{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"https://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[{"@id":"d3f:T1001","d3f:attack-id":"T1001","d3f:definition":"Adversaries may obfuscate command and control traffic to make it more difficult to detect.(Citation: Bitdefender FunnyDream Campaign November 2020) Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.","rdfs:label":"Data Obfuscation"},{"@id":"d3f:T1001.001","d3f:attack-id":"T1001.001","d3f:definition":"Adversaries may add junk data to protocols used for command and control to make detection more difficult.(Citation: FireEye SUNBURST Backdoor December 2020) By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.","rdfs:label":"Junk Data"},{"@id":"d3f:T1001.002","d3f:attack-id":"T1001.002","d3f:definition":"Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.","rdfs:label":"Steganography"},{"@id":"d3f:T1001.003","d3f:attack-id":"T1001.003","d3f:definition":"Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.","rdfs:label":"Protocol or Service Impersonation"},{"@id":"d3f:T1002","d3f:attack-id":"T1002","d3f:definition":"An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. The compression is done separately from the exfiltration channel and is performed using a custom program or algorithm, or a more common compression library or utility such as 7zip, RAR, ZIP, or zlib.","rdfs:label":"Data Compressed","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1003","d3f:attack-id":"T1003","d3f:definition":"Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.","rdfs:label":"OS Credential Dumping"},{"@id":"d3f:T1003.001","d3f:attack-id":"T1003.001","d3f:definition":"Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).","rdfs:label":"LSASS Memory"},{"@id":"d3f:T1003.002","d3f:attack-id":"T1003.002","d3f:definition":"Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.","rdfs:label":"Security Account Manager"},{"@id":"d3f:T1003.003","d3f:attack-id":"T1003.003","d3f:definition":"Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\\NTDS\\Ntds.dit of a domain controller.(Citation: Wikipedia Active Directory)","rdfs:label":"NTDS"},{"@id":"d3f:T1003.004","d3f:attack-id":"T1003.004","d3f:definition":"Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\\SECURITY\\Policy\\Secrets. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets)","rdfs:label":"LSA Secrets"},{"@id":"d3f:T1003.005","d3f:attack-id":"T1003.005","d3f:definition":"Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds)","rdfs:label":"Cached Domain Credentials"},{"@id":"d3f:T1003.006","d3f:attack-id":"T1003.006","d3f:definition":"Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync.","rdfs:label":"DCSync"},{"@id":"d3f:T1003.007","d3f:attack-id":"T1003.007","d3f:definition":"Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc//maps` file shows how memory is mapped within the process’s virtual address space. And `/proc//mem`, exposed for debugging purposes, provides access to the process’s virtual address space.(Citation: Picus Labs Proc cump 2022)(Citation: baeldung Linux proc map 2022)","rdfs:label":"Proc Filesystem"},{"@id":"d3f:T1003.008","d3f:attack-id":"T1003.008","d3f:definition":"Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.(Citation: Linux Password and Shadow File Formats)","rdfs:label":"/etc/passwd and /etc/shadow"},{"@id":"d3f:T1004","d3f:attack-id":"T1004","d3f:definition":"Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\\Software\\[Wow6432Node\\]Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ and HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ are used to manage additional helper programs and functionalities that support Winlogon. (Citation: Cylance Reg Persistence Sept 2013)","rdfs:label":"Winlogon Helper DLL","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1005","d3f:attack-id":"T1005","d3f:definition":"Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.","rdfs:label":"Data from Local System"},{"@id":"d3f:T1006","d3f:attack-id":"T1006","d3f:definition":"Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools. (Citation: Hakobyan 2009)","rdfs:label":"Direct Volume Access"},{"@id":"d3f:T1007","d3f:attack-id":"T1007","d3f:definition":"Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start.","rdfs:label":"System Service Discovery"},{"@id":"d3f:T1008","d3f:attack-id":"T1008","d3f:definition":"Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.","rdfs:label":"Fallback Channels"},{"@id":"d3f:T1009","d3f:attack-id":"T1009","d3f:definition":"Adversaries can use binary padding to add junk data and change the on-disk representation of malware without affecting the functionality or behavior of the binary. This will often increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.","rdfs:label":"Binary Padding","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1010","d3f:attack-id":"T1010","d3f:definition":"Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020)","rdfs:label":"Application Window Discovery"},{"@id":"d3f:T1011","d3f:attack-id":"T1011","d3f:definition":"Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.","rdfs:label":"Exfiltration Over Other Network Medium"},{"@id":"d3f:T1011.001","d3f:attack-id":"T1011.001","d3f:definition":"Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel.","rdfs:label":"Exfiltration Over Bluetooth"},{"@id":"d3f:T1012","d3f:attack-id":"T1012","d3f:definition":"Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.","rdfs:label":"Query Registry"},{"@id":"d3f:T1013","d3f:attack-id":"T1013","d3f:definition":"A port monitor can be set through the (Citation: AddMonitor) API call to set a DLL to be loaded at startup. (Citation: AddMonitor) This DLL can be located in C:\\Windows\\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. The spoolsv.exe process also runs under SYSTEM level permissions. (Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors.","rdfs:label":"Port Monitors","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1014","d3f:attack-id":"T1014","d3f:definition":"Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits)","rdfs:label":"Rootkit"},{"@id":"d3f:T1015","d3f:attack-id":"T1015","d3f:definition":"Windows contains accessibility features that may be launched with a key combination before a user has logged in (for example, when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.","rdfs:label":"Accessibility Features","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1016","d3f:attack-id":"T1016","d3f:definition":"Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).","rdfs:label":"System Network Configuration Discovery"},{"@id":"d3f:T1016.001","d3f:attack-id":"T1016.001","d3f:definition":"Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), tracert, and GET requests to websites.","rdfs:label":"Internet Connection Discovery"},{"@id":"d3f:T1016.002","d3f:attack-id":"T1016.002","d3f:definition":"Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of [Account Discovery](https://attack.mitre.org/techniques/T1087), [Remote System Discovery](https://attack.mitre.org/techniques/T1018), and other discovery or [Credential Access](https://attack.mitre.org/tactics/TA0006) activity to support both ongoing and future campaigns.","rdfs:label":"Wi-Fi Discovery"},{"@id":"d3f:T1017","d3f:attack-id":"T1017","d3f:definition":"Adversaries may deploy malicious software to systems within a network using application deployment systems employed by enterprise administrators. The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the deployment server, or specific domain credentials may be required. However, the system may require an administrative account to log in or to perform software deployment.","rdfs:label":"Application Deployment Software","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1018","d3f:attack-id":"T1018","d3f:definition":"Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039).","rdfs:label":"Remote System Discovery"},{"@id":"d3f:T1019","d3f:attack-id":"T1019","d3f:definition":"The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI) (Citation: About UEFI)","rdfs:label":"System Firmware","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1020","d3f:attack-id":"T1020","d3f:definition":"Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020)","rdfs:label":"Automated Exfiltration"},{"@id":"d3f:T1020.001","d3f:attack-id":"T1020.001","d3f:definition":"Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring)","rdfs:label":"Traffic Duplication"},{"@id":"d3f:T1021","d3f:attack-id":"T1021","d3f:definition":"Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.","rdfs:label":"Remote Services"},{"@id":"d3f:T1021.001","d3f:attack-id":"T1021.001","d3f:definition":"Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.","rdfs:label":"Remote Desktop Protocol"},{"@id":"d3f:T1021.002","d3f:attack-id":"T1021.002","d3f:definition":"Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.","rdfs:label":"SMB/Windows Admin Shares"},{"@id":"d3f:T1021.003","d3f:attack-id":"T1021.003","d3f:definition":"Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.","rdfs:label":"Distributed Component Object Model"},{"@id":"d3f:T1021.004","d3f:attack-id":"T1021.004","d3f:definition":"Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.","rdfs:label":"SSH"},{"@id":"d3f:T1021.005","d3f:attack-id":"T1021.005","d3f:definition":"Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.(Citation: The Remote Framebuffer Protocol)","rdfs:label":"VNC"},{"@id":"d3f:T1021.006","d3f:attack-id":"T1021.006","d3f:definition":"Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.","rdfs:label":"Windows Remote Management"},{"@id":"d3f:T1021.007","d3f:attack-id":"T1021.007","d3f:definition":"Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user.","rdfs:label":"Cloud Services"},{"@id":"d3f:T1021.008","d3f:attack-id":"T1021.008","d3f:definition":"Adversaries may leverage [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log directly into accessible cloud hosted compute infrastructure through cloud native methods. Many cloud providers offer interactive connections to virtual infrastructure that can be accessed through the [Cloud API](https://attack.mitre.org/techniques/T1059/009), such as Azure Serial Console(Citation: Azure Serial Console), AWS EC2 Instance Connect(Citation: EC2 Instance Connect)(Citation: lucr-3: Getting SaaS-y in the cloud), and AWS System Manager.(Citation: AWS System Manager).","rdfs:label":"Direct Cloud VM Connections"},{"@id":"d3f:T1022","d3f:attack-id":"T1022","d3f:definition":"Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file archive formats that can encrypt files are RAR and zip.","rdfs:label":"Data Encrypted","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1023","d3f:attack-id":"T1023","d3f:definition":"Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries could use shortcuts to execute their tools for persistence. They may create a new shortcut as a means of indirection that may use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like a legitimate program. Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program.","rdfs:label":"Shortcut Modification","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1024","d3f:attack-id":"T1024","d3f:definition":"Adversaries may use a custom cryptographic protocol or algorithm to hide command and control traffic. A simple scheme, such as XOR-ing the plaintext with a fixed key, will produce a very weak ciphertext.","rdfs:label":"Custom Cryptographic Protocol","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1025","d3f:attack-id":"T1025","d3f:definition":"Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.","rdfs:label":"Data from Removable Media"},{"@id":"d3f:T1026","d3f:attack-id":"T1026","d3f:definition":"**This technique has been deprecated and should no longer be used.**","rdfs:label":"Multiband Communication","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1027","d3f:attack-id":"T1027","d3f:definition":"Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.","rdfs:label":"Obfuscated Files or Information"},{"@id":"d3f:T1027.001","d3f:attack-id":"T1027.001","d3f:definition":"Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.","rdfs:label":"Binary Padding"},{"@id":"d3f:T1027.002","d3f:attack-id":"T1027.002","d3f:definition":"Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018)","rdfs:label":"Software Packing"},{"@id":"d3f:T1027.003","d3f:attack-id":"T1027.003","d3f:definition":"Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.","rdfs:label":"Steganography"},{"@id":"d3f:T1027.004","d3f:attack-id":"T1027.004","d3f:definition":"Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)","rdfs:label":"Compile After Delivery"},{"@id":"d3f:T1027.005","d3f:attack-id":"T1027.005","d3f:definition":"Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.","rdfs:label":"Indicator Removal from Tools"},{"@id":"d3f:T1027.006","d3f:attack-id":"T1027.006","d3f:definition":"Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. HTML5 also introduced a download attribute that may be used to initiate file downloads.(Citation: HTML Smuggling Menlo Security 2020)(Citation: Outlflank HTML Smuggling 2018)","rdfs:label":"HTML Smuggling"},{"@id":"d3f:T1027.007","d3f:attack-id":"T1027.007","d3f:definition":"Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts.","rdfs:label":"Dynamic API Resolution"},{"@id":"d3f:T1027.008","d3f:attack-id":"T1027.008","d3f:definition":"Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018)","rdfs:label":"Stripped Payloads"},{"@id":"d3f:T1027.009","d3f:attack-id":"T1027.009","d3f:definition":"Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to [Subvert Trust Controls](https://attack.mitre.org/techniques/T1553) by not impacting execution controls such as digital signatures and notarization tickets.(Citation: Sentinel Labs)","rdfs:label":"Embedded Payloads"},{"@id":"d3f:T1027.010","d3f:attack-id":"T1027.010","d3f:definition":"Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE)","rdfs:label":"Command Obfuscation"},{"@id":"d3f:T1027.011","d3f:attack-id":"T1027.011","d3f:definition":"Adversaries may store data in \"fileless\" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage include the Windows Registry, event logs, or WMI repository.(Citation: Microsoft Fileless)(Citation: SecureList Fileless)","rdfs:label":"Fileless Storage"},{"@id":"d3f:T1027.012","d3f:attack-id":"T1027.012","d3f:definition":"Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory.","rdfs:label":"LNK Icon Smuggling"},{"@id":"d3f:T1027.013","d3f:attack-id":"T1027.013","d3f:definition":"Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Steganography](https://attack.mitre.org/techniques/T1027/003), and [Embedded Payloads](https://attack.mitre.org/techniques/T1027/009), share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)) at the time of execution/use.","rdfs:label":"Encrypted/Encoded File"},{"@id":"d3f:T1027.014","d3f:attack-id":"T1027.014","d3f:definition":"Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone)","rdfs:label":"Polymorphic Code"},{"@id":"d3f:T1028","d3f:attack-id":"T1028","d3f:definition":"Windows Remote Management (WinRM) is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). (Citation: Microsoft WinRM) It may be called with the winrm command or by any number of programs such as PowerShell. (Citation: Jacobsen 2014)","rdfs:label":"Windows Remote Management","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1029","d3f:attack-id":"T1029","d3f:definition":"Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.","rdfs:label":"Scheduled Transfer"},{"@id":"d3f:T1030","d3f:attack-id":"T1030","d3f:definition":"An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.","rdfs:label":"Data Transfer Size Limits"},{"@id":"d3f:T1031","d3f:attack-id":"T1031","d3f:definition":"Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Registry. Service configurations can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075).","rdfs:label":"Modify Existing Service","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1032","d3f:attack-id":"T1032","d3f:definition":"Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if necessary secret keys are encoded and/or generated within malware samples/configuration files.","rdfs:label":"Standard Cryptographic Protocol","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1033","d3f:attack-id":"T1033","d3f:definition":"Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.","rdfs:label":"System Owner/User Discovery"},{"@id":"d3f:T1034","d3f:attack-id":"T1034","d3f:definition":"**This technique has been deprecated. Please use [Path Interception by PATH Environment Variable](https://attack.mitre.org/techniques/T1574/007), [Path Interception by Search Order Hijacking](https://attack.mitre.org/techniques/T1574/008), and/or [Path Interception by Unquoted Path](https://attack.mitre.org/techniques/T1574/009).**","rdfs:label":"Path Interception","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1035","d3f:attack-id":"T1035","d3f:definition":"Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service. This technique is the execution used in conjunction with [New Service](https://attack.mitre.org/techniques/T1050) and [Modify Existing Service](https://attack.mitre.org/techniques/T1031) during service persistence or privilege escalation.","rdfs:label":"Service Execution","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1036","d3f:attack-id":"T1036","d3f:definition":"Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.","rdfs:label":"Masquerading"},{"@id":"d3f:T1036.001","d3f:attack-id":"T1036.001","d3f:definition":"Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017)","rdfs:label":"Invalid Code Signature"},{"@id":"d3f:T1036.002","d3f:attack-id":"T1036.002","d3f:definition":"Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named March 25 \\u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_re\\u202Egnp.js will be displayed as photo_high_resj.png.(Citation: Infosecinstitute RTLO Technique)","rdfs:label":"Right-to-Left Override"},{"@id":"d3f:T1036.003","d3f:attack-id":"T1036.003","d3f:definition":"Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. (Citation: LOLBAS Main Site) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). (Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths. (Citation: F-Secure CozyDuke)","rdfs:label":"Rename System Utilities"},{"@id":"d3f:T1036.004","d3f:attack-id":"T1036.004","d3f:definition":"Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.","rdfs:label":"Masquerade Task or Service"},{"@id":"d3f:T1036.005","d3f:attack-id":"T1036.005","d3f:definition":"Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.","rdfs:label":"Match Legitimate Name or Location"},{"@id":"d3f:T1036.006","d3f:attack-id":"T1036.006","d3f:definition":"Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.","rdfs:label":"Space after Filename"},{"@id":"d3f:T1036.007","d3f:attack-id":"T1036.007","d3f:definition":"Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: File.txt.exe may render in some views as just File.txt). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies.(Citation: PCMag DoubleExtension)(Citation: SOCPrime DoubleExtension)","rdfs:label":"Double File Extension"},{"@id":"d3f:T1036.008","d3f:attack-id":"T1036.008","d3f:definition":"Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is 0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`.","rdfs:label":"Masquerade File Type"},{"@id":"d3f:T1036.009","d3f:attack-id":"T1036.009","d3f:definition":"An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child\" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022)","rdfs:label":"Break Process Trees"},{"@id":"d3f:T1036.010","d3f:attack-id":"T1036.010","d3f:definition":"Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during [Create Account](https://attack.mitre.org/techniques/T1136), although accounts may also be renamed at a later date. This may also coincide with [Account Access Removal](https://attack.mitre.org/techniques/T1531) if the actor first deletes an account before re-creating one with the same name.(Citation: Huntress MOVEit 2023)","rdfs:label":"Masquerade Account Name"},{"@id":"d3f:T1037","d3f:attack-id":"T1037","d3f:definition":"Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.","rdfs:label":"Boot or Logon Initialization Scripts"},{"@id":"d3f:T1037.001","d3f:attack-id":"T1037.001","d3f:definition":"Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the HKCU\\Environment\\UserInitMprLogonScript Registry key.(Citation: Hexacorn Logon Scripts)","rdfs:label":"Logon Script (Windows)"},{"@id":"d3f:T1037.002","d3f:attack-id":"T1037.002","d3f:definition":"Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev)","rdfs:label":"Login Hook"},{"@id":"d3f:T1037.003","d3f:attack-id":"T1037.003","d3f:definition":"Group Policy Object / Active Directory Users and Computers are both Active Directory-based","rdfs:label":"Network Logon Script"},{"@id":"d3f:T1037.004","d3f:attack-id":"T1037.004","d3f:definition":"Adversaries may establish persistence by modifying RC scripts which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.","rdfs:label":"RC Scripts"},{"@id":"d3f:T1037.005","d3f:attack-id":"T1037.005","d3f:definition":"Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items)","rdfs:label":"Startup Items"},{"@id":"d3f:T1038","d3f:attack-id":"T1038","d3f:definition":"Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft DLL Search) Adversaries may take advantage of the Windows DLL search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence.","rdfs:label":"DLL Search Order Hijacking","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1039","d3f:attack-id":"T1039","d3f:definition":"Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.","rdfs:label":"Data from Network Shared Drive"},{"@id":"d3f:T1040","d3f:attack-id":"T1040","d3f:definition":"Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.","rdfs:label":"Network Sniffing"},{"@id":"d3f:T1041","d3f:attack-id":"T1041","d3f:definition":"Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.","rdfs:label":"Exfiltration Over C2 Channel"},{"@id":"d3f:T1042","d3f:attack-id":"T1042","d3f:definition":"When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access (Citation: Microsoft Change Default Programs) (Citation: Microsoft File Handlers) or by administrators using the built-in assoc utility. (Citation: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.","rdfs:label":"Change Default File Association","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1043","d3f:attack-id":"T1043","d3f:definition":"**This technique has been deprecated. Please use [Non-Standard Port](https://attack.mitre.org/techniques/T1571) where appropriate.**","rdfs:label":"Commonly Used Port","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1044","d3f:attack-id":"T1044","d3f:definition":"Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.","rdfs:label":"File System Permissions Weakness","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1045","d3f:attack-id":"T1045","d3f:definition":"Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory.","rdfs:label":"Software Packing","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1046","d3f:attack-id":"T1046","d3f:definition":"Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021)","rdfs:label":"Network Service Discovery"},{"@id":"d3f:T1047","d3f:attack-id":"T1047","d3f:definition":"Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.(Citation: WMI 1-3) WMI is an administration feature that provides a uniform environment to access Windows system components.","rdfs:label":"Windows Management Instrumentation"},{"@id":"d3f:T1048","d3f:attack-id":"T1048","d3f:definition":"Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.","rdfs:label":"Exfiltration Over Alternative Protocol"},{"@id":"d3f:T1048.001","d3f:attack-id":"T1048.001","d3f:definition":"Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.","rdfs:label":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol"},{"@id":"d3f:T1048.002","d3f:attack-id":"T1048.002","d3f:definition":"Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.","rdfs:label":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},{"@id":"d3f:T1048.003","d3f:attack-id":"T1048.003","d3f:definition":"Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco)","rdfs:label":"Exfiltration Over Unencrypted Non-C2 Protocol"},{"@id":"d3f:T1049","d3f:attack-id":"T1049","d3f:definition":"Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.","rdfs:label":"System Network Connections Discovery"},{"@id":"d3f:T1050","d3f:attack-id":"T1050","d3f:definition":"When operating systems boot up, they can start programs or applications called services that perform background system functions. (Citation: TechNet Services) A service's configuration information, including the file path to the service's executable, is stored in the Windows Registry.","rdfs:label":"New Service","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1051","d3f:attack-id":"T1051","d3f:definition":"**This technique has been deprecated and should no longer be used.