Browse reusable Agent Skills, each with a clear purpose and practical guidance.
Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.
Adversaries may chain together multiple proxies to disguise the source of malicious traffic.
Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffi...
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to ...
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted i...
Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network.
Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.
An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant.
Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host.