T1053_scheduled-taskjob
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.
1.21k repo starsObserved in 1 repos
DevOps & Security
DevOps & Security skills
Browse reusable Agent Skills, each with a clear purpose and practical guidance.
T1055.001_dynamic-link-library-injection
Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1055.002_portable-executable-injection
Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1055.003_thread-execution-hijacking
Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1055.004_asynchronous-procedure-call
Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1055.005_thread-local-storage
Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1055.008_ptrace-system-calls
Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1055.009_proc-memory
Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1055.011_extra-window-memory-injection
Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1055.012_process-hollowing
Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses.
1.21k repo starsObserved in 1 repos
DevOps & Security