Bare Metal Cyber Wiki
Start with a question, a topic family, or a guided path. The complete directory is still here, but it no longer stands between you and the right place to begin.
Choose Your Entrance
Use the Wiki as a map, not a wall of definitions. Pick the route that best matches the question you have today.
New to the subject
Build the mental models behind systems, risk, controls, attacks, and resilience before moving into deeper technical material.
80 connected articles → 02Build technical depth
Explore networks, operating systems, identity, cloud, applications, cryptography, and the controls that protect them.
Open the Technical Core → 03Understand adversary behavior
Use the Enterprise ATT&CK catalog to study behaviors, groups, software, campaigns, defensive design, and detection opportunities.
860 local ATT&CK profiles → 04Engineer the defensive response
Move through seven defensive tactics, 271 techniques, technical artifacts, and carefully labeled links to ATT&CK and NIST SP 800-53.
271 defensive techniques → 05Organize outcomes around risk
Move from Govern, Identify, Protect, Detect, Respond, and Recover to every Category and Subcategory outcome.
Open the NIST CSF Learning Center → 06Implement and assess controls
Move from 20 control families to 324 base controls, 872 enhancements, baseline memberships, parameters, implementation guidance, and assessment evidence.
Open the SP 800-53 Control Library → 07Protect Controlled Unclassified Information
Move through 17 CUI requirement families, 97 active requirements, organization-defined parameters, source SP 800-53 controls, and SP 800-171A assessment evidence.
Open the CUI Protection Center → 08Protect Critical CUI Against Advanced Threats
Move through 17 enhanced CUI requirement families, 103 active requirements, protection strategies, organization-defined parameters, source SP 800-53 controls, and SP 800-172A assessment evidence.
Open the Enhanced CUI Protection Center → 09Connect outcomes, controls, defenses, and threats
Move from all 106 CSF Subcategory outcomes into SP 800-53, CUI requirements, D3FEND, ATT&CK, books, podcasts, and Academy learning.
430 connected map records → 10Turn the map into an operating path
Start with identity, ransomware, cloud, CUI, incident response, AI, supply chain, resilience, or another real mission and follow the connected evidence path.
12 guided playbooks → 11Study with a sequence
Move through related articles in an intentional order for network defense, identity, cloud, incident response, governance, and more.
46 learning paths →Knowledge Map
Each family is a smaller doorway into the larger reference. Entry counts show where the Wiki is deepest today.
Core models, principles, terminology, and ways of thinking that support every cybersecurity role.
Explore this family →How systems communicate, where trust boundaries form, and how networks are protected and monitored.
Explore this family →Operating systems, endpoints, servers, platforms, hardening, administration, and infrastructure resilience.
Explore this family →Authentication, authorization, identity lifecycle, privileges, federation, and access decisions.
Explore this family →Threat actors, attack patterns, malicious software, social engineering, and adversary behavior.
Explore this family →Weakness discovery, prioritization, validation, remediation, and safe security testing.
Explore this family →Secure design, layered defenses, Zero Trust, resilience, and engineering tradeoffs.
Explore this family →Monitoring, detection, investigation, response, recovery, forensics, and operational learning.
Explore this family →Decision rights, risk management, policy, assurance, standards, regulation, and privacy.
Explore this family →Cloud responsibility, secure software, APIs, pipelines, application risk, and modern platforms.
Explore this family →Encryption, hashing, keys, certificates, signatures, data lifecycle, and cryptographic change.
Explore this family →AI system risk, governance, model protection, automation, and fast-changing technology.
Explore this family →Threat-Informed Defense
The local Enterprise ATT&CK collection connects active adversary behaviors and threat context to plain-language explanations, defensive design, detection thinking, related lessons, and authoritative sources.
Guided Study
80 linked articles
84 linked articles
87 linked articles
91 linked articles
80 linked articles
80 linked articles
Complete Directory
Showing 24 of 2,153 matching entries.
/etc/passwd and /etc/shadow (T1003.008) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0028, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2015 campaign that disrupted Ukrainian electric-power substations using BlackEnergy and KillDisk.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0025, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2016 campaign that disrupted Ukrainian electric-power distribution using Industroyer.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0034, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2022 campaign against a Ukrainian electric utility that combined malware and living-off-the-land behavior to issue unauthorized SCADA commands.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0063, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing destructive December 2025 attacks against Polish energy infrastructure involving Windows and PowerShell wipers.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0057, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a cascading supply-chain compromise that moved from a trojanized trading application into 3CX build environments.
Read the entry →802.1X Network Access Control is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0677, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a PowerShell framework used to administer, enumerate, and test Azure Active Directory environments.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S1000, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a worm that collects AutoCAD drawings and can expose operational or engineering information.
Read the entry →An AI acceptable use policy defines approved, restricted, and prohibited uses of AI services, models, data, accounts, and generated content.
