T0894_system-binary-proxy-execution
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.
1.21k repo starsObserved in 1 repos
DevOps & Security
DevOps & Security skills
Browse reusable Agent Skills, each with a clear purpose and practical guidance.
T1001.002_steganography
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1001.003_protocol-or-service-impersonation
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1003.001_lsass-memory
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
1.21k repo starsObserved in 1 repos
DevOps & Security
T1003.002_security-account-manager
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is...
1.21k repo starsObserved in 1 repos
DevOps & Security
T1003.003_ntds
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as...
1.21k repo starsObserved in 1 repos
DevOps & Security
T1003.004_lsa-secrets
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service...
1.21k repo starsObserved in 1 repos
DevOps & Security
T1003.005_cached-domain-credentials
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1003.006_dcsync
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process fr...
1.21k repo starsObserved in 1 repos
DevOps & Security
T1003.007_proc-filesystem
Adversaries may gather credentials from the proc filesystem or `/proc`.
1.21k repo starsObserved in 1 repos
DevOps & Security