**","rdfs:label":"Shared Webroot","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1052","d3f:attack-id":"T1052","d3f:definition":"Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.","rdfs:label":"Exfiltration Over Physical Medium"},{"@id":"d3f:T1052.001","d3f:attack-id":"T1052.001","d3f:definition":"Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.","rdfs:label":"Exfiltration over USB"},{"@id":"d3f:T1053","d3f:attack-id":"T1053","d3f:definition":"The sub-techniques of this are specific software implementations of scheduling capabilities","rdfs:label":"Scheduled Task/Job"},{"@id":"d3f:T1053.001","d3f:attack-id":"T1053.001","d3f:definition":"Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial, recurring, or future execution of malicious code. The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux)","rdfs:label":"At (Linux) Execution","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1053.002","d3f:attack-id":"T1053.002","d3f:definition":"Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date. Although deprecated in favor of [Scheduled Task](https://attack.mitre.org/techniques/T1053/005)'s [schtasks](https://attack.mitre.org/software/S0111) in Windows environments, using [at](https://attack.mitre.org/software/S0110) requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group.","rdfs:label":"At"},{"@id":"d3f:T1053.003","d3f:attack-id":"T1053.003","d3f:definition":"Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The cron utility is a time-based job scheduler for Unix-like operating systems. The crontab file contains the schedule of cron entries to be run and the specified times for execution. Any crontab files are stored in operating system-specific file paths.","rdfs:label":"Cron"},{"@id":"d3f:T1053.004","d3f:attack-id":"T1053.004","d3f:definition":"This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself.","rdfs:label":"Launchd","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1053.005","d3f:attack-id":"T1053.005","d3f:definition":"Renamed from ATT&CK to be consistent with at, launchd, cron siblings; name as is looks like parent. Not sure why parent is not just Scheduled Task [Execution[.","rdfs:label":"Scheduled Task"},{"@id":"d3f:T1053.006","d3f:attack-id":"T1053.006","d3f:definition":"Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension .timer that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020) Systemd timers may be activated remotely via the systemctl command line utility, which operates over [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: Systemd Remote Control)","rdfs:label":"Systemd Timers"},{"@id":"d3f:T1053.007","d3f:attack-id":"T1053.007","d3f:definition":"Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.","rdfs:label":"Container Orchestration Job"},{"@id":"d3f:T1054","d3f:attack-id":"T1054","d3f:definition":"An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting (Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW),(Citation: Microsoft About Event Tracing 2018) by tampering settings that control the collection and flow of event telemetry. (Citation: Medium Event Tracing Tampering 2018) These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1086) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).","rdfs:label":"Indicator Blocking","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1055","d3f:attack-id":"T1055","d3f:definition":"Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.","rdfs:label":"Process Injection"},{"@id":"d3f:T1055.001","d3f:attack-id":"T1055.001","d3f:definition":"Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.","rdfs:label":"Dynamic-link Library Injection"},{"@id":"d3f:T1055.002","d3f:attack-id":"T1055.002","d3f:definition":"Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.","rdfs:label":"Portable Executable Injection"},{"@id":"d3f:T1055.003","d3f:attack-id":"T1055.003","d3f:definition":"Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process.","rdfs:label":"Thread Execution Hijacking"},{"@id":"d3f:T1055.004","d3f:attack-id":"T1055.004","d3f:definition":"Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process.","rdfs:label":"Asynchronous Procedure Call"},{"@id":"d3f:T1055.005","d3f:attack-id":"T1055.005","d3f:definition":"Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges. TLS callback injection is a method of executing arbitrary code in the address space of a separate live process.","rdfs:label":"Thread Local Storage"},{"@id":"d3f:T1055.008","d3f:attack-id":"T1055.008","d3f:definition":"Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.","rdfs:label":"Ptrace System Calls"},{"@id":"d3f:T1055.009","d3f:attack-id":"T1055.009","d3f:definition":"Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges. Proc memory injection is a method of executing arbitrary code in the address space of a separate live process.","rdfs:label":"Proc Memory"},{"@id":"d3f:T1055.011","d3f:attack-id":"T1055.011","d3f:definition":"Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.","rdfs:label":"Extra Window Memory Injection"},{"@id":"d3f:T1055.012","d3f:attack-id":"T1055.012","d3f:definition":"Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.","rdfs:label":"Process Hollowing"},{"@id":"d3f:T1055.013","d3f:attack-id":"T1055.013","d3f:definition":"Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process.","rdfs:label":"Process Doppelgänging"},{"@id":"d3f:T1055.014","d3f:attack-id":"T1055.014","d3f:definition":"Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges. Virtual dynamic shared object (vdso) hijacking is a method of executing arbitrary code in the address space of a separate live process.","rdfs:label":"VDSO Hijacking"},{"@id":"d3f:T1055.015","d3f:attack-id":"T1055.015","d3f:definition":"Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process. Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.","rdfs:label":"ListPlanting"},{"@id":"d3f:T1056","d3f:attack-id":"T1056","d3f:definition":"Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).","rdfs:label":"Input Capture"},{"@id":"d3f:T1056.001","d3f:attack-id":"T1056.001","d3f:definition":"Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.(Citation: Talos Kimsuky Nov 2021)","rdfs:label":"Keylogging"},{"@id":"d3f:T1056.002","d3f:attack-id":"T1056.002","d3f:definition":"Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).","rdfs:label":"GUI Input Capture"},{"@id":"d3f:T1056.003","d3f:attack-id":"T1056.003","d3f:definition":"Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.","rdfs:label":"Web Portal Capture"},{"@id":"d3f:T1056.004","d3f:attack-id":"T1056.004","d3f:definition":"Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001), this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:","rdfs:label":"Credential API Hooking"},{"@id":"d3f:T1057","d3f:attack-id":"T1057","d3f:definition":"Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.","rdfs:label":"Process Discovery"},{"@id":"d3f:T1058","d3f:attack-id":"T1058","d3f:definition":"Windows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1086), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: MSDN Registry Key Security)","rdfs:label":"Service Registry Permissions Weakness","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1059","d3f:attack-id":"T1059","d3f:definition":"Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).","rdfs:label":"Command and Scripting Interpreter"},{"@id":"d3f:T1059.001","d3f:attack-id":"T1059.001","d3f:definition":"Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).","rdfs:label":"PowerShell"},{"@id":"d3f:T1059.002","d3f:attack-id":"T1059.002","d3f:definition":"Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.","rdfs:label":"AppleScript"},{"@id":"d3f:T1059.003","d3f:attack-id":"T1059.003","d3f:definition":"Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: SSH in Windows)","rdfs:label":"Windows Command Shell"},{"@id":"d3f:T1059.004","d3f:attack-id":"T1059.004","d3f:definition":"Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.","rdfs:label":"Unix Shell"},{"@id":"d3f:T1059.005","d3f:attack-id":"T1059.005","d3f:definition":"Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft)","rdfs:label":"Visual Basic"},{"@id":"d3f:T1059.006","d3f:attack-id":"T1059.006","d3f:definition":"Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020)","rdfs:label":"Python"},{"@id":"d3f:T1059.007","d3f:attack-id":"T1059.007","d3f:definition":"Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS)","rdfs:label":"JavaScript"},{"@id":"d3f:T1059.008","d3f:attack-id":"T1059.008","d3f:definition":"Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands.","rdfs:label":"Network Device CLI"},{"@id":"d3f:T1059.009","d3f:attack-id":"T1059.009","d3f:definition":"Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules like Azure for PowerShell(Citation: Microsoft - Azure PowerShell), or software developer kits (SDKs) available for languages such as [Python](https://attack.mitre.org/techniques/T1059/006).","rdfs:label":"Cloud API"},{"@id":"d3f:T1059.010","d3f:attack-id":"T1059.010","d3f:definition":"Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs.(Citation: AutoIT)(Citation: AutoHotKey)","rdfs:label":"AutoHotKey & AutoIT"},{"@id":"d3f:T1059.011","d3f:attack-id":"T1059.011","d3f:definition":"Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (.lua), or from Lua-embedded programs (through the struct lua_State).(Citation: Lua main page)(Citation: Lua state)","rdfs:label":"Lua"},{"@id":"d3f:T1060","d3f:attack-id":"T1060","d3f:definition":"Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the \"run keys\" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.","rdfs:label":"Registry Run Keys / Startup Folder","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1061","d3f:attack-id":"T1061","d3f:definition":"**This technique has been deprecated. Please use [Remote Services](https://attack.mitre.org/techniques/T1021) where appropriate.**","rdfs:label":"Graphical User Interface","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1062","d3f:attack-id":"T1062","d3f:definition":"**This technique has been deprecated and should no longer be used.**","rdfs:label":"Hypervisor","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1063","d3f:attack-id":"T1063","d3f:definition":"Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1063) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.","rdfs:label":"Security Software Discovery","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1064","d3f:attack-id":"T1064","d3f:definition":"**This technique has been deprecated. Please use [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) where appropriate.**","rdfs:label":"Scripting","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1065","d3f:attack-id":"T1065","d3f:definition":"Adversaries may conduct C2 communications over a non-standard port to bypass proxies and firewalls that have been improperly configured.","rdfs:label":"Uncommonly Used Port","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1066","d3f:attack-id":"T1066","d3f:definition":"If a malicious tool is detected and quarantined or otherwise curtailed, an adversary may be able to determine why the malicious tool was detected (the indicator), modify the tool by removing the indicator, and use the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.","rdfs:label":"Indicator Removal from Tools","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1067","d3f:attack-id":"T1067","d3f:definition":"A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). (Citation: MTrends 2016)","rdfs:label":"Bootkit","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1068","d3f:attack-id":"T1068","d3f:definition":"Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.","rdfs:label":"Exploitation for Privilege Escalation"},{"@id":"d3f:T1069","d3f:attack-id":"T1069","d3f:definition":"Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.","rdfs:label":"Permission Groups Discovery"},{"@id":"d3f:T1069.001","d3f:attack-id":"T1069.001","d3f:definition":"Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.","rdfs:label":"Local Groups"},{"@id":"d3f:T1069.002","d3f:attack-id":"T1069.002","d3f:definition":"Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.","rdfs:label":"Domain Groups"},{"@id":"d3f:T1069.003","d3f:attack-id":"T1069.003","d3f:definition":"Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.","rdfs:label":"Cloud Groups"},{"@id":"d3f:T1070","d3f:attack-id":"T1070","d3f:definition":"Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.","rdfs:label":"Indicator Removal"},{"@id":"d3f:T1070.001","d3f:attack-id":"T1070.001","d3f:definition":"Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.","rdfs:label":"Clear Windows Event Logs"},{"@id":"d3f:T1070.002","d3f:attack-id":"T1070.002","d3f:definition":"Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)","rdfs:label":"Clear Linux or Mac System Logs"},{"@id":"d3f:T1070.003","d3f:attack-id":"T1070.003","d3f:definition":"In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.","rdfs:label":"Clear Command History"},{"@id":"d3f:T1070.004","d3f:attack-id":"T1070.004","d3f:definition":"Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.","rdfs:label":"File Deletion"},{"@id":"d3f:T1070.005","d3f:attack-id":"T1070.005","d3f:definition":"Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\\\system\\share /delete command. (Citation: Technet Net Use)","rdfs:label":"Network Share Connection Removal"},{"@id":"d3f:T1070.006","d3f:attack-id":"T1070.006","d3f:definition":"Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.","rdfs:label":"Timestomp"},{"@id":"d3f:T1070.007","d3f:attack-id":"T1070.007","d3f:definition":"Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.","rdfs:label":"Clear Network Connection History and Configurations"},{"@id":"d3f:T1070.008","d3f:attack-id":"T1070.008","d3f:definition":"Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.","rdfs:label":"Clear Mailbox Data"},{"@id":"d3f:T1070.009","d3f:attack-id":"T1070.009","d3f:definition":"Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco Attack 2022)","rdfs:label":"Clear Persistence"},{"@id":"d3f:T1070.010","d3f:attack-id":"T1070.010","d3f:definition":"Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with [File Deletion](https://attack.mitre.org/techniques/T1070/004) to cleanup older artifacts.","rdfs:label":"Relocate Malware"},{"@id":"d3f:T1071","d3f:attack-id":"T1071","d3f:definition":"Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.","rdfs:label":"Application Layer Protocol"},{"@id":"d3f:T1071.001","d3f:attack-id":"T1071.001","d3f:definition":"Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.","rdfs:label":"Web Protocols"},{"@id":"d3f:T1071.002","d3f:attack-id":"T1071.002","d3f:definition":"Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.","rdfs:label":"File Transfer Protocols"},{"@id":"d3f:T1071.003","d3f:attack-id":"T1071.003","d3f:definition":"Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.","rdfs:label":"Mail Protocols"},{"@id":"d3f:T1071.004","d3f:attack-id":"T1071.004","d3f:definition":"Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.","rdfs:label":"DNS"},{"@id":"d3f:T1071.005","d3f:attack-id":"T1071.005","d3f:definition":"Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.","rdfs:label":"Publish/Subscribe Protocols"},{"@id":"d3f:T1072","d3f:attack-id":"T1072","d3f:definition":"Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.","rdfs:label":"Software Deployment Tools"},{"@id":"d3f:T1073","d3f:attack-id":"T1073","d3f:definition":"Programs may specify DLLs that are loaded at runtime. Programs that improperly or vaguely specify a required DLL may be open to a vulnerability in which an unintended DLL is loaded. Side-loading vulnerabilities specifically occur when Windows Side-by-Side (WinSxS) manifests (Citation: MSDN Manifests) are not explicit enough about characteristics of the DLL to be loaded. Adversaries may take advantage of a legitimate program that is vulnerable to side-loading to load a malicious DLL. (Citation: Stewart 2014)","rdfs:label":"DLL Side-Loading","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1074","d3f:attack-id":"T1074","d3f:definition":"Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.(Citation: PWC Cloud Hopper April 2017)","rdfs:label":"Data Staged"},{"@id":"d3f:T1074.001","d3f:attack-id":"T1074.001","d3f:definition":"Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.","rdfs:label":"Local Data Staging"},{"@id":"d3f:T1074.002","d3f:attack-id":"T1074.002","d3f:definition":"Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.","rdfs:label":"Remote Data Staging"},{"@id":"d3f:T1075","d3f:attack-id":"T1075","d3f:definition":"Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. In this technique, valid password hashes for the account being used are captured using a Credential Access technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems.","rdfs:label":"Pass the Hash","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1076","d3f:attack-id":"T1076","d3f:definition":"Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). (Citation: TechNet Remote Desktop Services) There are other implementations and third-party tools that provide graphical access [Remote Services](https://attack.mitre.org/techniques/T1021) similar to RDS.","rdfs:label":"Remote Desktop Protocol","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1077","d3f:attack-id":"T1077","d3f:definition":"Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include C$, ADMIN$, and IPC$.","rdfs:label":"Windows Admin Shares","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1078","d3f:attack-id":"T1078","d3f:definition":"Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.(Citation: volexity_0day_sophos_FW) Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.","rdfs:label":"Valid Accounts"},{"@id":"d3f:T1078.001","d3f:attack-id":"T1078.001","d3f:definition":"Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS and the default service account in Kubernetes.(Citation: Microsoft Local Accounts Feb 2019)(Citation: AWS Root User)(Citation: Threat Matrix for Kubernetes)","rdfs:label":"Default Accounts"},{"@id":"d3f:T1078.002","d3f:attack-id":"T1078.002","d3f:definition":"Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.(Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts)","rdfs:label":"Domain Accounts"},{"@id":"d3f:T1078.003","d3f:attack-id":"T1078.003","d3f:definition":"Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.","rdfs:label":"Local Accounts"},{"@id":"d3f:T1078.004","d3f:attack-id":"T1078.004","d3f:definition":"Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory. (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)","rdfs:label":"Cloud Accounts"},{"@id":"d3f:T1079","d3f:attack-id":"T1079","d3f:definition":"An adversary performs C2 communications using multiple layers of encryption, typically (but not exclusively) tunneling a custom encryption scheme within a protocol encryption scheme such as HTTPS or SMTPS.","rdfs:label":"Multilayer Encryption","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1080","d3f:attack-id":"T1080","d3f:definition":"","rdfs:label":"Taint Shared Content"},{"@id":"d3f:T1081","d3f:attack-id":"T1081","d3f:definition":"Adversaries may search local file systems and remote file shares for files containing passwords. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.","rdfs:label":"Credentials in Files","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1082","d3f:attack-id":"T1082","d3f:definition":"An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.","rdfs:label":"System Information Discovery"},{"@id":"d3f:T1083","d3f:attack-id":"T1083","d3f:definition":"Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.","rdfs:label":"File and Directory Discovery"},{"@id":"d3f:T1084","d3f:attack-id":"T1084","d3f:definition":"Windows Management Instrumentation (WMI) can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. Adversaries may attempt to evade detection of this technique by compiling WMI scripts into Windows Management Object (MOF) files (.mof extension). (Citation: Dell WMI Persistence) Examples of events that may be subscribed to are the wall clock time or the computer's uptime. (Citation: Kazanciyan 2014) Several threat groups have reportedly used this technique to maintain persistence. (Citation: Mandiant M-Trends 2015)","rdfs:label":"Windows Management Instrumentation Event Subscription","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1085","d3f:attack-id":"T1085","d3f:definition":"The rundll32.exe program can be called to execute an arbitrary binary. Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of the rundll32.exe process because of whitelists or false positives from Windows using rundll32.exe for normal operations.","rdfs:label":"Rundll32","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1086","d3f:attack-id":"T1086","d3f:definition":"PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer.","rdfs:label":"PowerShell","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1087","d3f:attack-id":"T1087","d3f:definition":"Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)).","rdfs:label":"Account Discovery"},{"@id":"d3f:T1087.001","d3f:attack-id":"T1087.001","d3f:definition":"Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.","rdfs:label":"Local Account"},{"@id":"d3f:T1087.002","d3f:attack-id":"T1087.002","d3f:definition":"Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.","rdfs:label":"Domain Account"},{"@id":"d3f:T1087.003","d3f:attack-id":"T1087.003","d3f:definition":"Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists)","rdfs:label":"Email Account"},{"@id":"d3f:T1087.004","d3f:attack-id":"T1087.004","d3f:definition":"Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.","rdfs:label":"Cloud Account"},{"@id":"d3f:T1088","d3f:attack-id":"T1088","d3f:definition":"Windows User Account Control (UAC) allows a program to elevate its privileges to perform a task under administrator-level permissions by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works)","rdfs:label":"Bypass User Account Control","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1089","d3f:attack-id":"T1089","d3f:definition":"Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security scanning or event reporting.","rdfs:label":"Disabling Security Tools","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1090","d3f:attack-id":"T1090","d3f:definition":"Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.","rdfs:label":"Proxy"},{"@id":"d3f:T1090.001","d3f:attack-id":"T1090.001","d3f:definition":"Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.","rdfs:label":"Internal Proxy"},{"@id":"d3f:T1090.002","d3f:attack-id":"T1090.002","d3f:definition":"Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.","rdfs:label":"External Proxy"},{"@id":"d3f:T1090.003","d3f:attack-id":"T1090.003","d3f:definition":"Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.","rdfs:label":"Multi-hop Proxy"},{"@id":"d3f:T1090.004","d3f:attack-id":"T1090.004","d3f:definition":"Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, \"domainless\" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).","rdfs:label":"Domain Fronting"},{"@id":"d3f:T1091","d3f:attack-id":"T1091","d3f:definition":"Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.","rdfs:label":"Replication Through Removable Media"},{"@id":"d3f:T1092","d3f:attack-id":"T1092","d3f:definition":"Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.","rdfs:label":"Communication Through Removable Media"},{"@id":"d3f:T1093","d3f:attack-id":"T1093","d3f:definition":"Process hollowing occurs when a process is created in a suspended state then its memory is unmapped and replaced with malicious code. Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), execution of the malicious code is masked under a legitimate process and may evade defenses and detection analysis. (Citation: Leitch Hollowing) (Citation: Elastic Process Injection July 2017)","rdfs:label":"Process Hollowing","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1094","d3f:attack-id":"T1094","d3f:definition":"Adversaries may communicate using a custom command and control protocol instead of encapsulating commands/data in an existing [Application Layer Protocol](https://attack.mitre.org/techniques/T1071). Implementations include mimicking well-known protocols or developing custom protocols (including raw sockets) on top of fundamental protocols provided by TCP/IP/another standard network stack.","rdfs:label":"Custom Command and Control Protocol","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1095","d3f:attack-id":"T1095","d3f:definition":"Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).","rdfs:label":"Non-Application Layer Protocol"},{"@id":"d3f:T1096","d3f:attack-id":"T1096","d3f:definition":"Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)","rdfs:label":"NTFS File Attributes","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1097","d3f:attack-id":"T1097","d3f:definition":"Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.","rdfs:label":"Pass the Ticket","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1098","d3f:attack-id":"T1098","d3f:definition":"Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.","rdfs:label":"Account Manipulation"},{"@id":"d3f:T1098.001","d3f:attack-id":"T1098.001","d3f:definition":"Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.","rdfs:label":"Additional Cloud Credentials"},{"@id":"d3f:T1098.002","d3f:attack-id":"T1098.002","d3f:definition":"Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.","rdfs:label":"Additional Email Delegate Permissions"},{"@id":"d3f:T1098.003","d3f:attack-id":"T1098.003","d3f:definition":"An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)","rdfs:label":"Additional Cloud Roles"},{"@id":"d3f:T1098.004","d3f:attack-id":"T1098.004","d3f:definition":"Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions and macOS commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <user-home>/.ssh/authorized_keys.(Citation: SSH Authorized Keys) Users may edit the system’s SSH config file to modify the directives PubkeyAuthentication and RSAAuthentication to the value “yes” to ensure public key and RSA authentication are enabled. The SSH config file is usually located under /etc/ssh/sshd_config.","rdfs:label":"SSH Authorized Keys"},{"@id":"d3f:T1098.005","d3f:attack-id":"T1098.005","d3f:definition":"Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.","rdfs:label":"Device Registration"},{"@id":"d3f:T1098.006","d3f:attack-id":"T1098.006","d3f:definition":"An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.(Citation: Kubernetes RBAC)(Citation: Aquasec Kubernetes Attack 2023) Where attribute-based access control (ABAC) is in use, an adversary with sufficient permissions may modify a Kubernetes ABAC policy to give the target account additional permissions.(Citation: Kuberentes ABAC)","rdfs:label":"Additional Container Cluster Roles"},{"@id":"d3f:T1098.007","d3f:attack-id":"T1098.007","d3f:definition":"An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain.","rdfs:label":"Additional Local or Domain Groups"},{"@id":"d3f:T1099","d3f:attack-id":"T1099","d3f:definition":"Adversaries may take actions to hide the deployment of new, or modification of existing files to obfuscate their activities. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools. Timestomping may be used along with file name [Masquerading](https://attack.mitre.org/techniques/T1036) to hide malware and tools. (Citation: WindowsIR Anti-Forensic Techniques)","rdfs:label":"Timestomp","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1100","d3f:attack-id":"T1100","d3f:definition":"A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (see, for example, China Chopper Web shell client). (Citation: Lee 2013)","rdfs:label":"Web Shell","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1101","d3f:attack-id":"T1101","d3f:definition":"Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages and HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.","rdfs:label":"Security Support Provider","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1102","d3f:attack-id":"T1102","d3f:definition":"Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.","rdfs:label":"Web Service"},{"@id":"d3f:T1102.001","d3f:attack-id":"T1102.001","d3f:definition":"Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.","rdfs:label":"Dead Drop Resolver"},{"@id":"d3f:T1102.002","d3f:attack-id":"T1102.002","d3f:definition":"Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.","rdfs:label":"Bidirectional Communication"},{"@id":"d3f:T1102.003","d3f:attack-id":"T1102.003","d3f:definition":"Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.","rdfs:label":"One-Way Communication"},{"@id":"d3f:T1103","d3f:attack-id":"T1103","d3f:definition":"Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows or HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Elastic Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry)","rdfs:label":"AppInit DLLs","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1104","d3f:attack-id":"T1104","d3f:definition":"Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.","rdfs:label":"Multi-Stage Channels"},{"@id":"d3f:T1105","d3f:attack-id":"T1105","d3f:definition":"Session is initiated by the client, and may be a custom protocol which is why it is related to generic network traffic instead of file transfer network traffic.","rdfs:label":"Ingress Tool Transfer"},{"@id":"d3f:T1106","d3f:attack-id":"T1106","d3f:definition":"Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.","rdfs:label":"Native API"},{"@id":"d3f:T1107","d3f:attack-id":"T1107","d3f:definition":"Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.","rdfs:label":"File Deletion","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1108","d3f:attack-id":"T1108","d3f:definition":"**This technique has been deprecated. Please use [Create Account](https://attack.mitre.org/techniques/T1136), [Web Shell](https://attack.mitre.org/techniques/T1505/003), and [External Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.**","rdfs:label":"Redundant Access","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1109","d3f:attack-id":"T1109","d3f:definition":"Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1019) but conducted upon other system components that may not have the same capability or level of integrity checking. Malicious device firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.","rdfs:label":"Component Firmware","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1110","d3f:attack-id":"T1110","d3f:definition":"Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.","rdfs:label":"Brute Force"},{"@id":"d3f:T1110.001","d3f:attack-id":"T1110.001","d3f:definition":"Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.","rdfs:label":"Password Guessing"},{"@id":"d3f:T1110.002","d3f:attack-id":"T1110.002","d3f:definition":"Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) can be used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) is not an option. Further, adversaries may leverage [Data from Configuration Repository](https://attack.mitre.org/techniques/T1602) in order to obtain hashed credentials for network devices.(Citation: US-CERT-TA18-106A)","rdfs:label":"Password Cracking"},{"@id":"d3f:T1110.003","d3f:attack-id":"T1110.003","d3f:definition":"Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. (Citation: BlackHillsInfosec Password Spraying)","rdfs:label":"Password Spraying"},{"@id":"d3f:T1110.004","d3f:attack-id":"T1110.004","d3f:definition":"Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts.","rdfs:label":"Credential Stuffing"},{"@id":"d3f:T1111","d3f:attack-id":"T1111","d3f:definition":"Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.","rdfs:label":"Multi-Factor Authentication Interception"},{"@id":"d3f:T1112","d3f:attack-id":"T1112","d3f:definition":"Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.","rdfs:label":"Modify Registry"},{"@id":"d3f:T1113","d3f:attack-id":"T1113","d3f:definition":"Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)","rdfs:label":"Screen Capture"},{"@id":"d3f:T1114","d3f:attack-id":"T1114","d3f:definition":"Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.","rdfs:label":"Email Collection"},{"@id":"d3f:T1114.001","d3f:attack-id":"T1114.001","d3f:definition":"Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.","rdfs:label":"Local Email Collection"},{"@id":"d3f:T1114.002","d3f:attack-id":"T1114.002","d3f:definition":"Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.","rdfs:label":"Remote Email Collection"},{"@id":"d3f:T1114.003","d3f:attack-id":"T1114.003","d3f:definition":"Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules)","rdfs:label":"Email Forwarding Rule"},{"@id":"d3f:T1115","d3f:attack-id":"T1115","d3f:definition":"Adversaries may collect data stored in the clipboard from users copying information within or between applications.","rdfs:label":"Clipboard Data"},{"@id":"d3f:T1116","d3f:attack-id":"T1116","d3f:definition":"Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) However, adversaries are known to use code signing certificates to masquerade malware and tools as legitimate binaries (Citation: Janicab). The certificates used during an operation may be created, forged, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates)","rdfs:label":"Code Signing","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1117","d3f:attack-id":"T1117","d3f:definition":"Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe can be used to execute arbitrary binaries. (Citation: Microsoft Regsvr32)","rdfs:label":"Regsvr32","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1118","d3f:attack-id":"T1118","d3f:definition":"InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is located in the .NET directories on a Windows system: C:\\Windows\\Microsoft.NET\\Framework\\v\\InstallUtil.exe and C:\\Windows\\Microsoft.NET\\Framework64\\v\\InstallUtil.exe. InstallUtil.exe is digitally signed by Microsoft.","rdfs:label":"InstallUtil","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1119","d3f:attack-id":"T1119","d3f:definition":"Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.","rdfs:label":"Automated Collection"},{"@id":"d3f:T1120","d3f:attack-id":"T1120","d3f:definition":"Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.","rdfs:label":"Peripheral Device Discovery"},{"@id":"d3f:T1121","d3f:attack-id":"T1121","d3f:definition":"Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)","rdfs:label":"Regsvcs/Regasm","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1122","d3f:attack-id":"T1122","d3f:definition":"The Component Object Model (COM) is a system within Windows to enable interaction between software components through the operating system. (Citation: Microsoft Component Object Model) Adversaries can use this system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Windows Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead. (Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection.","rdfs:label":"Component Object Model Hijacking","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1123","d3f:attack-id":"T1123","d3f:definition":"An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.(Citation: ESET Attor Oct 2019)","rdfs:label":"Audio Capture"},{"@id":"d3f:T1124","d3f:attack-id":"T1124","d3f:definition":"An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.(Citation: MSDN System Time)(Citation: Technet Windows Time Service)(Citation: systemsetup mac time) These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.(Citation: Mac Time Sync)(Citation: linux system time)","rdfs:label":"System Time Discovery"},{"@id":"d3f:T1125","d3f:attack-id":"T1125","d3f:definition":"An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.","rdfs:label":"Video Capture"},{"@id":"d3f:T1126","d3f:attack-id":"T1126","d3f:definition":"Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\\\system\\share /delete command. (Citation: Technet Net Use)","rdfs:label":"Network Share Connection Removal","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1127","d3f:attack-id":"T1127","d3f:definition":"Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.","rdfs:label":"Trusted Developer Utilities Proxy Execution"},{"@id":"d3f:T1127.001","d3f:attack-id":"T1127.001","d3f:definition":"Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild)","rdfs:label":"MSBuild"},{"@id":"d3f:T1127.002","d3f:attack-id":"T1127.002","d3f:definition":"Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat) ClickOnce is a deployment that enables a user to create self-updating Windows-based .NET applications (i.e, .XBAP, .EXE, or .DLL) that install and run from a file share or web page with minimal user interaction. The application launches as a child process of DFSVC.EXE, which is responsible for installing, launching, and updating the application.(Citation: SpectorOps Medium ClickOnce)","rdfs:label":"ClickOnce"},{"@id":"d3f:T1128","d3f:attack-id":"T1128","d3f:definition":"Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. (Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\\SOFTWARE\\Microsoft\\Netsh.","rdfs:label":"Netsh Helper DLL","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1129","d3f:attack-id":"T1129","d3f:definition":"Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., [Native API](https://attack.mitre.org/techniques/T1106)).","rdfs:label":"Shared Modules"},{"@id":"d3f:T1130","d3f:attack-id":"T1130","d3f:definition":"Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. (Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.","rdfs:label":"Install Root Certificate","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1131","d3f:attack-id":"T1131","d3f:definition":"Windows Authentication Package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system. (Citation: MSDN Authentication Packages)","rdfs:label":"Authentication Package","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1132","d3f:attack-id":"T1132","d3f:definition":"Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.","rdfs:label":"Data Encoding"},{"@id":"d3f:T1132.001","d3f:attack-id":"T1132.001","d3f:definition":"Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.","rdfs:label":"Standard Encoding"},{"@id":"d3f:T1132.002","d3f:attack-id":"T1132.002","d3f:definition":"Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding)","rdfs:label":"Non-Standard Encoding"},{"@id":"d3f:T1133","d3f:attack-id":"T1133","d3f:definition":"Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) and [VNC](https://attack.mitre.org/techniques/T1021/005) can also be used externally.(Citation: MacOS VNC software for Remote Desktop)","rdfs:label":"External Remote Services"},{"@id":"d3f:T1134","d3f:attack-id":"T1134","d3f:definition":"Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.","rdfs:label":"Access Token Manipulation"},{"@id":"d3f:T1134.001","d3f:attack-id":"T1134.001","d3f:definition":"Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.","rdfs:label":"Token Impersonation/Theft"},{"@id":"d3f:T1134.002","d3f:attack-id":"T1134.002","d3f:definition":"Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.(Citation: Microsoft RunAs)","rdfs:label":"Create Process with Token"},{"@id":"d3f:T1134.003","d3f:attack-id":"T1134.003","d3f:definition":"Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.","rdfs:label":"Make and Impersonate Token"},{"@id":"d3f:T1134.004","d3f:attack-id":"T1134.004","d3f:definition":"Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context.(Citation: Microsoft UAC Nov 2018)","rdfs:label":"Parent PID Spoofing"},{"@id":"d3f:T1134.005","d3f:attack-id":"T1134.005","d3f:definition":"Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).","rdfs:label":"SID-History Injection"},{"@id":"d3f:T1135","d3f:attack-id":"T1135","d3f:definition":"Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.","rdfs:label":"Network Share Discovery"},{"@id":"d3f:T1136","d3f:attack-id":"T1136","d3f:definition":"Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.","rdfs:label":"Create Account"},{"@id":"d3f:T1136.001","d3f:attack-id":"T1136.001","d3f:definition":"Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.","rdfs:label":"Local Account"},{"@id":"d3f:T1136.002","d3f:attack-id":"T1136.002","d3f:definition":"Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.(Citation: Savill 1999)","rdfs:label":"Domain Account"},{"@id":"d3f:T1136.003","d3f:attack-id":"T1136.003","d3f:definition":"Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users)","rdfs:label":"Cloud Account"},{"@id":"d3f:T1137","d3f:attack-id":"T1137","d3f:definition":"Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.","rdfs:label":"Office Application Startup"},{"@id":"d3f:T1137.001","d3f:attack-id":"T1137.001","d3f:definition":"Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template)","rdfs:label":"Office Template Macros"},{"@id":"d3f:T1137.002","d3f:attack-id":"T1137.002","d3f:definition":"Adversaries may abuse the Microsoft Office \"Office Test\" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy)","rdfs:label":"Office Test"},{"@id":"d3f:T1137.003","d3f:attack-id":"T1137.003","d3f:definition":"Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms)","rdfs:label":"Outlook Forms"},{"@id":"d3f:T1137.004","d3f:attack-id":"T1137.004","d3f:definition":"Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page)","rdfs:label":"Outlook Home Page"},{"@id":"d3f:T1137.005","d3f:attack-id":"T1137.005","d3f:definition":"Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules)","rdfs:label":"Outlook Rules"},{"@id":"d3f:T1137.006","d3f:attack-id":"T1137.006","d3f:definition":"Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018)","rdfs:label":"Add-ins"},{"@id":"d3f:T1138","d3f:attack-id":"T1138","d3f:definition":"The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Elastic Process Injection July 2017) Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses [Hooking](https://attack.mitre.org/techniques/T1179) to redirect the code as necessary in order to communicate with the OS.","rdfs:label":"Application Shimming","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1139","d3f:attack-id":"T1139","d3f:definition":"Bash keeps track of the commands users type on the command-line with the \"history\" utility. Once a user logs out, the history is flushed to the user’s .bash_history file. For each user, this file resides at the same location: ~/.bash_history. Typically, this file keeps track of the user’s last 500 commands. Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Attackers can abuse this by looking through the file for potential credentials. (Citation: External to DA, the OS X Way)","rdfs:label":"Bash History","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1140","d3f:attack-id":"T1140","d3f:definition":"Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.","rdfs:label":"Deobfuscate/Decode Files or Information"},{"@id":"d3f:T1141","d3f:attack-id":"T1141","d3f:definition":"When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1088)).","rdfs:label":"Input Prompt","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1142","d3f:attack-id":"T1142","d3f:definition":"Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes, certificates, and Kerberos. Keychain files are located in ~/Library/Keychains/,/Library/Keychains/, and /Network/Library/Keychains/. (Citation: Wikipedia keychain) The security command-line utility, which is built into macOS by default, provides a useful way to manage these credentials.","rdfs:label":"Keychain","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1143","d3f:attack-id":"T1143","d3f:definition":"Adversaries may implement hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. Adversaries may abuse operating system functionality to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.","rdfs:label":"Hidden Window","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1144","d3f:attack-id":"T1144","d3f:definition":"In macOS and OS X, when applications or programs are downloaded from the internet, there is a special attribute set on the file called com.apple.quarantine. This attribute is read by Apple's Gatekeeper defense program at execution time and provides a prompt to the user to allow or deny execution.","rdfs:label":"Gatekeeper Bypass","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1145","d3f:attack-id":"T1145","d3f:definition":"Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. (Citation: Wikipedia Public Key Crypto)","rdfs:label":"Private Keys","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1146","d3f:attack-id":"T1146","d3f:definition":"In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. macOS and Linux both keep track of the commands users type in their terminal so that users can retrace what they've done. These logs can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions. Since everything typed on the command-line is saved, passwords passed in on the command line are also saved. Adversaries can abuse this by searching these files for cleartext passwords. Additionally, adversaries can use a variety of methods to prevent their own commands from appear in these logs such as unset HISTFILE, export HISTFILESIZE=0, history -c, rm ~/.bash_history.","rdfs:label":"Clear Command History","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1147","d3f:attack-id":"T1147","d3f:definition":"Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account. There is a property value in /Library/Preferences/com.apple.loginwindow called Hide500Users that prevents users with userIDs 500 and lower from appearing at the login screen. By using the [Create Account](https://attack.mitre.org/techniques/T1136) technique with a userID under 500 and enabling this property (setting it to Yes), an adversary can hide their user accounts much more easily: sudo dscl . -create /Users/username UniqueID 401 (Citation: Cybereason OSX Pirrit).","rdfs:label":"Hidden Users","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1148","d3f:attack-id":"T1148","d3f:definition":"The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. This setting can be configured to ignore commands that start with a space by simply setting it to \"ignorespace\". HISTCONTROL can also be set to ignore duplicate commands by setting it to \"ignoredups\". In some Linux systems, this is set by default to \"ignoreboth\" which covers both of the previous examples. This means that “ ls” will not be saved, but “ls” would be saved by history. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected. Adversaries can use this to operate without leaving traces by simply prepending a space to all of their terminal commands.","rdfs:label":"HISTCONTROL","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1149","d3f:attack-id":"T1149","d3f:definition":"**This technique has been deprecated and should no longer be used.**","rdfs:label":"LC_MAIN Hijacking","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1150","d3f:attack-id":"T1150","d3f:definition":"Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and services. These files are UTF-8 encoded and formatted like XML documents via a series of keys surrounded by < >. They detail when programs should execute, file paths to the executables, program arguments, required OS permissions, and many others. plists are located in certain locations depending on their purpose such as /Library/Preferences (which execute with elevated privileges) and ~/Library/Preferences (which execute with a user's privileges).","rdfs:label":"Plist Modification","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1151","d3f:attack-id":"T1151","d3f:definition":"Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to \"evil.txt \" (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back).","rdfs:label":"Space after Filename","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1152","d3f:attack-id":"T1152","d3f:definition":"Launchctl controls the macOS launchd process which handles things like launch agents and launch daemons, but can execute other commands or programs itself. