Process Doppelgänging CONTRIBUTE A TEST InstallUtil
Outlook Rules CONTRIBUTE A TEST Process Hollowing Invalid Code Signature CONTRIBUTE A TEST
Path Interception CONTRIBUTE A TEST Process Injection LC_MAIN Hijacking CONTRIBUTE A TEST
Path Interception by PATH Environment Variable CONTRIBUTE A TEST Ptrace System Calls CONTRIBUTE A TEST LD_PRELOAD
Path Interception by Search Order Hijacking CONTRIBUTE A TEST Rc.common Linux and Mac File and Directory Permissions Modification
Path Interception by Unquoted Path Re-opened Applications Local Accounts CONTRIBUTE A TEST
Plist Modification Registry Run Keys / Startup Folder MSBuild
Port Knocking CONTRIBUTE A TEST SID-History Injection CONTRIBUTE A TEST Make and Impersonate Token CONTRIBUTE A TEST
Port Monitors CONTRIBUTE A TEST Scheduled Task Masquerade Task or Service CONTRIBUTE A TEST
PowerShell Profile Scheduled Task/Job CONTRIBUTE A TEST Masquerading CONTRIBUTE A TEST
Pre-OS Boot CONTRIBUTE A TEST Screensaver Match Legitimate Name or Location CONTRIBUTE A TEST
Rc.common Security Support Provider Modify Authentication Process CONTRIBUTE A TEST
Re-opened Applications Services File Permissions Weakness CONTRIBUTE A TEST Modify Cloud Compute Infrastructure CONTRIBUTE A TEST
Redundant Access CONTRIBUTE A TEST Services Registry Permissions Weakness Modify Registry
Registry Run Keys / Startup Folder Setuid and Setgid Mshta
SQL Stored Procedures CONTRIBUTE A TEST Shortcut Modification Msiexec
SSH Authorized Keys Startup Items NTFS File Attributes
Scheduled Task Sudo and Sudo Caching Network Share Connection Removal
Scheduled Task/Job CONTRIBUTE A TEST Systemd Service Obfuscated Files or Information
Screensaver Thread Execution Hijacking CONTRIBUTE A TEST Odbcconf
Security Support Provider Thread Local Storage CONTRIBUTE A TEST Parent PID Spoofing
Server Software Component CONTRIBUTE A TEST Time Providers CONTRIBUTE A TEST Pass the Hash
Services File Permissions Weakness CONTRIBUTE A TEST Token Impersonation/Theft CONTRIBUTE A TEST Pass the Ticket
Services Registry Permissions Weakness Trap Password Filter DLL
Shortcut Modification VDSO Hijacking CONTRIBUTE A TEST Path Interception by PATH Environment Variable CONTRIBUTE A TEST
Startup Items Valid Accounts CONTRIBUTE A TEST Path Interception by Search Order Hijacking CONTRIBUTE A TEST
System Firmware CONTRIBUTE A TEST Windows Management Instrumentation Event Subscription Path Interception by Unquoted Path
Systemd Service Windows Service Pluggable Authentication Modules CONTRIBUTE A TEST
Time Providers CONTRIBUTE A TEST Winlogon Helper DLL Port Knocking CONTRIBUTE A TEST
Traffic Signaling CONTRIBUTE A TEST Portable Executable Injection CONTRIBUTE A TEST
Transport Agent Pre-OS Boot CONTRIBUTE A TEST
Trap Proc Memory CONTRIBUTE A TEST
Valid Accounts CONTRIBUTE A TEST Process Doppelgänging CONTRIBUTE A TEST
Web Shell Process Hollowing
Windows Management Instrumentation Event Subscription Process Injection
Windows Service Ptrace System Calls CONTRIBUTE A TEST
Winlogon Helper DLL PubPrn
Redundant Access CONTRIBUTE A TEST
Regsvcs/Regasm
Regsvr32
Rename System Utilities
Revert Cloud Instance CONTRIBUTE A TEST
Right-to-Left Override CONTRIBUTE A TEST
Rogue Domain Controller
Rootkit
Run Virtual Instance CONTRIBUTE A TEST
Rundll32
SID-History Injection CONTRIBUTE A TEST
SIP and Trust Provider Hijacking CONTRIBUTE A TEST
Scripting CONTRIBUTE A TEST
Services File Permissions Weakness CONTRIBUTE A TEST
Services Registry Permissions Weakness
Setuid and Setgid
Signed Binary Proxy Execution
Signed Script Proxy Execution
Software Packing
Space after Filename
Steganography CONTRIBUTE A TEST
Subvert Trust Controls CONTRIBUTE A TEST
Sudo and Sudo Caching
System Checks CONTRIBUTE A TEST
System Firmware CONTRIBUTE A TEST
Template Injection CONTRIBUTE A TEST
Thread Execution Hijacking CONTRIBUTE A TEST
Thread Local Storage CONTRIBUTE A TEST
Time Based Evasion CONTRIBUTE A TEST
Timestomp
Token Impersonation/Theft CONTRIBUTE A TEST
Traffic Signaling CONTRIBUTE A TEST
Trusted Developer Utilities Proxy Execution CONTRIBUTE A TEST
Unused/Unsupported Cloud Regions CONTRIBUTE A TEST
Use Alternate Authentication Material CONTRIBUTE A TEST
User Activity Based Checks CONTRIBUTE A TEST
VDSO Hijacking CONTRIBUTE A TEST
Valid Accounts CONTRIBUTE A TEST
Virtualization/Sandbox Evasion CONTRIBUTE A TEST
Web Session Cookie CONTRIBUTE A TEST
Windows File and Directory Permissions Modification
XSL Script Processing