Read the entry →An AI agent selects actions and invokes tools, services, or workflows to pursue a goal across multiple steps.
Read the entry →AI audit analytics applies reproducible queries, statistics, visualizations, and anomaly detection to evaluate populations and focus testing without replacing professional judgment.
Read the entry →AI audit evidence integrity is the ability to show that logs, model artifacts, data extracts, test results, approvals, and screenshots are authentic, complete, attributable, and unchanged.
Read the entry →AI audit finding follow-up verifies that corrective actions address the root cause, operate as intended, and reduce the stated risk before a finding is closed.
Read the entry →AI audit hallucination controls prevent unsupported generated statements from being treated as evidence, criteria, citations, calculations, or conclusions.
Read the entry →AI audit overreliance safeguards keep auditors responsible for scoping, evidence evaluation, judgment, challenge, and conclusions even when AI performs analysis or drafting.
Read the entry →An AI audit sampling strategy selects transactions, prompts, outputs, decisions, users, periods, or model versions in a way that supports the audit objective and exposes meaningful failure modes.
Read the entry →AI audit scope defines the systems, life-cycle stages, data, decisions, vendors, locations, and stakeholders included in an engagement, while audit criteria define the requirements used to judge them.
Read the entry →AI bias and fairness assessment evaluates how data, labels, objectives, design choices, and deployment conditions can create uneven errors or harms across groups.
Read the entry →An AI change evidence package assembles the artifacts needed to understand, approve, reproduce, and later audit a model, data, prompt, configuration, or integration change.
Read the entry →AI configuration reproducibility means an authorized team can recreate the relevant model build or runtime behavior from recorded code, data references, parameters, dependencies, prompts, and infrastructure settings.
Read the entry →AI connector and plugin security governs integrations that let models read data or act through external applications and services.
Read the entry →AI control design effectiveness asks whether a control, as documented and configured, is capable of preventing, detecting, or correcting the risk it was selected to address.
Read the entry →AI control monitoring observes whether preventive, detective, and corrective controls remain active, correctly configured, sufficiently covered, and effective as systems change.
Read the entry →AI control operating effectiveness evaluates whether an appropriately designed control performed consistently, by the right people or automation, throughout the period under review.
Read the entry →AI data lifecycle security protects information during collection, labeling, storage, use, sharing, retention, and deletion.
Read the entry →AI data preparation collects, cleans, labels, transforms, and partitions information for development and evaluation.
Read the entry →AI data-rights and deletion processes handle access, correction, objection, restriction, portability, and erasure across datasets, models, embeddings, caches, logs, and derived outputs.
Read the entry →AI deactivation and contingency controls let an organization pause, limit, localize, roll back, or replace an AI capability when risk exceeds tolerance.
Read the entry →AI deployment approval gates require defined evidence and accountable authorization before models or AI-enabled features advance into higher-risk environments.
Read the entry →AI evaluation pipelines run repeatable tests against model quality, safety, security, fairness, robustness, and operational requirements.
Read the entry →AI evidence chain of custody records who collected, transferred, accessed, transformed, stored, and analyzed evidence from an AI system or incident.
Read the entry →AI feedback loops occur when a system's outputs influence the future data used to evaluate or retrain it.
Read the entry →AI governance roles assign decision rights and obligations across executives, business owners, developers, data stewards, security, privacy, legal, risk, and users.
Read the entry →AI guardrail engineering implements enforceable limits around model inputs, outputs, tools, data, and operating conditions.
Read the entry →AI incident notification governance defines when, how, and by whom AI-related events are escalated to leaders, customers, regulators, vendors, legal counsel, and affected parties.
Read the entry →AI literacy and training give each stakeholder enough role-specific knowledge to use, build, supervise, procure, govern, or challenge AI responsibly.
Read the entry →An AI management system integrates policy, objectives, roles, risk processes, resources, competence, operations, measurement, audit, and continual improvement.
Read the entry →An AI model artifact audit trail links a deployed model to its source code, training configuration, data references, parameters, evaluation results, approvals, and release package.
Read the entry →AI model artifact signing uses cryptographic identity and provenance to verify the origin and integrity of models, adapters, prompts, and supporting files.
Read the entry →The AI model lifecycle covers conception, data, development, testing, release, operation, change, retirement, and evidence preservation.
Read the entry →AI model serving security protects inference endpoints, runtimes, dependencies, model access, scaling, and operational telemetry.
Read the entry →An AI operational readiness review verifies that ownership, support, monitoring, incident response, continuity, capacity, user guidance, and rollback are ready before production use.
Read the entry →AI output validation treats generated text, code, commands, queries, and structured data as untrusted until the consuming system verifies it.
Read the entry →AI post-deployment monitoring measures whether a released system continues to perform, comply, and behave safely in its actual environment.