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input. By loading or reloading launch agents or launch daemons, adversaries can install persistence or execute changes they made (Citation: Sofacy Komplex Trojan). Running a command from launchctl is as simple as launchctl submit -l -- /Path/to/thing/to/execute \"arg\" \"arg\" \"arg\". Loading, unloading, or reloading launch agents or launch daemons can require elevated privileges.","rdfs:label":"Launchctl","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1153","d3f:attack-id":"T1153","d3f:definition":"**This technique has been deprecated and should no longer be used.**","rdfs:label":"Source","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1154","d3f:attack-id":"T1154","d3f:definition":"The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d. Adversaries can use this to register code to be executed when the shell encounters specific interrupts either to gain execution or as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where \"command list\" will be executed when \"signals\" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)","rdfs:label":"Trap","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1155","d3f:attack-id":"T1155","d3f:definition":"macOS and OS X applications send AppleEvent messages to each other for interprocess communications (IPC). These messages can be easily scripted with AppleScript for local or remote IPC. Osascript executes AppleScript and any other Open Scripting Architecture (OSA) language scripts. A list of OSA languages installed on a system can be found by using the osalang program.","rdfs:label":"AppleScript","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1156","d3f:attack-id":"T1156","d3f:definition":"Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command line interface or remotely logs in (such as SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.","rdfs:label":"Malicious Shell Modification","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1157","d3f:attack-id":"T1157","d3f:definition":"macOS and OS X use a common method to look for required dynamic libraries (dylib) to load into a program based on search paths. Adversaries can take advantage of ambiguous paths to plant dylibs to gain privilege escalation or persistence.","rdfs:label":"Dylib Hijacking","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1158","d3f:attack-id":"T1158","d3f:definition":"To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).","rdfs:label":"Hidden Files and Directories","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1159","d3f:attack-id":"T1159","d3f:definition":"Per Apple’s developer documentation, when a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (plist) files found in /System/Library/LaunchAgents, /Library/LaunchAgents, and $HOME/Library/LaunchAgents (Citation: AppleDocs Launch Agent Daemons) (Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware). These launch agents have property list files which point to the executables that will be launched (Citation: OSX.Dok Malware).","rdfs:label":"Launch Agent","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1160","d3f:attack-id":"T1160","d3f:definition":"Per Apple’s developer documentation, when macOS and OS X boot up, launchd is run to finish system initialization. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).","rdfs:label":"Launch Daemon","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1161","d3f:attack-id":"T1161","d3f:definition":"Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long adjustments are made to the rest of the fields and dependencies (Citation: Writing Bad Malware for OSX). There are tools available to perform these changes. Any changes will invalidate digital signatures on binaries because the binary is being modified. Adversaries can remediate this issue by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time (Citation: Malware Persistence on OS X).","rdfs:label":"LC_LOAD_DYLIB Addition","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1162","d3f:attack-id":"T1162","d3f:definition":"MacOS provides the option to list specific applications to run when a user logs in. These applications run under the logged in user's context, and will be started every time the user logs in. Login items installed using the Service Management Framework are not visible in the System Preferences and can only be removed by the application that created them (Citation: Adding Login Items). Users have direct control over login items installed using a shared file list which are also visible in System Preferences (Citation: Adding Login Items). These login items are stored in the user's ~/Library/Preferences/ directory in a plist file called com.apple.loginitems.plist (Citation: Methods of Mac Malware Persistence). Some of these applications can open visible dialogs to the user, but they don’t all have to since there is an option to ‘Hide’ the window. If an adversary can register their own login item or modified an existing one, then they can use it to execute their code for a persistence mechanism each time the user logs in (Citation: Malware Persistence on OS X) (Citation: OSX.Dok Malware). The API method SMLoginItemSetEnabled can be used to set Login Items, but scripting languages like [AppleScript](https://attack.mitre.org/techniques/T1155) can do this as well (Citation: Adding Login Items).","rdfs:label":"Login Item","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1163","d3f:attack-id":"T1163","d3f:definition":"During the boot process, macOS executes source /etc/rc.common, which is a shell script containing various utility functions. This file also defines routines for processing command-line arguments and for gathering system settings, and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items). In macOS and OS X, this is now a deprecated technique in favor of launch agents and launch daemons, but is currently still used.","rdfs:label":"Rc.common","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1164","d3f:attack-id":"T1164","d3f:definition":"Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user reboots their machine. While this is usually done via a Graphical User Interface (GUI) on an app-by-app basis, there are property list files (plist) that contain this information as well located at ~/Library/Preferences/com.apple.loginwindow.plist and ~/Library/Preferences/ByHost/com.apple.loginwindow.* .plist.","rdfs:label":"Re-opened Applications","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1165","d3f:attack-id":"T1165","d3f:definition":"Per Apple’s documentation, startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items (Citation: Startup Items). This is technically a deprecated version (superseded by Launch Daemons), and thus the appropriate folder, /Library/StartupItems isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory.","rdfs:label":"Startup Items","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1166","d3f:attack-id":"T1166","d3f:definition":"When the setuid or setgid bits are set on Linux or macOS for an application, this means that the application will run with the privileges of the owning user or group respectively (Citation: setuid man page). Normally an application is run in the current user’s context, regardless of which user or group owns the application. There are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges. Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications. These bits are indicated with an \"s\" instead of an \"x\" when viewing a file's attributes via ls -l. The chmod program can set these bits with via bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file].","rdfs:label":"Setuid and Setgid","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1167","d3f:attack-id":"T1167","d3f:definition":"In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords. (Citation: OS X Keychain) (Citation: External to DA, the OS X Way) Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an attacker need only iterate over the other values to unlock the final password. (Citation: OS X Keychain)","rdfs:label":"Securityd Memory","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1168","d3f:attack-id":"T1168","d3f:definition":"On Linux and macOS systems, multiple methods are supported for creating pre-scheduled and periodic background jobs: cron, (Citation: Die.net Linux crontab Man Page) at, (Citation: Die.net Linux at Man Page) and launchd. (Citation: AppleDocs Scheduling Timed Jobs) Unlike [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053) on Windows systems, job scheduling on Linux-based systems cannot be done remotely unless used in conjunction within an established remote session, like secure shell (SSH).","rdfs:label":"Local Job Scheduling","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1169","d3f:attack-id":"T1169","d3f:definition":"The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the idea of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL (Citation: OSX.Dok Malware).","rdfs:label":"Sudo","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1170","d3f:attack-id":"T1170","d3f:definition":"Mshta.exe is a utility that executes Microsoft HTML Applications (HTA). HTA files have the file extension .hta. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications)","rdfs:label":"Mshta","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1171","d3f:attack-id":"T1171","d3f:definition":"Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. (Citation: Wikipedia LLMNR) (Citation: TechNet NetBIOS)","rdfs:label":"LLMNR/NBT-NS Poisoning and Relay","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1172","d3f:attack-id":"T1172","d3f:definition":"Domain fronting takes advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) The technique involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, \"domainless\" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).","rdfs:label":"Domain Fronting","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1173","d3f:attack-id":"T1173","d3f:definition":"Windows Dynamic Data Exchange (DDE) is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.","rdfs:label":"Dynamic Data Exchange","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1174","d3f:attack-id":"T1174","d3f:definition":"Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as dynamic link libraries (DLLs) containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts.","rdfs:label":"Password Filter DLL","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1175","d3f:attack-id":"T1175","d3f:definition":"**This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**","rdfs:label":"Component Object Model and Distributed COM","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1176","d3f:attack-id":"T1176","d3f:definition":"Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition)","rdfs:label":"Browser Extensions"},{"@id":"d3f:T1177","d3f:attack-id":"T1177","d3f:definition":"The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process. (Citation: Microsoft Security Subsystem)","rdfs:label":"LSASS Driver","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1178","d3f:attack-id":"T1178","d3f:definition":"The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).","rdfs:label":"SID-History Injection","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1179","d3f:attack-id":"T1179","d3f:definition":"Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Windows API functions are typically stored in dynamic-link libraries (DLLs) as exported functions.","rdfs:label":"Hooking","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1180","d3f:attack-id":"T1180","d3f:definition":"Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in C:\\Windows\\System32\\, and C:\\Windows\\sysWOW64\\ on 64-bit Windows systems, along with screensavers included with base Windows installations.","rdfs:label":"Screensaver","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1181","d3f:attack-id":"T1181","d3f:definition":"Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data). (Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of extra window memory (EWM) to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value. (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function)","rdfs:label":"Extra Window Memory Injection","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1182","d3f:attack-id":"T1182","d3f:definition":"Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. (Citation: Elastic Process Injection July 2017)","rdfs:label":"AppCert DLLs","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1183","d3f:attack-id":"T1183","d3f:definition":"Image File Execution Options (IFEO) enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., “C:\\dbg\\ntsd.exe -g notepad.exe”). (Citation: Microsoft Dev Blog IFEO Mar 2010)","rdfs:label":"Image File Execution Options Injection","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1184","d3f:attack-id":"T1184","d3f:definition":"Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.","rdfs:label":"SSH Hijacking","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1185","d3f:attack-id":"T1185","d3f:definition":"Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.(Citation: Wikipedia Man in the Browser)","rdfs:label":"Browser Session Hijacking"},{"@id":"d3f:T1186","d3f:attack-id":"T1186","d3f:definition":"Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. (Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction. (Citation: Microsoft Where to use TxF)","rdfs:label":"Process Doppelgänging","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1187","d3f:attack-id":"T1187","d3f:definition":"Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.","rdfs:label":"Forced Authentication"},{"@id":"d3f:T1188","d3f:attack-id":"T1188","d3f:definition":"To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.","rdfs:label":"Multi-hop Proxy","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1189","d3f:attack-id":"T1189","d3f:definition":"Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring [Application Access Token](https://attack.mitre.org/techniques/T1550/001).","rdfs:label":"Drive-by Compromise"},{"@id":"d3f:T1190","d3f:attack-id":"T1190","d3f:definition":"Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.","rdfs:label":"Exploit Public-Facing Application"},{"@id":"d3f:T1191","d3f:attack-id":"T1191","d3f:definition":"The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.","rdfs:label":"CMSTP","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1192","d3f:attack-id":"T1192","d3f:definition":"Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.","rdfs:label":"Spearphishing Link","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1193","d3f:attack-id":"T1193","d3f:definition":"Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.","rdfs:label":"Spearphishing Attachment","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1194","d3f:attack-id":"T1194","d3f:definition":"Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.","rdfs:label":"Spearphishing via Service","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1195","d3f:attack-id":"T1195","d3f:definition":"Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.","rdfs:label":"Supply Chain Compromise"},{"@id":"d3f:T1195.001","d3f:attack-id":"T1195.001","d3f:definition":"Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)","rdfs:label":"Compromise Software Dependencies and Development Tools"},{"@id":"d3f:T1195.002","d3f:attack-id":"T1195.002","d3f:definition":"Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.","rdfs:label":"Compromise Software Supply Chain"},{"@id":"d3f:T1195.003","d3f:attack-id":"T1195.003","d3f:definition":"Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.","rdfs:label":"Compromise Hardware Supply Chain"},{"@id":"d3f:T1196","d3f:attack-id":"T1196","d3f:definition":"Windows Control Panel items are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013)","rdfs:label":"Control Panel Items","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1197","d3f:attack-id":"T1197","d3f:definition":"Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM).(Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.","rdfs:label":"BITS Jobs"},{"@id":"d3f:T1198","d3f:attack-id":"T1198","d3f:definition":"In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)","rdfs:label":"SIP and Trust Provider Hijacking","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1199","d3f:attack-id":"T1199","d3f:definition":"Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.","rdfs:label":"Trusted Relationship"},{"@id":"d3f:T1200","d3f:attack-id":"T1200","d3f:definition":"Adversaries may introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091)), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.","rdfs:label":"Hardware Additions"},{"@id":"d3f:T1201","d3f:attack-id":"T1201","d3f:definition":"Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).","rdfs:label":"Password Policy Discovery"},{"@id":"d3f:T1202","d3f:attack-id":"T1202","d3f:definition":"Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts. (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017)","rdfs:label":"Indirect Command Execution"},{"@id":"d3f:T1203","d3f:attack-id":"T1203","d3f:definition":"Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.","rdfs:label":"Exploitation for Client Execution"},{"@id":"d3f:T1204","d3f:attack-id":"T1204","d3f:definition":"An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566).","rdfs:label":"User Execution"},{"@id":"d3f:T1204.001","d3f:attack-id":"T1204.001","d3f:definition":"An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).","rdfs:label":"Malicious Link"},{"@id":"d3f:T1204.002","d3f:attack-id":"T1204.002","d3f:definition":"An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.","rdfs:label":"Malicious File"},{"@id":"d3f:T1204.003","d3f:attack-id":"T1204.003","d3f:definition":"Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs)","rdfs:label":"Malicious Image"},{"@id":"d3f:T1205","d3f:attack-id":"T1205","d3f:definition":"Adversaries use traffic signaling techniques, such as sending specific network sequences or magic packets, to covertly trigger actions like opening ports, activating backdoors, or installing filters, facilitating command and control, persistence, and defense evasion.","rdfs:label":"Traffic Signaling"},{"@id":"d3f:T1205.001","d3f:attack-id":"T1205.001","d3f:definition":"Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software.","rdfs:label":"Port Knocking"},{"@id":"d3f:T1205.002","d3f:attack-id":"T1205.002","d3f:definition":"Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control. With elevated permissions, adversaries can use features such as the `libpcap` library to open sockets and install filters to allow or disallow certain types of data to come through the socket. The filter may apply to all traffic passing through the specified network interface (or every interface if not specified). When the network interface receives a packet matching the filter criteria, additional actions can be triggered on the host, such as activation of a reverse shell.","rdfs:label":"Socket Filters"},{"@id":"d3f:T1206","d3f:attack-id":"T1206","d3f:definition":"The sudo command \"allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments.\" (Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout that is the amount of time in minutes between instances of sudo before it will re-prompt for a password. This is because sudo has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at /var/db/sudo with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).","rdfs:label":"Sudo Caching","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1207","d3f:attack-id":"T1207","d3f:definition":"Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC. (Citation: DCShadow Blog) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys.","rdfs:label":"Rogue Domain Controller"},{"@id":"d3f:T1208","d3f:attack-id":"T1208","d3f:definition":"Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service (Citation: Microsoft Detecting Kerberoasting Feb 2018)). (Citation: Microsoft SPN) (Citation: Microsoft SetSPN) (Citation: SANS Attacking Kerberos Nov 2014) (Citation: Harmj0y Kerberoast Nov 2016)","rdfs:label":"Kerberoasting","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1209","d3f:attack-id":"T1209","d3f:definition":"The Windows Time service (W32Time) enables time synchronization across and within domains. (Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients. (Citation: Microsoft TimeProvider)","rdfs:label":"Time Providers","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1210","d3f:attack-id":"T1210","d3f:definition":"Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.","rdfs:label":"Exploitation of Remote Services"},{"@id":"d3f:T1211","d3f:attack-id":"T1211","d3f:definition":"Adversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.","rdfs:label":"Exploitation for Defense Evasion"},{"@id":"d3f:T1212","d3f:attack-id":"T1212","d3f:definition":"Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. ","rdfs:label":"Exploitation for Credential Access"},{"@id":"d3f:T1213","d3f:attack-id":"T1213","d3f:definition":"Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization.","rdfs:label":"Data from Information Repositories"},{"@id":"d3f:T1213.001","d3f:attack-id":"T1213.001","d3f:definition":"","rdfs:label":"Confluence"},{"@id":"d3f:T1213.002","d3f:attack-id":"T1213.002","d3f:definition":"Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:","rdfs:label":"Sharepoint"},{"@id":"d3f:T1213.003","d3f:attack-id":"T1213.003","d3f:definition":"Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.","rdfs:label":"Code Repositories"},{"@id":"d3f:T1213.004","d3f:attack-id":"T1213.004","d3f:definition":"Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data.","rdfs:label":"Customer Relationship Management Software"},{"@id":"d3f:T1213.005","d3f:attack-id":"T1213.005","d3f:definition":"Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.","rdfs:label":"Messaging Applications"},{"@id":"d3f:T1214","d3f:attack-id":"T1214","d3f:definition":"The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.","rdfs:label":"Credentials in Registry","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1215","d3f:attack-id":"T1215","d3f:definition":"Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming) When used maliciously, Loadable Kernel Modules (LKMs) can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Adversaries can use loadable kernel modules to covertly persist on a system and evade defenses. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)","rdfs:label":"Kernel Modules and Extensions","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1216","d3f:attack-id":"T1216","d3f:definition":"Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.(Citation: LOLBAS Project) This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.(Citation: GitHub Ultimate AppLocker Bypass List)","rdfs:label":"System Script Proxy Execution"},{"@id":"d3f:T1216.001","d3f:attack-id":"T1216.001","d3f:definition":"Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Basic](https://attack.mitre.org/techniques/T1059/005) script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) via Cscript.exe. For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com.(Citation: pubprn)","rdfs:label":"PubPrn"},{"@id":"d3f:T1216.002","d3f:attack-id":"T1216.002","d3f:definition":"Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V).(Citation: 1 - appv) For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.(Citation: 2 - appv)(Citation: 3 - appv)","rdfs:label":"SyncAppvPublishingServer"},{"@id":"d3f:T1217","d3f:attack-id":"T1217","d3f:definition":"Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.