-
Application Layer Protocol: Adversaries use application layer protocols for communication and data transfer within a target network.
-
Boot or Logon Autostart Execution: This technique involves configuring mechanisms for executing malicious code during system boot or login.
-
Command and Scripting Interpreter: Adversaries use interpreters to execute commands, scripts, or code on a victim's system.
-
Shortcut Modification: Modification of shortcut files (.lnk) to execute malicious commands when accessed.
-
Remote File Copy: Copying files from a remote system to the local system for lateral movement or data exfiltration.
-
Masquerading: Adversaries attempt to masquerade as legitimate entities or software to evade detection.
-
Obfuscated Files or Information: Adversaries use obfuscation techniques to hide or protect malicious code, scripts, or other data.
-
Phishing: Adversaries use phishing emails or messages to deliver malicious payloads or trick victims into revealing sensitive information.
-
Service Stop: Attackers stop or disable essential services or processes to disrupt or compromise a target system.
-
System Information Discovery: Adversaries gather information about the target system, such as hardware, software, or network configurations.
-
System Owner/User Discovery: This technique involves adversaries identifying and gathering information about the system owner or user accounts on a target system.
-
User Execution: Adversaries rely on user interactions, such as opening malicious attachments or clicking on links, to execute malicious code.
-
Abuse Elevation Control Mechanism: Attackers exploit mechanisms designed to control privilege elevation to gain higher levels of access.
-
Data from Information Repositories: Adversaries search for and steal sensitive information stored in information repositories.
-
Signed Binary Proxy Execution: This technique involves the use of signed binaries to proxy execution of malicious code.
-
System Network Configuration Discovery: Adversaries gather information about the network configuration of a target system. #
