Browse reusable Agent Skills, each with a clear purpose and practical guidance.
An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system.
An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain.
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure.
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel.
Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel.
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.
Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions.
Adversaries may transfer tools or other files from an external system into a compromised environment.
Adversaries may interact with the native OS application programming interface (API) to execute behaviors.