(Citation: Kaspersky Autofill)","rdfs:label":"Browser Information Discovery"},{"@id":"d3f:T1218","d3f:attack-id":"T1218","d3f:definition":"Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.","rdfs:label":"System Binary Proxy Execution"},{"@id":"d3f:T1218.001","d3f:attack-id":"T1218.001","d3f:definition":"Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program)","rdfs:label":"Compiled HTML File"},{"@id":"d3f:T1218.002","d3f:attack-id":"T1218.002","d3f:definition":"Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.","rdfs:label":"Control Panel"},{"@id":"d3f:T1218.003","d3f:attack-id":"T1218.003","d3f:definition":"Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.","rdfs:label":"CMSTP"},{"@id":"d3f:T1218.004","d3f:attack-id":"T1218.004","d3f:definition":"Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\\Windows\\Microsoft.NET\\Framework\\v\\InstallUtil.exe and C:\\Windows\\Microsoft.NET\\Framework64\\v\\InstallUtil.exe.","rdfs:label":"InstallUtil"},{"@id":"d3f:T1218.005","d3f:attack-id":"T1218.005","d3f:definition":"Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017)","rdfs:label":"Mshta"},{"@id":"d3f:T1218.007","d3f:attack-id":"T1218.007","d3f:definition":"Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) The Msiexec.exe binary may also be digitally signed by Microsoft.","rdfs:label":"Msiexec"},{"@id":"d3f:T1218.008","d3f:attack-id":"T1218.008","d3f:definition":"Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft.","rdfs:label":"Odbcconf"},{"@id":"d3f:T1218.009","d3f:attack-id":"T1218.009","d3f:definition":"Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)","rdfs:label":"Regsvcs/Regasm"},{"@id":"d3f:T1218.010","d3f:attack-id":"T1218.010","d3f:definition":"Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft. (Citation: Microsoft Regsvr32)","rdfs:label":"Regsvr32"},{"@id":"d3f:T1218.011","d3f:attack-id":"T1218.011","d3f:definition":"Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).","rdfs:label":"Rundll32"},{"@id":"d3f:T1218.012","d3f:attack-id":"T1218.012","d3f:definition":"Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe)","rdfs:label":"Verclsid"},{"@id":"d3f:T1218.013","d3f:attack-id":"T1218.013","d3f:definition":"Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).(Citation: LOLBAS Mavinject)","rdfs:label":"Mavinject"},{"@id":"d3f:T1218.014","d3f:attack-id":"T1218.014","d3f:definition":"Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt.(Citation: win_mmc)(Citation: what_is_mmc) MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely. MMC can also be used to open Microsoft created .msc files to manage system configuration.(Citation: win_msc_files_overview)","rdfs:label":"MMC"},{"@id":"d3f:T1218.015","d3f:attack-id":"T1218.015","d3f:definition":"Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams.(Citation: Electron 2) Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS.(Citation: Electron 3) The Chromium engine is used to display web content and Node.js runs the backend code.(Citation: Electron 1)","rdfs:label":"Electron Applications"},{"@id":"d3f:T1219","d3f:attack-id":"T1219","d3f:definition":"An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)","rdfs:label":"Remote Access Software"},{"@id":"d3f:T1220","d3f:attack-id":"T1220","d3f:definition":"Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. (Citation: Microsoft XSLT Script Mar 2017)","rdfs:label":"XSL Script Processing"},{"@id":"d3f:T1221","d3f:attack-id":"T1221","d3f:definition":"Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.(Citation: Microsoft Open XML July 2017)","rdfs:label":"Template Injection"},{"@id":"d3f:T1222","d3f:attack-id":"T1222","d3f:definition":"Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).","rdfs:label":"File and Directory Permissions Modification"},{"@id":"d3f:T1222.001","d3f:attack-id":"T1222.001","d3f:definition":"Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).","rdfs:label":"Windows File and Directory Permissions Modification"},{"@id":"d3f:T1222.002","d3f:attack-id":"T1222.002","d3f:definition":"Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).","rdfs:label":"Linux and Mac File and Directory Permissions Modification"},{"@id":"d3f:T1223","d3f:attack-id":"T1223","d3f:definition":"Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program)","rdfs:label":"Compiled HTML File","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1480","d3f:attack-id":"T1480","d3f:definition":"Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: FireEye Kevin Mandia Guardrails) Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.(Citation: FireEye Outlook Dec 2019)","rdfs:label":"Execution Guardrails"},{"@id":"d3f:T1480.001","d3f:attack-id":"T1480.001","d3f:definition":"Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of [Execution Guardrails](https://attack.mitre.org/techniques/T1480) that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.(Citation: EK Clueless Agents)","rdfs:label":"Environmental Keying"},{"@id":"d3f:T1480.002","d3f:attack-id":"T1480.002","d3f:definition":"Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.(Citation: Microsoft Mutexes)","rdfs:label":"Mutual Exclusion"},{"@id":"d3f:T1482","d3f:attack-id":"T1482","d3f:definition":"Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1134/005), [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003), and [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)","rdfs:label":"Domain Trust Discovery"},{"@id":"d3f:T1483","d3f:attack-id":"T1483","d3f:definition":"Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019)","rdfs:label":"Domain Generation Algorithms","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1484","d3f:attack-id":"T1484","d3f:definition":"Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments. Such services provide a centralized means of managing identity resources such as devices and accounts, and often include configuration settings that may apply between domains or tenants such as trust relationships, identity syncing, or identity federation.","rdfs:label":"Domain or Tenant Policy Modification"},{"@id":"d3f:T1484.001","d3f:attack-id":"T1484.001","d3f:definition":"Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path `\\\\SYSVOL\\\\Policies\\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016)","rdfs:label":"Group Policy Modification"},{"@id":"d3f:T1484.002","d3f:attack-id":"T1484.002","d3f:definition":"Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not user identities are federated, allow authentication and authorization properties to apply between domains or tenants for the purpose of accessing shared resources.(Citation: Microsoft - Azure AD Federation) These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.","rdfs:label":"Trust Modification"},{"@id":"d3f:T1485","d3f:attack-id":"T1485","d3f:definition":"Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.","rdfs:label":"Data Destruction"},{"@id":"d3f:T1485.001","d3f:attack-id":"T1485.001","d3f:definition":"Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.","rdfs:label":"Lifecycle-Triggered Deletion"},{"@id":"d3f:T1486","d3f:attack-id":"T1486","d3f:definition":"Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018)","rdfs:label":"Data Encrypted for Impact"},{"@id":"d3f:T1487","d3f:attack-id":"T1487","d3f:definition":"Adversaries may corrupt or wipe the disk data structures on hard drive necessary to boot systems; targeting specific critical systems as well as a large number of systems in a network to interrupt availability to system and network resources.","rdfs:label":"Disk Structure Wipe","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1488","d3f:attack-id":"T1488","d3f:definition":"Adversaries may erase the contents of storage devices on specific systems as well as large numbers of systems in a network to interrupt availability to system and network resources.","rdfs:label":"Disk Content Wipe","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1489","d3f:attack-id":"T1489","d3f:definition":"Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)","rdfs:label":"Service Stop"},{"@id":"d3f:T1490","d3f:attack-id":"T1490","d3f:definition":"Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.","rdfs:label":"Inhibit System Recovery"},{"@id":"d3f:T1491","d3f:attack-id":"T1491","d3f:definition":"Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.","rdfs:label":"Defacement"},{"@id":"d3f:T1491.001","d3f:attack-id":"T1491.001","d3f:definition":"An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)","rdfs:label":"Internal Defacement"},{"@id":"d3f:T1491.002","d3f:attack-id":"T1491.002","d3f:definition":"An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. [External Defacement](https://attack.mitre.org/techniques/T1491/002) may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) [External Defacement](https://attack.mitre.org/techniques/T1491/002) may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: Trend Micro Deep Dive Into Defacement)","rdfs:label":"External Defacement"},{"@id":"d3f:T1492","d3f:attack-id":"T1492","d3f:definition":"Adversaries may insert, delete, or manipulate data at rest in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.","rdfs:label":"Stored Data Manipulation","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1493","d3f:attack-id":"T1493","d3f:definition":"Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.","rdfs:label":"Transmitted Data Manipulation","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1494","d3f:attack-id":"T1494","d3f:definition":"Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.","rdfs:label":"Runtime Data Manipulation","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1495","d3f:attack-id":"T1495","d3f:definition":"Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.(Citation: Symantec Chernobyl W95.CIH) Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards.","rdfs:label":"Firmware Corruption"},{"@id":"d3f:T1496","d3f:attack-id":"T1496","d3f:definition":"Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.","rdfs:label":"Resource Hijacking"},{"@id":"d3f:T1496.001","d3f:attack-id":"T1496.001","d3f:definition":"Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.","rdfs:label":"Compute Hijacking"},{"@id":"d3f:T1496.002","d3f:attack-id":"T1496.002","d3f:definition":"Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.","rdfs:label":"Bandwidth Hijacking"},{"@id":"d3f:T1496.003","d3f:attack-id":"T1496.003","d3f:definition":"Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.(Citation: Twilio SMS Pumping) SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.(Citation: Twilio SMS Pumping Fraud)","rdfs:label":"SMS Pumping"},{"@id":"d3f:T1496.004","d3f:attack-id":"T1496.004","d3f:definition":"Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability.","rdfs:label":"Cloud Service Hijacking"},{"@id":"d3f:T1497","d3f:attack-id":"T1497","d3f:definition":"Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)","rdfs:label":"Virtualization/Sandbox Evasion"},{"@id":"d3f:T1497.001","d3f:attack-id":"T1497.001","d3f:definition":"Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)","rdfs:label":"System Checks"},{"@id":"d3f:T1497.002","d3f:attack-id":"T1497.002","d3f:definition":"Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)","rdfs:label":"User Activity Based Checks"},{"@id":"d3f:T1497.003","d3f:attack-id":"T1497.003","d3f:definition":"Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.","rdfs:label":"Time Based Evasion"},{"@id":"d3f:T1498","d3f:attack-id":"T1498","d3f:definition":"Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)","rdfs:label":"Network Denial of Service"},{"@id":"d3f:T1498.001","d3f:attack-id":"T1498.001","d3f:definition":"Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. This DoS attack may also reduce the availability and functionality of the targeted system(s) and network. [Direct Network Flood](https://attack.mitre.org/techniques/T1498/001)s are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. Almost any network protocol may be used for flooding. Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.","rdfs:label":"Direct Network Flood"},{"@id":"d3f:T1498.002","d3f:attack-id":"T1498.002","d3f:definition":"Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target. This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address. This third-party server is commonly termed a reflector. An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim. Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used. Likewise, one or more reflectors may be used to focus traffic on the target.(Citation: Cloudflare ReflectionDoS May 2017) This Network DoS attack may also reduce the availability and functionality of the targeted system(s) and network.","rdfs:label":"Reflection Amplification"},{"@id":"d3f:T1499","d3f:attack-id":"T1499","d3f:definition":"Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)","rdfs:label":"Endpoint Denial of Service"},{"@id":"d3f:T1499.001","d3f:attack-id":"T1499.001","d3f:definition":"Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS). A system's OS is responsible for managing the finite resources as well as preventing the entire system from being overwhelmed by excessive demands on its capacity. These attacks do not need to exhaust the actual resources on a system; the attacks may simply exhaust the limits and available resources that an OS self-imposes.","rdfs:label":"OS Exhaustion Flood"},{"@id":"d3f:T1499.002","d3f:attack-id":"T1499.002","d3f:definition":"Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). Adversaries often target the availability of DNS and web services, however others have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service.","rdfs:label":"Service Exhaustion Flood"},{"@id":"d3f:T1499.003","d3f:attack-id":"T1499.003","d3f:definition":"Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.(Citation: Arbor AnnualDoSreport Jan 2018)","rdfs:label":"Application Exhaustion Flood"},{"@id":"d3f:T1499.004","d3f:attack-id":"T1499.004","d3f:definition":"Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. (Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.","rdfs:label":"Application or System Exploitation"},{"@id":"d3f:T1500","d3f:attack-id":"T1500","d3f:definition":"Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Similar to [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027), text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)","rdfs:label":"Compile After Delivery","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1501","d3f:attack-id":"T1501","d3f:definition":"Systemd services can be used to establish persistence on a Linux system. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014)(Citation: Freedesktop.org Linux systemd 29SEP2018) Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.","rdfs:label":"Systemd Service","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1502","d3f:attack-id":"T1502","d3f:definition":"Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context.(Citation: Microsoft UAC Nov 2018)","rdfs:label":"Parent PID Spoofing","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1503","d3f:attack-id":"T1503","d3f:definition":"Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (Citation: Talos Olympic Destroyer 2018)","rdfs:label":"Credentials from Web Browsers","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1504","d3f:attack-id":"T1504","d3f:definition":"Adversaries may gain persistence and elevate privileges in certain situations by abusing [PowerShell](https://attack.mitre.org/techniques/T1086) profiles. A PowerShell profile (profile.ps1) is a script that runs when PowerShell starts and can be used as a logon script to customize user environments. PowerShell supports several profiles depending on the user or host program. For example, there can be different profiles for PowerShell host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer. (Citation: Microsoft About Profiles)","rdfs:label":"PowerShell Profile","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1505","d3f:attack-id":"T1505","d3f:definition":"Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)","rdfs:label":"Server Software Component"},{"@id":"d3f:T1505.001","d3f:attack-id":"T1505.001","d3f:definition":"Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted).","rdfs:label":"SQL Stored Procedures"},{"@id":"d3f:T1505.002","d3f:attack-id":"T1505.002","d3f:definition":"Adversaries may abuse Microsoft transport agents to establish persistent access to systems. Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails.(Citation: Microsoft TransportAgent Jun 2016)(Citation: ESET LightNeuron May 2019) Transport agents can be written by application developers and then compiled to .NET assemblies that are subsequently registered with the Exchange server. Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks.","rdfs:label":"Transport Agent"},{"@id":"d3f:T1505.003","d3f:attack-id":"T1505.003","d3f:definition":"Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW)","rdfs:label":"Web Shell"},{"@id":"d3f:T1505.004","d3f:attack-id":"T1505.004","d3f:definition":"Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions: Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}. IIS modules may also be installed to extend IIS web servers.(Citation: Microsoft ISAPI Extension Overview 2017)(Citation: Microsoft ISAPI Filter Overview 2017)(Citation: IIS Backdoor 2011)(Citation: Trustwave IIS Module 2013)","rdfs:label":"IIS Components"},{"@id":"d3f:T1505.005","d3f:attack-id":"T1505.005","d3f:definition":"Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts. Terminal Services allows servers to transmit a full, interactive, graphical user interface to clients via RDP.(Citation: Microsoft Remote Desktop Services)","rdfs:label":"Terminal Services DLL"},{"@id":"d3f:T1506","d3f:attack-id":"T1506","d3f:definition":"Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie)","rdfs:label":"Web Session Cookie","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1514","d3f:attack-id":"T1514","d3f:definition":"Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified. Although this API is deprecated, it still fully functions in the latest releases of macOS. When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made. The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges.","rdfs:label":"Elevated Execution with Prompt","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1518","d3f:attack-id":"T1518","d3f:definition":"Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.","rdfs:label":"Software Discovery"},{"@id":"d3f:T1518.001","d3f:attack-id":"T1518.001","d3f:definition":"Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.","rdfs:label":"Security Software Discovery"},{"@id":"d3f:T1519","d3f:attack-id":"T1519","d3f:definition":"Adversaries may use Event Monitor Daemon (emond) to establish persistence by scheduling malicious commands to run on predictable event triggers. Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1160) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place. The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1160) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)","rdfs:label":"Emond","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1522","d3f:attack-id":"T1522","d3f:definition":"Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.","rdfs:label":"Cloud Instance Metadata API","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1525","d3f:attack-id":"T1525","d3f:definition":"Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored. Unlike [Upload Malware](https://attack.mitre.org/techniques/T1608/001), this technique focuses on adversaries implanting an image in a registry within a victim’s environment. Depending on how the infrastructure is provisioned, this could provide persistent access if the infrastructure provisioning tool is instructed to always use the latest image.(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019)","rdfs:label":"Implant Internal Image"},{"@id":"d3f:T1526","d3f:attack-id":"T1526","d3f:definition":"An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.","rdfs:label":"Cloud Service Discovery"},{"@id":"d3f:T1527","d3f:attack-id":"T1527","d3f:definition":"Adversaries may use application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users and used in lieu of login credentials.","rdfs:label":"Application Access Token","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1528","d3f:attack-id":"T1528","d3f:definition":"Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.","rdfs:label":"Steal Application Access Token"},{"@id":"d3f:T1529","d3f:attack-id":"T1529","d3f:definition":"Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. reload).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A)","rdfs:label":"System Shutdown/Reboot"},{"@id":"d3f:T1530","d3f:attack-id":"T1530","d3f:definition":"Adversaries may access data from cloud storage.","rdfs:label":"Data from Cloud Storage"},{"@id":"d3f:T1531","d3f:attack-id":"T1531","d3f:definition":"Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. Adversaries may also subsequently log off and/or perform a [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019)","rdfs:label":"Account Access Removal"},{"@id":"d3f:T1534","d3f:attack-id":"T1534","d3f:definition":"After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating [Impersonation](https://attack.mitre.org/techniques/T1656).(Citation: Trend Micro - Int SP)","rdfs:label":"Internal Spearphishing"},{"@id":"d3f:T1535","d3f:attack-id":"T1535","d3f:definition":"Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.","rdfs:label":"Unused/Unsupported Cloud Regions"},{"@id":"d3f:T1536","d3f:attack-id":"T1536","d3f:definition":"An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.","rdfs:label":"Revert Cloud Instance","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1537","d3f:attack-id":"T1537","d3f:definition":"Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.","rdfs:label":"Transfer Data to Cloud Account"},{"@id":"d3f:T1538","d3f:attack-id":"T1538","d3f:definition":"An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, findings of potential security risks, and to run additional queries, such as finding public IP addresses and open ports.(Citation: Google Command Center Dashboard)","rdfs:label":"Cloud Service Dashboard"},{"@id":"d3f:T1539","d3f:attack-id":"T1539","d3f:definition":"An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.","rdfs:label":"Steal Web Session Cookie"},{"@id":"d3f:T1542","d3f:attack-id":"T1542","d3f:definition":"Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.(Citation: Wikipedia Booting)","rdfs:label":"Pre-OS Boot"},{"@id":"d3f:T1542.001","d3f:attack-id":"T1542.001","d3f:definition":"Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.(Citation: Wikipedia BIOS)(Citation: Wikipedia UEFI)(Citation: About UEFI)","rdfs:label":"System Firmware"},{"@id":"d3f:T1542.002","d3f:attack-id":"T1542.002","d3f:definition":"Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1542/001) but conducted upon other system components/devices that may not have the same capability or level of integrity checking.","rdfs:label":"Component Firmware"},{"@id":"d3f:T1542.003","d3f:attack-id":"T1542.003","d3f:definition":"Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.","rdfs:label":"Bootkit"},{"@id":"d3f:T1542.004","d3f:attack-id":"T1542.004","d3f:definition":"Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks)","rdfs:label":"ROMMONkit"},{"@id":"d3f:T1542.005","d3f:attack-id":"T1542.005","d3f:definition":"Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images.","rdfs:label":"TFTP Boot"},{"@id":"d3f:T1543","d3f:attack-id":"T1543","d3f:definition":"Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons)","rdfs:label":"Create or Modify System Process"},{"@id":"d3f:T1543.001","d3f:attack-id":"T1543.001","d3f:definition":"Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware) Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.","rdfs:label":"Launch Agent"},{"@id":"d3f:T1543.002","d3f:attack-id":"T1543.002","d3f:definition":"Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014) Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.","rdfs:label":"Systemd Service"},{"@id":"d3f:T1543.003","d3f:attack-id":"T1543.003","d3f:definition":"Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.","rdfs:label":"Windows Service"},{"@id":"d3f:T1543.004","d3f:attack-id":"T1543.004","d3f:definition":"Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS. Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction. During the macOS initialization startup, the launchd process loads the parameters for launch-on-demand system-level daemons from plist files found in /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/. Required Launch Daemons parameters include a Label to identify the task, Program to provide a path to the executable, and RunAtLoad to specify when the task is run. Launch Daemons are often used to provide access to shared resources, updates to software, or conduct automation tasks.