T1027.017_svg-smuggling
Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.
1.21k repo starsObserved in 1 repos
DevOps & Security
DevOps & Security skills
Browse reusable Agent Skills, each with a clear purpose and practical guidance.
T1027_obfuscated-files-or-information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1029_scheduled-transfer
Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1030_data-transfer-size-limits
An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1033_system-owneruser-discovery
Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1036.002_right-to-left-override
Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1036.003_rename-legitimate-utilities
Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1036.004_masquerade-task-or-service
Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1036.005_match-legitimate-resource-name-or-location
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1036.006_space-after-filename
Adversaries can hide a program's true filetype by changing the extension of a file.
1.21k repo starsObserved in 1 repos
DevOps & Security