(Citation: AppleDocs Launch Agent Daemons)(Citation: Methods of Mac Malware Persistence)(Citation: launchd Keywords for plists)","rdfs:label":"Launch Daemon"},{"@id":"d3f:T1543.005","d3f:attack-id":"T1543.005","d3f:definition":"Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts. These include software for creating and managing individual containers, such as Docker and Podman, as well as container cluster node-level agents such as kubelet. By modifying these services, an adversary may be able to achieve persistence or escalate their privileges on a host.","rdfs:label":"Container Service"},{"@id":"d3f:T1546","d3f:attack-id":"T1546","d3f:definition":"Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: Microsoft DART Case Report 001)","rdfs:label":"Event Triggered Execution"},{"@id":"d3f:T1546.001","d3f:attack-id":"T1546.001","d3f:definition":"Adversaries may establish persistence by executing malicious content triggered by a file type association. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility.(Citation: Microsoft Change Default Programs)(Citation: Microsoft File Handlers)(Citation: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.","rdfs:label":"Change Default File Association"},{"@id":"d3f:T1546.002","d3f:attack-id":"T1546.002","d3f:definition":"Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in C:\\Windows\\System32\\, and C:\\Windows\\sysWOW64\\ on 64-bit Windows systems, along with screensavers included with base Windows installations.","rdfs:label":"Screensaver"},{"@id":"d3f:T1546.003","d3f:attack-id":"T1546.003","d3f:definition":"Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.(Citation: Mandiant M-Trends 2015)","rdfs:label":"Windows Management Instrumentation Event Subscription"},{"@id":"d3f:T1546.004","d3f:attack-id":"T1546.004","d3f:definition":"Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User [Unix Shell](https://attack.mitre.org/techniques/T1059/004)s execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.","rdfs:label":"Unix Shell Configuration Modification"},{"@id":"d3f:T1546.005","d3f:attack-id":"T1546.005","d3f:definition":"Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.","rdfs:label":"Trap"},{"@id":"d3f:T1546.006","d3f:attack-id":"T1546.006","d3f:definition":"Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies.(Citation: Writing Bad Malware for OSX) There are tools available to perform these changes.","rdfs:label":"LC_LOAD_DYLIB Addition"},{"@id":"d3f:T1546.007","d3f:attack-id":"T1546.007","d3f:definition":"Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\\SOFTWARE\\Microsoft\\Netsh.","rdfs:label":"Netsh Helper DLL"},{"@id":"d3f:T1546.008","d3f:attack-id":"T1546.008","d3f:definition":"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.","rdfs:label":"Accessibility Features"},{"@id":"d3f:T1546.009","d3f:attack-id":"T1546.009","d3f:definition":"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. (Citation: Elastic Process Injection July 2017)","rdfs:label":"AppCert DLLs"},{"@id":"d3f:T1546.010","d3f:attack-id":"T1546.010","d3f:definition":"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows or HKEY_LOCAL_MACHINE\\Software\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Elastic Process Injection July 2017)","rdfs:label":"AppInit DLLs"},{"@id":"d3f:T1546.011","d3f:attack-id":"T1546.011","d3f:definition":"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Elastic Process Injection July 2017)","rdfs:label":"Application Shimming"},{"@id":"d3f:T1546.012","d3f:attack-id":"T1546.012","d3f:definition":"Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., C:\\dbg\\ntsd.exe -g notepad.exe). (Citation: Microsoft Dev Blog IFEO Mar 2010)","rdfs:label":"Image File Execution Options Injection"},{"@id":"d3f:T1546.013","d3f:attack-id":"T1546.013","d3f:definition":"Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments.","rdfs:label":"PowerShell Profile"},{"@id":"d3f:T1546.014","d3f:attack-id":"T1546.014","d3f:definition":"Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.","rdfs:label":"Emond"},{"@id":"d3f:T1546.015","d3f:attack-id":"T1546.015","d3f:definition":"Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry.","rdfs:label":"Component Object Model Hijacking"},{"@id":"d3f:T1546.016","d3f:attack-id":"T1546.016","d3f:definition":"Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system. Installer packages can include scripts that run prior to installation as well as after installation is complete. Installer scripts may inherit elevated permissions when executed. Developers often use these scripts to prepare the environment for installation, check requirements, download dependencies, and remove files after installation.(Citation: Installer Package Scripting Rich Trouton)","rdfs:label":"Installer Packages"},{"@id":"d3f:T1546.017","d3f:attack-id":"T1546.017","d3f:definition":"Adversaries may maintain persistence through executing malicious content triggered using udev rules. Udev is the Linux kernel device manager that dynamically manages device nodes, handles access to pseudo-device files in the `/dev` directory, and responds to hardware events, such as when external devices like hard drives or keyboards are plugged in or removed. Udev uses rule files with `match keys` to specify the conditions a hardware event must meet and `action keys` to define the actions that should follow. Root permissions are required to create, modify, or delete rule files located in `/etc/udev/rules.d/`, `/run/udev/rules.d/`, `/usr/lib/udev/rules.d/`, `/usr/local/lib/udev/rules.d/`, and `/lib/udev/rules.d/`. Rule priority is determined by both directory and by the digit prefix in the rule filename.(Citation: Ignacio Udev research 2024)(Citation: Elastic Linux Persistence 2024)","rdfs:label":"Udev Rules"},{"@id":"d3f:T1547","d3f:attack-id":"T1547","d3f:definition":"Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.","rdfs:label":"Boot or Logon Autostart Execution"},{"@id":"d3f:T1547.001","d3f:attack-id":"T1547.001","d3f:definition":"Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the \"run keys\" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.(Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.","rdfs:label":"Registry Run Keys / Startup Folder"},{"@id":"d3f:T1547.002","d3f:attack-id":"T1547.002","d3f:definition":"Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages)","rdfs:label":"Authentication Package"},{"@id":"d3f:T1547.003","d3f:attack-id":"T1547.003","d3f:definition":"Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider)","rdfs:label":"Time Providers"},{"@id":"d3f:T1547.004","d3f:attack-id":"T1547.004","d3f:definition":"Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\\Software[\\\\Wow6432Node\\\\]\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ and HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ are used to manage additional helper programs and functionalities that support Winlogon.(Citation: Cylance Reg Persistence Sept 2013)","rdfs:label":"Winlogon Helper DLL"},{"@id":"d3f:T1547.005","d3f:attack-id":"T1547.005","d3f:definition":"Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.","rdfs:label":"Security Support Provider"},{"@id":"d3f:T1547.006","d3f:attack-id":"T1547.006","d3f:definition":"Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.(Citation: Linux Kernel Programming) ","rdfs:label":"Kernel Modules and Extensions"},{"@id":"d3f:T1547.007","d3f:attack-id":"T1547.007","d3f:definition":"Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to \"Reopen windows when logging back in\".(Citation: Re-Open windows on Mac) When selected, all applications currently open are added to a property list file named com.apple.loginwindow.[UUID].plist within the ~/Library/Preferences/ByHost directory.(Citation: Methods of Mac Malware Persistence)(Citation: Wardle Persistence Chapter) Applications listed in this file are automatically reopened upon the user’s next logon.","rdfs:label":"Re-opened Applications"},{"@id":"d3f:T1547.008","d3f:attack-id":"T1547.008","d3f:definition":"Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem)","rdfs:label":"LSASS Driver"},{"@id":"d3f:T1547.009","d3f:attack-id":"T1547.009","d3f:definition":"Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.","rdfs:label":"Shortcut Modification"},{"@id":"d3f:T1547.010","d3f:attack-id":"T1547.010","d3f:definition":"Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in C:\\Windows\\System32 and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham)","rdfs:label":"Port Monitors"},{"@id":"d3f:T1547.011","d3f:attack-id":"T1547.011","d3f:definition":"Adversaries can modify property list files (plist files) to execute their code as part of establishing persistence. Plist files are used by macOS applications to store properties and configuration settings for applications and services. Applications use information plist files, Info.plist, to tell the operating system how to handle the application at runtime using structured metadata in the form of keys and values. Plist files are formatted in XML and based on Apple's Core Foundation DTD and can be saved in text or binary format.(Citation: fileinfo plist file description)","rdfs:label":"Plist Modification","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1547.012","d3f:attack-id":"T1547.012","d3f:definition":"Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors)","rdfs:label":"Print Processors"},{"@id":"d3f:T1547.013","d3f:attack-id":"T1547.013","d3f:definition":"Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login. XDG Autostart entries are available for any XDG-compliant Linux system. XDG Autostart entries use Desktop Entry files (`.desktop`) to configure the user’s desktop environment upon user login. These configuration files determine what applications launch upon user login, define associated applications to open specific file types, and define applications used to open removable media.(Citation: Free Desktop Application Autostart Feb 2006)(Citation: Free Desktop Entry Keys)","rdfs:label":"XDG Autostart Entries"},{"@id":"d3f:T1547.014","d3f:attack-id":"T1547.014","d3f:definition":"Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level.","rdfs:label":"Active Setup"},{"@id":"d3f:T1547.015","d3f:attack-id":"T1547.015","d3f:definition":"Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.","rdfs:label":"Login Items"},{"@id":"d3f:T1548","d3f:attack-id":"T1548","d3f:definition":"Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)","rdfs:label":"Abuse Elevation Control Mechanism"},{"@id":"d3f:T1548.001","d3f:attack-id":"T1548.001","d3f:definition":"An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.(Citation: setuid man page) Normally an application is run in the current user’s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges.","rdfs:label":"Setuid and Setgid"},{"@id":"d3f:T1548.002","d3f:attack-id":"T1548.002","d3f:definition":"Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works)","rdfs:label":"Bypass User Account Control"},{"@id":"d3f:T1548.003","d3f:attack-id":"T1548.003","d3f:definition":"Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.","rdfs:label":"Sudo and Sudo Caching"},{"@id":"d3f:T1548.004","d3f:attack-id":"T1548.004","d3f:definition":"Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified.","rdfs:label":"Elevated Execution with Prompt"},{"@id":"d3f:T1548.005","d3f:attack-id":"T1548.005","d3f:definition":"Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources. Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto resources and services, or otherwise gain short-term access to a set of privileges that may be distinct from their own.","rdfs:label":"Temporary Elevated Cloud Access"},{"@id":"d3f:T1548.006","d3f:attack-id":"T1548.006","d3f:definition":"Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to execute malicious applications with elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services protected by TCC, such as screen sharing, camera, microphone, or Full Disk Access (FDA).","rdfs:label":"TCC Manipulation"},{"@id":"d3f:T1550","d3f:attack-id":"T1550","d3f:definition":"Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.","rdfs:label":"Use Alternate Authentication Material"},{"@id":"d3f:T1550.001","d3f:attack-id":"T1550.001","d3f:definition":"Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.","rdfs:label":"Application Access Token"},{"@id":"d3f:T1550.002","d3f:attack-id":"T1550.002","d3f:definition":"Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.","rdfs:label":"Pass the Hash"},{"@id":"d3f:T1550.003","d3f:attack-id":"T1550.003","d3f:definition":"Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.","rdfs:label":"Pass the Ticket"},{"@id":"d3f:T1550.004","d3f:attack-id":"T1550.004","d3f:definition":"Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie)","rdfs:label":"Web Session Cookie"},{"@id":"d3f:T1552","d3f:attack-id":"T1552","d3f:definition":"Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)","rdfs:label":"Unsecured Credentials"},{"@id":"d3f:T1552.001","d3f:attack-id":"T1552.001","d3f:definition":"Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.","rdfs:label":"Credentials In Files"},{"@id":"d3f:T1552.002","d3f:attack-id":"T1552.002","d3f:definition":"Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.","rdfs:label":"Credentials in Registry"},{"@id":"d3f:T1552.003","d3f:attack-id":"T1552.003","d3f:definition":"Adversaries may search the bash command history on compromised systems for insecurely stored credentials. Bash keeps track of the commands users type on the command-line with the \"history\" utility. Once a user logs out, the history is flushed to the user’s .bash_history file. For each user, this file resides at the same location: ~/.bash_history. Typically, this file keeps track of the user’s last 500 commands. Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Adversaries can abuse this by looking through the file for potential credentials. (Citation: External to DA, the OS X Way)","rdfs:label":"Bash History"},{"@id":"d3f:T1552.004","d3f:attack-id":"T1552.004","d3f:definition":"Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.","rdfs:label":"Private Keys"},{"@id":"d3f:T1552.005","d3f:attack-id":"T1552.005","d3f:definition":"Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.","rdfs:label":"Cloud Instance Metadata API"},{"@id":"d3f:T1552.006","d3f:attack-id":"T1552.006","d3f:definition":"Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.(Citation: Microsoft GPP 2016)","rdfs:label":"Group Policy Preferences"},{"@id":"d3f:T1552.007","d3f:attack-id":"T1552.007","d3f:definition":"Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation: Docker API)(Citation: Kubernetes API)","rdfs:label":"Container API"},{"@id":"d3f:T1552.008","d3f:attack-id":"T1552.008","d3f:definition":"Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels.","rdfs:label":"Chat Messages"},{"@id":"d3f:T1553","d3f:attack-id":"T1553","d3f:definition":"Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.","rdfs:label":"Subvert Trust Controls"},{"@id":"d3f:T1553.001","d3f:attack-id":"T1553.001","d3f:definition":"Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apple’s security model to ensure only trusted applications are executed on a host. Gatekeeper was built on top of File Quarantine in Snow Leopard (10.6, 2009) and has grown to include Code Signing, security policy compliance, Notarization, and more. Gatekeeper also treats applications running for the first time differently than reopened applications.(Citation: TheEclecticLightCompany Quarantine and the flag)(Citation: TheEclecticLightCompany apple notarization )","rdfs:label":"Gatekeeper Bypass"},{"@id":"d3f:T1553.002","d3f:attack-id":"T1553.002","d3f:definition":"Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature.","rdfs:label":"Code Signing"},{"@id":"d3f:T1553.003","d3f:attack-id":"T1553.003","d3f:definition":"Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)","rdfs:label":"SIP and Trust Provider Hijacking"},{"@id":"d3f:T1553.004","d3f:attack-id":"T1553.004","d3f:definition":"Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.(Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.","rdfs:label":"Install Root Certificate"},{"@id":"d3f:T1553.005","d3f:attack-id":"T1553.005","d3f:definition":"Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020)","rdfs:label":"Mark-of-the-Web Bypass"},{"@id":"d3f:T1553.006","d3f:attack-id":"T1553.006","d3f:definition":"Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system.","rdfs:label":"Code Signing Policy Modification"},{"@id":"d3f:T1554","d3f:attack-id":"T1554","d3f:definition":"Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications.","rdfs:label":"Compromise Host Software Binary"},{"@id":"d3f:T1555","d3f:attack-id":"T1555","d3f:definition":"Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.","rdfs:label":"Credentials from Password Stores"},{"@id":"d3f:T1555.001","d3f:attack-id":"T1555.001","d3f:definition":"Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.","rdfs:label":"Keychain"},{"@id":"d3f:T1555.002","d3f:attack-id":"T1555.002","d3f:definition":"An adversary with root access may gather credentials by reading `securityd`’s memory. `securityd` is a service/daemon responsible for implementing security protocols such as encryption and authorization.(Citation: Apple Dev SecurityD) A privileged adversary may be able to scan through `securityd`'s memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware)","rdfs:label":"Securityd Memory"},{"@id":"d3f:T1555.003","d3f:attack-id":"T1555.003","d3f:definition":"Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.","rdfs:label":"Credentials from Web Browsers"},{"@id":"d3f:T1555.004","d3f:attack-id":"T1555.004","d3f:definition":"Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker)","rdfs:label":"Windows Credential Manager"},{"@id":"d3f:T1555.005","d3f:attack-id":"T1555.005","d3f:definition":"Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019) Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.(Citation: ise Password Manager February 2019)","rdfs:label":"Password Managers"},{"@id":"d3f:T1555.006","d3f:attack-id":"T1555.006","d3f:definition":"Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.","rdfs:label":"Cloud Secrets Management Stores"},{"@id":"d3f:T1556","d3f:attack-id":"T1556","d3f:definition":"Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078).","rdfs:label":"Modify Authentication Process"},{"@id":"d3f:T1556.001","d3f:attack-id":"T1556.001","d3f:definition":"Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.","rdfs:label":"Domain Controller Authentication"},{"@id":"d3f:T1556.002","d3f:attack-id":"T1556.002","d3f:definition":"Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.","rdfs:label":"Password Filter DLL"},{"@id":"d3f:T1556.003","d3f:attack-id":"T1556.003","d3f:definition":"Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow.(Citation: Apple PAM)(Citation: Man Pam_Unix)(Citation: Red Hat PAM)","rdfs:label":"Pluggable Authentication Modules"},{"@id":"d3f:T1556.004","d3f:attack-id":"T1556.004","d3f:definition":"Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.","rdfs:label":"Network Device Authentication"},{"@id":"d3f:T1556.005","d3f:attack-id":"T1556.005","d3f:definition":"An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems. The AllowReversiblePasswordEncryption property specifies whether reversible password encryption for an account is enabled or disabled. By default this property is disabled (instead storing user credentials as the output of one-way hashing functions) and should not be enabled unless legacy or other software require it.(Citation: store_pwd_rev_enc)","rdfs:label":"Reversible Encryption"},{"@id":"d3f:T1556.006","d3f:attack-id":"T1556.006","d3f:definition":"Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.","rdfs:label":"Multi-Factor Authentication"},{"@id":"d3f:T1556.007","d3f:attack-id":"T1556.007","d3f:definition":"Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credentials, and enable persistent access to accounts.","rdfs:label":"Hybrid Identity"},{"@id":"d3f:T1556.008","d3f:attack-id":"T1556.008","d3f:definition":"Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.(Citation: Network Provider API) During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC. The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening.(Citation: NPPSPY - Huntress)(Citation: NPPSPY Video)(Citation: NPLogonNotify)","rdfs:label":"Network Provider DLL"},{"@id":"d3f:T1556.009","d3f:attack-id":"T1556.009","d3f:definition":"Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource.","rdfs:label":"Conditional Access Policies"},{"@id":"d3f:T1557","d3f:attack-id":"T1557","d3f:definition":"Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or replay attacks ([Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212)). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)","rdfs:label":"Adversary-in-the-Middle"},{"@id":"d3f:T1557.001","d3f:attack-id":"T1557.001","d3f:definition":"By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.","rdfs:label":"LLMNR/NBT-NS Poisoning and SMB Relay"},{"@id":"d3f:T1557.002","d3f:attack-id":"T1557.002","d3f:definition":"Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. This activity may be used to enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).","rdfs:label":"ARP Cache Poisoning"},{"@id":"d3f:T1557.003","d3f:attack-id":"T1557.003","d3f:definition":"Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).","rdfs:label":"DHCP Spoofing"},{"@id":"d3f:T1557.004","d3f:attack-id":"T1557.004","d3f:definition":"Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or [Input Capture](https://attack.mitre.org/techniques/T1056).(Citation: Australia ‘Evil Twin’)","rdfs:label":"Evil Twin"},{"@id":"d3f:T1558","d3f:attack-id":"T1558","d3f:definition":"Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.","rdfs:label":"Steal or Forge Kerberos Tickets"},{"@id":"d3f:T1558.001","d3f:attack-id":"T1558.001","d3f:definition":"Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.(Citation: AdSecurity Kerberos GT Aug 2015) Golden tickets enable adversaries to generate authentication material for any account in Active Directory.(Citation: CERT-EU Golden Ticket Protection)","rdfs:label":"Golden Ticket"},{"@id":"d3f:T1558.002","d3f:attack-id":"T1558.002","d3f:definition":"Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets)","rdfs:label":"Silver Ticket"},{"@id":"d3f:T1558.003","d3f:attack-id":"T1558.003","d3f:definition":"Service Provider Name (SPN) scanning is one way to gather hashes, which results in RPC calls conforming to the NSPI protocol.","rdfs:label":"Kerberoasting"},{"@id":"d3f:T1558.004","d3f:attack-id":"T1558.004","d3f:definition":"Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by [Password Cracking](https://attack.mitre.org/techniques/T1110/002) Kerberos messages.(Citation: Harmj0y Roasting AS-REPs Jan 2017)","rdfs:label":"AS-REP Roasting"},{"@id":"d3f:T1558.005","d3f:attack-id":"T1558.005","d3f:definition":"Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials.","rdfs:label":"Ccache Files"},{"@id":"d3f:T1559","d3f:attack-id":"T1559","d3f:definition":"Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.","rdfs:label":"Inter-Process Communication"},{"@id":"d3f:T1559.001","d3f:attack-id":"T1559.001","d3f:definition":"Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019)","rdfs:label":"Component Object Model"},{"@id":"d3f:T1559.002","d3f:attack-id":"T1559.002","d3f:definition":"Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.","rdfs:label":"Dynamic Data Exchange"},{"@id":"d3f:T1559.003","d3f:attack-id":"T1559.003","d3f:definition":"Adversaries can provide malicious content to an XPC service daemon for local code execution. macOS uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools. Applications can send messages to the XPC Service daemon, which runs as root, using the low-level XPC Service C API or the high level NSXPCConnection API in order to handle tasks that require elevated privileges (such as network connections). Applications are responsible for providing the protocol definition which serves as a blueprint of the XPC services. Developers typically use XPC Services to provide applications stability and privilege separation between the application client and the daemon.(Citation: creatingXPCservices)(Citation: Designing Daemons Apple Dev)","rdfs:label":"XPC Services"},{"@id":"d3f:T1560","d3f:attack-id":"T1560","d3f:definition":"An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.","rdfs:label":"Archive Collected Data"},{"@id":"d3f:T1560.001","d3f:attack-id":"T1560.001","d3f:definition":"Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.","rdfs:label":"Archive via Utility"},{"@id":"d3f:T1560.002","d3f:attack-id":"T1560.002","d3f:definition":"An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data.","rdfs:label":"Archive via Library"},{"@id":"d3f:T1560.003","d3f:attack-id":"T1560.003","d3f:definition":"An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)","rdfs:label":"Archive via Custom Method"},{"@id":"d3f:T1561","d3f:attack-id":"T1561","d3f:definition":"Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted.","rdfs:label":"Disk Wipe"},{"@id":"d3f:T1561.001","d3f:attack-id":"T1561.001","d3f:definition":"Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.","rdfs:label":"Disk Content Wipe"},{"@id":"d3f:T1561.002","d3f:attack-id":"T1561.002","d3f:definition":"Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.","rdfs:label":"Disk Structure Wipe"},{"@id":"d3f:T1562","d3f:attack-id":"T1562","d3f:definition":"Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.","rdfs:label":"Impair Defenses"},{"@id":"d3f:T1562.001","d3f:attack-id":"T1562.001","d3f:definition":"Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware)","rdfs:label":"Disable or Modify Tools"},{"@id":"d3f:T1562.002","d3f:attack-id":"T1562.002","d3f:definition":"Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections.","rdfs:label":"Disable Windows Event Logging"},{"@id":"d3f:T1562.003","d3f:attack-id":"T1562.003","d3f:definition":"Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.","rdfs:label":"Impair Command History Logging"},{"@id":"d3f:T1562.004","d3f:attack-id":"T1562.004","d3f:definition":"Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.","rdfs:label":"Disable or Modify System Firewall"},{"@id":"d3f:T1562.006","d3f:attack-id":"T1562.006","d3f:definition":"An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting(Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW)(Citation: Microsoft About Event Tracing 2018), by tampering settings that control the collection and flow of event telemetry.(Citation: Medium Event Tracing Tampering 2018) These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1059/001) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).","rdfs:label":"Indicator Blocking"},{"@id":"d3f:T1562.007","d3f:attack-id":"T1562.007","d3f:definition":"Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004).","rdfs:label":"Disable or Modify Cloud Firewall"},{"@id":"d3f:T1562.008","d3f:attack-id":"T1562.008","d3f:definition":"An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.","rdfs:label":"Disable or Modify Cloud Logs"},{"@id":"d3f:T1562.009","d3f:attack-id":"T1562.009","d3f:definition":"Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Safe Mode)(Citation: Sophos Snatch Ransomware 2019)","rdfs:label":"Safe Mode Boot"},{"@id":"d3f:T1562.010","d3f:attack-id":"T1562.010","d3f:definition":"Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.","rdfs:label":"Downgrade Attack"},{"@id":"d3f:T1562.011","d3f:attack-id":"T1562.011","d3f:definition":"Adversaries may spoof security alerting from tools, presenting false evidence to impair defenders’ awareness of malicious activity.(Citation: BlackBasta) Messages produced by defensive tools contain information about potential security events as well as the functioning status of security software and the system. Security reporting messages are important for monitoring the normal operation of a system and identifying important events that can signal a security incident.","rdfs:label":"Spoof Security Alerting"},{"@id":"d3f:T1562.012","d3f:attack-id":"T1562.012","d3f:definition":"Adversaries may disable or modify the Linux audit system to hide malicious activity and avoid detection. Linux admins use the Linux Audit system to track security-relevant information on a system. The Linux Audit system operates at the kernel-level and maintains event logs on application and system activity such as process, network, file, and login events based on pre-configured rules.","rdfs:label":"Disable or Modify Linux Audit System"},{"@id":"d3f:T1563","d3f:attack-id":"T1563","d3f:definition":"Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service.","rdfs:label":"Remote Service Session Hijacking"},{"@id":"d3f:T1563.001","d3f:attack-id":"T1563.001","d3f:definition":"Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.","rdfs:label":"SSH Hijacking"},{"@id":"d3f:T1563.002","d3f:attack-id":"T1563.002","d3f:definition":"Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services)","rdfs:label":"RDP Hijacking"},{"@id":"d3f:T1564","d3f:attack-id":"T1564","d3f:definition":"Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015)","rdfs:label":"Hide Artifacts"},{"@id":"d3f:T1564.001","d3f:attack-id":"T1564.001","d3f:definition":"Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).","rdfs:label":"Hidden Files and Directories"},{"@id":"d3f:T1564.002","d3f:attack-id":"T1564.002","d3f:definition":"Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.","rdfs:label":"Hidden Users"},{"@id":"d3f:T1564.003","d3f:attack-id":"T1564.003","d3f:definition":"Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.","rdfs:label":"Hidden Window"},{"@id":"d3f:T1564.004","d3f:attack-id":"T1564.004","d3f:definition":"Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)","rdfs:label":"NTFS File Attributes"},{"@id":"d3f:T1564.005","d3f:attack-id":"T1564.005","d3f:definition":"Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage. Typically, a user engages with a file system through applications that allow them to access files and directories, which are an abstraction from their physical location (ex: disk sector). Standard file systems include FAT, NTFS, ext4, and APFS. File systems can also contain other structures, such as the Volume Boot Record (VBR) and Master File Table (MFT) in NTFS.(Citation: MalwareTech VFS Nov 2014)","rdfs:label":"Hidden File System"},{"@id":"d3f:T1564.006","d3f:attack-id":"T1564.006","d3f:definition":"Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance. Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.(Citation: SingHealth Breach Jan 2019)","rdfs:label":"Run Virtual Instance"},{"@id":"d3f:T1564.007","d3f:attack-id":"T1564.007","d3f:definition":"Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.(Citation: FireEye VBA stomp Feb 2020)","rdfs:label":"VBA Stomping"},{"@id":"d3f:T1564.008","d3f:attack-id":"T1564.008","d3f:definition":"Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule)","rdfs:label":"Email Hiding Rules"},{"@id":"d3f:T1564.009","d3f:attack-id":"T1564.009","d3f:definition":"Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.(Citation: macOS Hierarchical File System Overview) Usage of a resource fork is identifiable when displaying a file’s extended attributes, using ls -l@ or xattr -l commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the /Resources folder.(Citation: Resource and Data Forks)(Citation: ELC Extended Attributes)","rdfs:label":"Resource Forking"},{"@id":"d3f:T1564.010","d3f:attack-id":"T1564.010","d3f:definition":"Adversaries may attempt to hide process command-line arguments by overwriting process memory. Process command-line arguments are stored in the process environment block (PEB), a data structure used by Windows to store various information about/used by a process. The PEB includes the process command-line arguments that are referenced when executing the process. When a process is created, defensive tools/sensors that monitor process creations may retrieve the process arguments from the PEB.(Citation: Microsoft PEB 2021)(Citation: Xpn Argue Like Cobalt 2019)","rdfs:label":"Process Argument Spoofing"},{"@id":"d3f:T1564.011","d3f:attack-id":"T1564.011","d3f:definition":"Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. Many operating systems use signals to deliver messages to control process behavior. Command interpreters often include specific commands/flags that ignore errors and other hangups, such as when the user of the active session logs off.(Citation: Linux Signal Man) These interrupt signals may also be used by defensive tools and/or analysts to pause or terminate specified running processes.","rdfs:label":"Ignore Process Interrupts"},{"@id":"d3f:T1564.012","d3f:attack-id":"T1564.012","d3f:definition":"Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities. AV and other file-based scanners often include exclusions to optimize performance as well as ease installation and legitimate use of applications. These exclusions may be contextual (e.g., scans are only initiated in response to specific triggering events/alerts), but are also often hardcoded strings referencing specific folders and/or files assumed to be trusted and legitimate.(Citation: Microsoft File Folder Exclusions)","rdfs:label":"File/Path Exclusions"},{"@id":"d3f:T1565","d3f:attack-id":"T1565","d3f:definition":"Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: Sygnia Elephant Beetle Jan 2022) By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.","rdfs:label":"Data Manipulation"},{"@id":"d3f:T1565.001","d3f:attack-id":"T1565.001","d3f:definition":"Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.","rdfs:label":"Stored Data Manipulation"},{"@id":"d3f:T1565.002","d3f:attack-id":"T1565.002","d3f:definition":"Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.","rdfs:label":"Transmitted Data Manipulation"},{"@id":"d3f:T1565.003","d3f:attack-id":"T1565.003","d3f:definition":"Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.","rdfs:label":"Runtime Data Manipulation"},{"@id":"d3f:T1566","d3f:attack-id":"T1566","d3f:definition":"Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.","rdfs:label":"Phishing"},{"@id":"d3f:T1566.001","d3f:attack-id":"T1566.001","d3f:definition":"Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.(Citation: Unit 42 DarkHydrus July 2018) Spearphishing may also involve social engineering techniques, such as posing as a trusted source.","rdfs:label":"Spearphishing Attachment"},{"@id":"d3f:T1566.002","d3f:attack-id":"T1566.002","d3f:definition":"Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.","rdfs:label":"Spearphishing Link"},{"@id":"d3f:T1566.003","d3f:attack-id":"T1566.003","d3f:definition":"Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.","rdfs:label":"Spearphishing via Service"},{"@id":"d3f:T1566.004","d3f:attack-id":"T1566.004","d3f:definition":"Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that is employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) and/or creating a sense of urgency or alarm for the recipient.","rdfs:label":"Spearphishing Voice"},{"@id":"d3f:T1567","d3f:attack-id":"T1567","d3f:definition":"Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.","rdfs:label":"Exfiltration Over Web Service"},{"@id":"d3f:T1567.001","d3f:attack-id":"T1567.001","d3f:definition":"Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.","rdfs:label":"Exfiltration to Code Repository"},{"@id":"d3f:T1567.002","d3f:attack-id":"T1567.002","d3f:definition":"Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.","rdfs:label":"Exfiltration to Cloud Storage"},{"@id":"d3f:T1567.003","d3f:attack-id":"T1567.003","d3f:definition":"Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information.","rdfs:label":"Exfiltration to Text Storage Sites"},{"@id":"d3f:T1567.004","d3f:attack-id":"T1567.004","d3f:definition":"Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: Discord Intro to Webhooks) When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application.","rdfs:label":"Exfiltration Over Webhook"},{"@id":"d3f:T1568","d3f:attack-id":"T1568","d3f:definition":"Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.","rdfs:label":"Dynamic Resolution"},{"@id":"d3f:T1568.001","d3f:attack-id":"T1568.001","d3f:definition":"Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.(Citation: MehtaFastFluxPt1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welivesecurity)","rdfs:label":"Fast Flux DNS"},{"@id":"d3f:T1568.002","d3f:attack-id":"T1568.002","d3f:definition":"Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019)","rdfs:label":"Domain Generation Algorithms"},{"@id":"d3f:T1568.003","d3f:attack-id":"T1568.003","d3f:definition":"Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda)","rdfs:label":"DNS Calculation"},{"@id":"d3f:T1569","d3f:attack-id":"T1569","d3f:definition":"This technique has been deprecated.","rdfs:label":"System Services"},{"@id":"d3f:T1569.001","d3f:attack-id":"T1569.001","d3f:definition":"Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man)","rdfs:label":"Launchctl"},{"@id":"d3f:T1569.002","d3f:attack-id":"T1569.002","d3f:definition":"Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and [Net](https://attack.mitre.org/software/S0039).","rdfs:label":"Service Execution"},{"@id":"d3f:T1570","d3f:attack-id":"T1570","d3f:definition":"Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.","rdfs:label":"Lateral Tool Transfer"},{"@id":"d3f:T1571","d3f:attack-id":"T1571","d3f:definition":"Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.","rdfs:label":"Non-Standard Port"},{"@id":"d3f:T1572","d3f:attack-id":"T1572","d3f:definition":"Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.","rdfs:label":"Protocol Tunneling"},{"@id":"d3f:T1573","d3f:attack-id":"T1573","d3f:definition":"Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.","rdfs:label":"Encrypted Channel"},{"@id":"d3f:T1573.001","d3f:attack-id":"T1573.001","d3f:definition":"Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.","rdfs:label":"Symmetric Cryptography"},{"@id":"d3f:T1573.002","d3f:attack-id":"T1573.002","d3f:definition":"Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal.","rdfs:label":"Asymmetric Cryptography"},{"@id":"d3f:T1574","d3f:attack-id":"T1574","d3f:definition":"Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.","rdfs:label":"Hijack Execution Flow"},{"@id":"d3f:T1574.001","d3f:attack-id":"T1574.001","d3f:definition":"Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.","rdfs:label":"DLL Search Order Hijacking"},{"@id":"d3f:T1574.002","d3f:attack-id":"T1574.002","d3f:definition":"Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).","rdfs:label":"DLL Side-Loading"},{"@id":"d3f:T1574.004","d3f:attack-id":"T1574.004","d3f:definition":"Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with @rpath, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable. Additionally, if weak linking is used, such as the LC_LOAD_WEAK_DYLIB function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added.","rdfs:label":"Dylib Hijacking"},{"@id":"d3f:T1574.005","d3f:attack-id":"T1574.005","d3f:definition":"Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.","rdfs:label":"Executable Installer File Permissions Weakness"},{"@id":"d3f:T1574.006","d3f:attack-id":"T1574.006","d3f:definition":"Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS. Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions without changing the original library.(Citation: Baeldung LD_PRELOAD)","rdfs:label":"Dynamic Linker Hijacking"},{"@id":"d3f:T1574.007","d3f:attack-id":"T1574.007","d3f:definition":"Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. The PATH environment variable contains a list of directories (User and System) that the OS searches sequentially through in search of the binary that was called from a script or the command line.","rdfs:label":"Path Interception by PATH Environment Variable"},{"@id":"d3f:T1574.008","d3f:attack-id":"T1574.008","d3f:definition":"Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.","rdfs:label":"Path Interception by Search Order Hijacking"},{"@id":"d3f:T1574.009","d3f:attack-id":"T1574.009","d3f:definition":"Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.","rdfs:label":"Path Interception by Unquoted Path"},{"@id":"d3f:T1574.010","d3f:attack-id":"T1574.010","d3f:definition":"Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.","rdfs:label":"Services File Permissions Weakness"},{"@id":"d3f:T1574.011","d3f:attack-id":"T1574.011","d3f:definition":"Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts. Windows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions. (Citation: Registry Key Security)(Citation: malware_hides_service)","rdfs:label":"Services Registry Permissions Weakness"},{"@id":"d3f:T1574.012","d3f:attack-id":"T1574.012","d3f:definition":"Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profilers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013)","rdfs:label":"COR_PROFILER"},{"@id":"d3f:T1574.013","d3f:attack-id":"T1574.013","d3f:definition":"Adversaries may abuse the KernelCallbackTable of a process to hijack its execution flow in order to run their own payloads.(Citation: Lazarus APT January 2022)(Citation: FinFisher exposed ) The KernelCallbackTable can be found in the Process Environment Block (PEB) and is initialized to an array of graphic functions available to a GUI process once user32.dll is loaded.(Citation: Windows Process Injection KernelCallbackTable)","rdfs:label":"KernelCallbackTable"},{"@id":"d3f:T1574.014","d3f:attack-id":"T1574.014","d3f:definition":"Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` loads assemblies. The .NET framework uses the `AppDomainManager` class to create and manage one or more isolated runtime environments (called application domains) inside a process to host the execution of .NET applications. Assemblies (`.exe` or `.dll` binaries compiled to run as .NET code) may be loaded into an application domain as executable code.(Citation: Microsoft App Domains)","rdfs:label":"AppDomainManager"},{"@id":"d3f:T1578","d3f:attack-id":"T1578","d3f:definition":"An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.","rdfs:label":"Modify Cloud Compute Infrastructure"},{"@id":"d3f:T1578.001","d3f:attack-id":"T1578.001","d3f:definition":"An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence.","rdfs:label":"Create Snapshot"},{"@id":"d3f:T1578.002","d3f:attack-id":"T1578.002","d3f:definition":"An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020)","rdfs:label":"Create Cloud Instance"},{"@id":"d3f:T1578.003","d3f:attack-id":"T1578.003","d3f:definition":"An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable.","rdfs:label":"Delete Cloud Instance"},{"@id":"d3f:T1578.004","d3f:attack-id":"T1578.004","d3f:definition":"An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.","rdfs:label":"Revert Cloud Instance"},{"@id":"d3f:T1578.005","d3f:attack-id":"T1578.005","d3f:definition":"Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve their goals, potentially without affecting the execution of running instances and/or revealing their activities to the victim.","rdfs:label":"Modify Cloud Compute Configurations"},{"@id":"d3f:T1580","d3f:attack-id":"T1580","d3f:definition":"An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.","rdfs:label":"Cloud Infrastructure Discovery"},{"@id":"d3f:T1583","d3f:attack-id":"T1583","d3f:definition":"Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost.(Citation: Free Trial PurpleUrchin) Additionally, botnets are available for rent or purchase.","rdfs:label":"Acquire Infrastructure"},{"@id":"d3f:T1583.001","d3f:attack-id":"T1583.001","d3f:definition":"Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.","rdfs:label":"Domains"},{"@id":"d3f:T1583.002","d3f:attack-id":"T1583.002","d3f:definition":"Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations.","rdfs:label":"DNS Server"},{"@id":"d3f:T1583.003","d3f:attack-id":"T1583.003","d3f:definition":"Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure.","rdfs:label":"Virtual Private Server"},{"@id":"d3f:T1583.004","d3f:attack-id":"T1583.004","d3f:definition":"Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), enabling [Phishing](https://attack.mitre.org/techniques/T1566) operations, or facilitating [Command and Control](https://attack.mitre.org/tactics/TA0011). Instead of compromising a third-party [Server](https://attack.mitre.org/techniques/T1584/004) or renting a [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused.(Citation: Free Trial PurpleUrchin)(Citation: Freejacked)","rdfs:label":"Server"},{"@id":"d3f:T1583.005","d3f:attack-id":"T1583.005","d3f:definition":"Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Adversaries may purchase a subscription to use an existing botnet from a booter/stresser service. With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).(Citation: Imperva DDoS for Hire)(Citation: Krebs-Anna)(Citation: Krebs-Bazaar)(Citation: Krebs-Booter)","rdfs:label":"Botnet"},{"@id":"d3f:T1583.006","d3f:attack-id":"T1583.006","d3f:definition":"Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566). Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: FireEye APT29) By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.","rdfs:label":"Web Services"},{"@id":"d3f:T1583.007","d3f:attack-id":"T1583.007","d3f:definition":"Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers or AWS Lambda functions, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.","rdfs:label":"Serverless"},{"@id":"d3f:T1583.008","d3f:attack-id":"T1583.008","d3f:definition":"Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements.(Citation: spamhaus-malvertising) Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites.","rdfs:label":"Malvertising"},{"@id":"d3f:T1584","d3f:attack-id":"T1584","d3f:definition":"Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.","rdfs:label":"Compromise Infrastructure"},{"@id":"d3f:T1584.001","d3f:attack-id":"T1584.001","d3f:definition":"Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account or taking advantage of renewal process gaps.(Citation: Krebs DNS Hijack 2019)","rdfs:label":"Domains"},{"@id":"d3f:T1584.002","d3f:attack-id":"T1584.002","d3f:definition":"Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations.","rdfs:label":"DNS Server"},{"@id":"d3f:T1584.003","d3f:attack-id":"T1584.003","d3f:definition":"Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig)","rdfs:label":"Virtual Private Server"},{"@id":"d3f:T1584.004","d3f:attack-id":"T1584.004","d3f:definition":"Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.(Citation: TrendMicro EarthLusca 2022) Instead of purchasing a [Server](https://attack.mitre.org/techniques/T1583/004) or [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may compromise third-party servers in support of operations.","rdfs:label":"Server"},{"@id":"d3f:T1584.005","d3f:attack-id":"T1584.005","d3f:definition":"Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.(Citation: Imperva DDoS for Hire) Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.(Citation: Dell Dridex Oct 2015) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).","rdfs:label":"Botnet"},{"@id":"d3f:T1584.006","d3f:attack-id":"T1584.006","d3f:definition":"Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Recorded Future Turla Infra 2020) Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.","rdfs:label":"Web Services"},{"@id":"d3f:T1584.007","d3f:attack-id":"T1584.007","d3f:definition":"Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers or AWS Lambda functions, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.","rdfs:label":"Serverless"},{"@id":"d3f:T1584.008","d3f:attack-id":"T1584.008","d3f:definition":"Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not [Initial Access](https://attack.mitre.org/tactics/TA0001) to that environment -- instead leveraging these devices to support additional targeting.","rdfs:label":"Network Devices"},{"@id":"d3f:T1585","d3f:attack-id":"T1585","d3f:definition":"Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)","rdfs:label":"Establish Accounts"},{"@id":"d3f:T1585.001","d3f:attack-id":"T1585.001","d3f:definition":"Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)","rdfs:label":"Social Media Accounts"},{"@id":"d3f:T1585.002","d3f:attack-id":"T1585.002","d3f:definition":"Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for follow-on purposes.(Citation: Free Trial PurpleUrchin)","rdfs:label":"Email Accounts"},{"@id":"d3f:T1585.003","d3f:attack-id":"T1585.003","d3f:definition":"Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)","rdfs:label":"Cloud Accounts"},{"@id":"d3f:T1586","d3f:attack-id":"T1586","d3f:definition":"Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. [Establish Accounts](https://attack.mitre.org/techniques/T1585)), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.","rdfs:label":"Compromise Accounts"},{"@id":"d3f:T1586.001","d3f:attack-id":"T1586.001","d3f:definition":"Adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating social media profiles (i.e. [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001)), adversaries may compromise existing social media accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.","rdfs:label":"Social Media Accounts"},{"@id":"d3f:T1586.002","d3f:attack-id":"T1586.002","d3f:definition":"Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Phishing](https://attack.mitre.org/techniques/T1566), or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).","rdfs:label":"Email Accounts"},{"@id":"d3f:T1586.003","d3f:attack-id":"T1586.003","d3f:definition":"Adversaries may compromise cloud accounts that can be used during targeting. Adversaries can use compromised cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Compromising cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)","rdfs:label":"Cloud Accounts"},{"@id":"d3f:T1587","d3f:attack-id":"T1587","d3f:definition":"Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020)","rdfs:label":"Develop Capabilities"},{"@id":"d3f:T1587.001","d3f:attack-id":"T1587.001","d3f:definition":"Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB)","rdfs:label":"Malware"},{"@id":"d3f:T1587.002","d3f:attack-id":"T1587.002","d3f:definition":"Adversaries may create self-signed code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.","rdfs:label":"Code Signing Certificates"},{"@id":"d3f:T1587.003","d3f:attack-id":"T1587.003","d3f:definition":"Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).","rdfs:label":"Digital Certificates"},{"@id":"d3f:T1587.004","d3f:attack-id":"T1587.004","d3f:definition":"Adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than finding/modifying exploits from online or purchasing them from exploit vendors, an adversary may develop their own exploits.(Citation: NYTStuxnet) Adversaries may use information acquired via [Vulnerabilities](https://attack.mitre.org/techniques/T1588/006) to focus exploit development efforts. As part of the exploit development process, adversaries may uncover exploitable vulnerabilities through methods such as fuzzing and patch analysis.(Citation: Irongeek Sims BSides 2017)","rdfs:label":"Exploits"},{"@id":"d3f:T1588","d3f:attack-id":"T1588","d3f:definition":"Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.","rdfs:label":"Obtain Capabilities"},{"@id":"d3f:T1588.001","d3f:attack-id":"T1588.001","d3f:definition":"Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.","rdfs:label":"Malware"},{"@id":"d3f:T1588.002","d3f:attack-id":"T1588.002","d3f:definition":"Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Tool acquisition can involve the procurement of commercial software licenses, including for red teaming tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154). Commercial software may be obtained through purchase, stealing licenses (or licensed copies of the software), or cracking trial versions.(Citation: Recorded Future Beacon 2019)","rdfs:label":"Tool"},{"@id":"d3f:T1588.003","d3f:attack-id":"T1588.003","d3f:definition":"Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.","rdfs:label":"Code Signing Certificates"},{"@id":"d3f:T1588.004","d3f:attack-id":"T1588.004","d3f:definition":"Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.","rdfs:label":"Digital Certificates"},{"@id":"d3f:T1588.005","d3f:attack-id":"T1588.005","d3f:definition":"Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.(Citation: Exploit Database)(Citation: TempertonDarkHotel)(Citation: NationsBuying)","rdfs:label":"Exploits"},{"@id":"d3f:T1588.006","d3f:attack-id":"T1588.006","d3f:definition":"Adversaries may acquire information about vulnerabilities that can be used during targeting. A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur. Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.(Citation: National Vulnerability Database)","rdfs:label":"Vulnerabilities"},{"@id":"d3f:T1588.007","d3f:attack-id":"T1588.007","d3f:definition":"Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks including conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043), creating basic scripts, assisting social engineering, and even developing payloads.(Citation: MSFT-AI)","rdfs:label":"Artificial Intelligence"},{"@id":"d3f:T1589","d3f:attack-id":"T1589","d3f:definition":"Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations.","rdfs:label":"Gather Victim Identity Information"},{"@id":"d3f:T1589.001","d3f:attack-id":"T1589.001","d3f:definition":"Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.","rdfs:label":"Credentials"},{"@id":"d3f:T1589.002","d3f:attack-id":"T1589.002","d3f:definition":"Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.","rdfs:label":"Email Addresses"},{"@id":"d3f:T1589.003","d3f:attack-id":"T1589.003","d3f:definition":"Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures.","rdfs:label":"Employee Names"},{"@id":"d3f:T1590","d3f:attack-id":"T1590","d3f:definition":"Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.","rdfs:label":"Gather Victim Network Information"},{"@id":"d3f:T1590.001","d3f:attack-id":"T1590.001","d3f:definition":"Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers.","rdfs:label":"Domain Properties"},{"@id":"d3f:T1590.002","d3f:attack-id":"T1590.002","d3f:definition":"Adversaries may gather information about the victim's DNS that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. DNS, MX, TXT, and SPF records may also reveal the use of third party cloud and SaaS providers, such as Office 365, G Suite, Salesforce, or Zendesk.(Citation: Sean Metcalf Twitter DNS Records)","rdfs:label":"DNS"},{"@id":"d3f:T1590.003","d3f:attack-id":"T1590.003","d3f:definition":"Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access.","rdfs:label":"Network Trust Dependencies"},{"@id":"d3f:T1590.004","d3f:attack-id":"T1590.004","d3f:definition":"Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure.","rdfs:label":"Network Topology"},{"@id":"d3f:T1590.005","d3f:attack-id":"T1590.005","d3f:definition":"Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and or where/how their publicly-facing infrastructure is hosted.","rdfs:label":"IP Addresses"},{"@id":"d3f:T1590.006","d3f:attack-id":"T1590.006","d3f:definition":"Adversaries may gather information about the victim's network security appliances that can be used during targeting. Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts. Adversaries may also target information about victim network-based intrusion detection systems (NIDS) or other appliances related to defensive cybersecurity operations.","rdfs:label":"Network Security Appliances"},{"@id":"d3f:T1591","d3f:attack-id":"T1591","d3f:definition":"Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees.","rdfs:label":"Gather Victim Org Information"},{"@id":"d3f:T1591.001","d3f:attack-id":"T1591.001","d3f:definition":"Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within.","rdfs:label":"Determine Physical Locations"},{"@id":"d3f:T1591.002","d3f:attack-id":"T1591.002","d3f:definition":"Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources.","rdfs:label":"Business Relationships"},{"@id":"d3f:T1591.003","d3f:attack-id":"T1591.003","d3f:definition":"Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources.","rdfs:label":"Identify Business Tempo"},{"@id":"d3f:T1591.004","d3f:attack-id":"T1591.004","d3f:definition":"Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to.","rdfs:label":"Identify Roles"},{"@id":"d3f:T1592","d3f:attack-id":"T1592","d3f:definition":"Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).","rdfs:label":"Gather Victim Host Information"},{"@id":"d3f:T1592.001","d3f:attack-id":"T1592.001","d3f:definition":"Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.).","rdfs:label":"Hardware"},{"@id":"d3f:T1592.002","d3f:attack-id":"T1592.002","d3f:definition":"Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).","rdfs:label":"Software"},{"@id":"d3f:T1592.003","d3f:attack-id":"T1592.003","d3f:definition":"Adversaries may gather information about the victim's host firmware that can be used during targeting. Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, etc.).","rdfs:label":"Firmware"},{"@id":"d3f:T1592.004","d3f:attack-id":"T1592.004","d3f:definition":"Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone.","rdfs:label":"Client Configurations"},{"@id":"d3f:T1593","d3f:attack-id":"T1593","d3f:definition":"Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking)","rdfs:label":"Search Open Websites/Domains"},{"@id":"d3f:T1593.001","d3f:attack-id":"T1593.001","d3f:definition":"Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff.","rdfs:label":"Social Media"},{"@id":"d3f:T1593.002","d3f:attack-id":"T1593.002","d3f:definition":"Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking)","rdfs:label":"Search Engines"},{"@id":"d3f:T1593.003","d3f:attack-id":"T1593.003","d3f:definition":"Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.","rdfs:label":"Code Repositories"},{"@id":"d3f:T1594","d3f:attack-id":"T1594","d3f:definition":"Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: [Email Addresses](https://attack.mitre.org/techniques/T1589/002)). These sites may also have details highlighting business operations and relationships.(Citation: Comparitech Leak)","rdfs:label":"Search Victim-Owned Websites"},{"@id":"d3f:T1595","d3f:attack-id":"T1595","d3f:definition":"Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.","rdfs:label":"Active Scanning"},{"@id":"d3f:T1595.001","d3f:attack-id":"T1595.001","d3f:definition":"Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses.","rdfs:label":"Scanning IP Blocks"},{"@id":"d3f:T1595.002","d3f:attack-id":"T1595.002","d3f:definition":"Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use.","rdfs:label":"Vulnerability Scanning"},{"@id":"d3f:T1595.003","d3f:attack-id":"T1595.003","d3f:definition":"Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).","rdfs:label":"Wordlist Scanning"},{"@id":"d3f:T1596","d3f:attack-id":"T1596","d3f:definition":"Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS)(Citation: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: DigitalShadows CDN)(Citation: Shodan)","rdfs:label":"Search Open Technical Databases"},{"@id":"d3f:T1596.001","d3f:attack-id":"T1596.001","d3f:definition":"Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts.","rdfs:label":"DNS/Passive DNS"},{"@id":"d3f:T1596.002","d3f:attack-id":"T1596.002","d3f:definition":"Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers.(Citation: WHOIS)","rdfs:label":"WHOIS"},{"@id":"d3f:T1596.003","d3f:attack-id":"T1596.003","d3f:definition":"Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location.","rdfs:label":"Digital Certificates"},{"@id":"d3f:T1596.004","d3f:attack-id":"T1596.004","d3f:definition":"Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region.","rdfs:label":"CDNs"},{"@id":"d3f:T1596.005","d3f:attack-id":"T1596.005","d3f:definition":"Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.(Citation: Shodan)","rdfs:label":"Scan Databases"},{"@id":"d3f:T1597","d3f:attack-id":"T1597","d3f:definition":"Adversaries may search and gather information about victims from closed sources that can be used during targeting. Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data.(Citation: D3Secutrity CTI Feeds) Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.(Citation: ZDNET Selling Data)","rdfs:label":"Search Closed Sources"},{"@id":"d3f:T1597.001","d3f:attack-id":"T1597.001","d3f:definition":"Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds)","rdfs:label":"Threat Intel Vendors"},{"@id":"d3f:T1597.002","d3f:attack-id":"T1597.002","d3f:definition":"Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.","rdfs:label":"Purchase Technical Data"},{"@id":"d3f:T1598","d3f:attack-id":"T1598","d3f:definition":"Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code.","rdfs:label":"Phishing for Information"},{"@id":"d3f:T1598.001","d3f:attack-id":"T1598.001","d3f:definition":"Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.","rdfs:label":"Spearphishing Service"},{"@id":"d3f:T1598.002","d3f:attack-id":"T1598.002","d3f:definition":"Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.","rdfs:label":"Spearphishing Attachment"},{"@id":"d3f:T1598.003","d3f:attack-id":"T1598.003","d3f:definition":"Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.","rdfs:label":"Spearphishing Link"},{"@id":"d3f:T1598.004","d3f:attack-id":"T1598.004","d3f:definition":"Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) and/or creating a sense of urgency or alarm for the recipient.","rdfs:label":"Spearphishing Voice"},{"@id":"d3f:T1599","d3f:attack-id":"T1599","d3f:definition":"Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation. Breaching these devices may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.","rdfs:label":"Network Boundary Bridging"},{"@id":"d3f:T1599.001","d3f:attack-id":"T1599.001","d3f:definition":"Adversaries may bridge network boundaries by modifying a network device’s Network Address Translation (NAT) configuration. Malicious modifications to NAT may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.","rdfs:label":"Network Address Translation Traversal"},{"@id":"d3f:T1600","d3f:attack-id":"T1600","d3f:definition":"Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications. (Citation: Cisco Synful Knock Evolution)","rdfs:label":"Weaken Encryption"},{"@id":"d3f:T1600.001","d3f:attack-id":"T1600.001","d3f:definition":"Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution)","rdfs:label":"Reduce Key Space"},{"@id":"d3f:T1600.002","d3f:attack-id":"T1600.002","d3f:definition":"Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data.","rdfs:label":"Disable Crypto Hardware"},{"@id":"d3f:T1601","d3f:attack-id":"T1601","d3f:definition":"Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.","rdfs:label":"Modify System Image"},{"@id":"d3f:T1601.001","d3f:attack-id":"T1601.001","d3f:definition":"Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime.","rdfs:label":"Patch System Image"},{"@id":"d3f:T1601.002","d3f:attack-id":"T1601.002","d3f:definition":"Adversaries may install an older version of the operating system of a network device to weaken security. Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features. (Citation: Cisco Synful Knock Evolution)","rdfs:label":"Downgrade System Image"},{"@id":"d3f:T1602","d3f:attack-id":"T1602","d3f:definition":"Adversaries may collect data related to managed devices from configuration repositories. Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems. Configuration repositories may also facilitate remote access and administration of devices.","rdfs:label":"Data from Configuration Repository"},{"@id":"d3f:T1602.001","d3f:attack-id":"T1602.001","d3f:definition":"Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).","rdfs:label":"SNMP (MIB Dump)"},{"@id":"d3f:T1602.002","d3f:attack-id":"T1602.002","d3f:definition":"Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.","rdfs:label":"Network Device Configuration Dump"},{"@id":"d3f:T1606","d3f:attack-id":"T1606","d3f:definition":"Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.","rdfs:label":"Forge Web Credentials"},{"@id":"d3f:T1606.001","d3f:attack-id":"T1606.001","d3f:definition":"Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access.","rdfs:label":"Web Cookies"},{"@id":"d3f:T1606.002","d3f:attack-id":"T1606.002","d3f:definition":"An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.(Citation: Microsoft SolarWinds Steps) The default lifetime of a SAML token is one hour, but the validity period can be specified in the NotOnOrAfter value of the conditions ... element in a token. This value can be changed using the AccessTokenLifetime in a LifetimeTokenPolicy.(Citation: Microsoft SAML Token Lifetimes) Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO (single sign-on) mechanism.(Citation: Cyberark Golden SAML)","rdfs:label":"SAML Tokens"},{"@id":"d3f:T1608","d3f:attack-id":"T1608","d3f:definition":"Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.(Citation: Volexity Ocean Lotus November 2020)(Citation: Dragos Heroku Watering Hole)(Citation: Malwarebytes Heroku Skimmers)(Citation: Netskope GCP Redirection)(Citation: Netskope Cloud Phishing)","rdfs:label":"Stage Capabilities"},{"@id":"d3f:T1608.001","d3f:attack-id":"T1608.001","d3f:definition":"Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content. Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.","rdfs:label":"Upload Malware"},{"@id":"d3f:T1608.002","d3f:attack-id":"T1608.002","d3f:definition":"Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.","rdfs:label":"Upload Tool"},{"@id":"d3f:T1608.003","d3f:attack-id":"T1608.003","d3f:definition":"Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it.(Citation: DigiCert Install SSL Cert)","rdfs:label":"Install Digital Certificate"},{"@id":"d3f:T1608.004","d3f:attack-id":"T1608.004","d3f:definition":"Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001). Prior to [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).","rdfs:label":"Drive-by Target"},{"@id":"d3f:T1608.005","d3f:attack-id":"T1608.005","d3f:definition":"Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in [Malicious Link](https://attack.mitre.org/techniques/T1204/001). Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003)) or a phish to gain initial access to a system (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002)), an adversary must set up the resources for a link target for the spearphishing link.","rdfs:label":"Link Target"},{"@id":"d3f:T1608.006","d3f:attack-id":"T1608.006","d3f:definition":"Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.(Citation: Atlas SEO)(Citation: MalwareBytes SEO)","rdfs:label":"SEO Poisoning"},{"@id":"d3f:T1609","d3f:attack-id":"T1609","d3f:definition":"Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet)","rdfs:label":"Container Administration Command"},{"@id":"d3f:T1610","d3f:attack-id":"T1610","d3f:definition":"Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node. (Citation: AppSecco Kubernetes Namespace Breakout 2020)","rdfs:label":"Deploy Container"},{"@id":"d3f:T1611","d3f:attack-id":"T1611","d3f:definition":"Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)","rdfs:label":"Escape to Host"},{"@id":"d3f:T1612","d3f:attack-id":"T1612","d3f:definition":"Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image)","rdfs:label":"Build Image on Host"},{"@id":"d3f:T1613","d3f:attack-id":"T1613","d3f:definition":"Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.","rdfs:label":"Container and Resource Discovery"},{"@id":"d3f:T1614","d3f:attack-id":"T1614","d3f:definition":"","rdfs:label":"System Location Discovery"},{"@id":"d3f:T1614.001","d3f:attack-id":"T1614.001","d3f:definition":"Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check)","rdfs:label":"System Language Discovery"},{"@id":"d3f:T1615","d3f:attack-id":"T1615","d3f:definition":"Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\\\\SYSVOL\\\\Policies\\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016)","rdfs:label":"Group Policy Discovery"},{"@id":"d3f:T1619","d3f:attack-id":"T1619","d3f:definition":"Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) on a local host, after identifying available storage services (i.e. [Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580)) adversaries may access the contents/objects stored in cloud infrastructure.","rdfs:label":"Cloud Storage Object Discovery"},{"@id":"d3f:T1620","d3f:attack-id":"T1620","d3f:definition":"Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., [Shared Modules](https://attack.mitre.org/techniques/T1129)).","rdfs:label":"Reflective Code Loading"},{"@id":"d3f:T1621","d3f:attack-id":"T1621","d3f:definition":"Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.","rdfs:label":"Multi-Factor Authentication Request Generation"},{"@id":"d3f:T1622","d3f:attack-id":"T1622","d3f:definition":"Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.(Citation: ProcessHacker Github)","rdfs:label":"Debugger Evasion"},{"@id":"d3f:T1647","d3f:attack-id":"T1647","d3f:definition":"Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses. macOS applications use plist files, such as the info.plist file, to store properties and configuration settings that inform the operating system how to handle the application at runtime. Plist files are structured metadata in key-value pairs formatted in XML based on Apple's Core Foundation DTD. Plist files can be saved in text or binary format.(Citation: fileinfo plist file description)","rdfs:label":"Plist File Modification"},{"@id":"d3f:T1648","d3f:attack-id":"T1648","d3f:definition":"Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.","rdfs:label":"Serverless Execution"},{"@id":"d3f:T1649","d3f:attack-id":"T1649","d3f:definition":"Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Azure AD device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.(Citation: O365 Blog Azure AD Device IDs)(Citation: Microsoft AD CS Overview)","rdfs:label":"Steal or Forge Authentication Certificates"},{"@id":"d3f:T1650","d3f:attack-id":"T1650","d3f:definition":"Adversaries may purchase or otherwise acquire an existing access to a target system or network. A variety of online services and initial access broker networks are available to sell access to previously compromised systems.(Citation: Microsoft Ransomware as a Service)(Citation: CrowdStrike Access Brokers)(Citation: Krebs Access Brokers Fortune 500) In some cases, adversary groups may form partnerships to share compromised systems with each other.(Citation: CISA Karakurt 2022)","rdfs:label":"Acquire Access"},{"@id":"d3f:T1651","d3f:attack-id":"T1651","d3f:definition":"Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. (Citation: AWS Systems Manager Run Command)(Citation: Microsoft Run Command)","rdfs:label":"Cloud Administration Command"},{"@id":"d3f:T1652","d3f:attack-id":"T1652","d3f:definition":"Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)).","rdfs:label":"Device Driver Discovery"},{"@id":"d3f:T1653","d3f:attack-id":"T1653","d3f:definition":"Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.(Citation: Sleep, shut down, hibernate)","rdfs:label":"Power Settings"},{"@id":"d3f:T1654","d3f:attack-id":"T1654","d3f:definition":"Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records ([Account Discovery](https://attack.mitre.org/techniques/T1087)), security or vulnerable software ([Software Discovery](https://attack.mitre.org/techniques/T1518)), or hosts within a compromised network ([Remote System Discovery](https://attack.mitre.org/techniques/T1018)).","rdfs:label":"Log Enumeration"},{"@id":"d3f:T1656","d3f:attack-id":"T1656","d3f:definition":"Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Phishing](https://attack.mitre.org/techniques/T1566), or [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.","rdfs:label":"Impersonation"},{"@id":"d3f:T1657","d3f:attack-id":"T1657","d3f:definition":"Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware,(Citation: FBI-ransomware) business email compromise (BEC) and fraud,(Citation: FBI-BEC) \"pig butchering,\"(Citation: wired-pig butchering) bank hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocurrency networks.(Citation: BBC-Ronin)","rdfs:label":"Financial Theft"},{"@id":"d3f:T1659","d3f:attack-id":"T1659","d3f:definition":"Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) followed by [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and other data to already compromised systems.(Citation: ESET MoustachedBouncer)","rdfs:label":"Content Injection"},{"@id":"d3f:T1665","d3f:attack-id":"T1665","d3f:definition":"Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished in various ways including by identifying and filtering traffic from defensive tools,(Citation: TA571) masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers,(Citation: Schema-abuse)(Citation: Facad1ng)(Citation: Browser-updates) and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely.","rdfs:label":"Hide Infrastructure"},{"@id":"d3f:T1666","d3f:attack-id":"T1666","d3f:definition":"Adversaries may attempt to modify hierarchical structures in infrastructure-as-a-service (IaaS) environments in order to evade defenses.","rdfs:label":"Modify Cloud Resource Hierarchy"}]}