Read the entry →AI problem framing translates a business or public objective into a defined decision, target, user population, success measure, and set of constraints.
Read the entry →AI procurement and contract controls convert governance, security, privacy, performance, audit, incident, and exit requirements into enforceable supplier obligations.
Read the entry →An AI red teaming program uses authorized adversarial testing to discover harmful behavior, security weaknesses, and control failures before and after release.
Read the entry →AI regulatory role mapping identifies whether an organization acts as a provider, deployer, importer, distributor, user, controller, processor, or another regulated actor for each system.
Read the entry →AI resource abuse targets compute, tokens, storage, tool calls, or paid services to exhaust capacity or create excessive cost.
Read the entry →An AI risk appetite statement describes the types and amount of AI-related risk an organization is willing to pursue or retain in support of its objectives.
Read the entry →AI risk reassessment triggers are defined events that require risk assumptions, ratings, controls, and approvals to be reviewed before normal cadence.
Read the entry →AI risk register integration records AI risks within the enterprise risk structure rather than isolating them in project-only documents.
Read the entry →AI risk scenario analysis describes a plausible chain from threat, vulnerability, error, misuse, or change through affected assets, stakeholders, and consequences.
Read the entry →AI risk tolerance thresholds translate risk appetite into measurable limits for performance, safety, privacy, bias, security, availability, cost, or human-impact indicators.
Read the entry →AI risk treatment tracking follows mitigation, transfer, avoidance, acceptance, or pursuit decisions from approval through implementation and validation.
Read the entry →AI rollback readiness is the proven ability to return to a known acceptable model, configuration, data pipeline, or operating mode after a harmful change.
Read the entry →AI sandboxing confines generated code, tools, files, and network activity to a restricted environment with limited authority and lifetime.
Read the entry →AI secrets management protects API keys, tokens, certificates, and credentials used by models, agents, pipelines, and tools.
Read the entry →AI security governance establishes accountable decisions, controls, evidence, and oversight across the AI lifecycle without treating AI as either ordinary software or an unknowable special case.
Read the entry →AI security metrics governance defines which measures support decisions, how they are calculated, who owns them, and how limitations and thresholds are communicated.
Read the entry →AI shared-responsibility mapping assigns control duties across model providers, cloud platforms, application teams, data owners, users, and oversight functions.
Read the entry →AI system decommissioning assurance verifies that retired models, endpoints, data, credentials, integrations, copies, and monitoring obligations are removed or transferred as approved.
Read the entry →AI-system incident response adapts preparation, detection, analysis, containment, recovery, and learning to failures and attacks involving models, data, prompts, outputs, pipelines, and automated decisions.
Read the entry →An AI system taxonomy separates capabilities, learning methods, autonomy, deployment context, and intended purpose so teams use the same language when describing a system.
Read the entry →AI system trust boundaries identify where data, instructions, identities, models, tools, and authority cross between components or organizations.
Read the entry →AI third-party assurance evaluates whether suppliers and service providers can substantiate their claims about governance, security, privacy, performance, and legal compliance.
Read the entry →AI transparency notices tell people when AI is used, what it does, what information it relies on, important limitations, and how to seek review or correction.
Read the entry →AI use-case intake governance creates a controlled entry point where proposed AI uses are identified, classified, owned, and screened before procurement or development proceeds.
Read the entry →AI use-case readiness assessment tests whether a proposed AI capability has a defined purpose, suitable data, accountable owners, realistic benefits, acceptable failure modes, and monitorable risk.
Read the entry →AI vendor change notification requires providers to disclose material changes that could alter risk, performance, data handling, compliance, or system behavior.
Read the entry →AI vendor control monitoring evaluates whether a provider continues to meet security, privacy, resilience, transparency, and notification commitments after onboarding.
Read the entry →AI-assisted audit governance establishes approved uses, boundaries, validation, confidentiality, accountability, and documentation when auditors use AI tools.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G1000, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected Russian espionage cluster reported against electric utilities in the United States and United Kingdom.
Read the entry →API authentication and token validation establish which principal is calling an API and whether the presented credential is authentic, current, intended for that audience, and permitted to support the requested action.
Read the entry →An API gateway is an intermediary that routes and mediates API traffic and may enforce authentication, rate limits, schema controls, observability, transformation, and policy; securing it requires consistent edge policy without assuming the gateway can replace backend authorization.
Read the entry →API token scope design grants an automation client only the operations, resources, environments, and duration needed for its approved purpose.
Read the entry →API-based data ingestion security validates the source, identity, authorization, format, rate, and integrity of data accepted through programmatic interfaces.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G1028, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a cluster active since at least 2014 with a Middle East focus and reported development of Android and iOS spyware.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0051, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing APT28 activity from 2022 through 2024 that used nearby compromised networks and Wi-Fi paths to reach intended targets.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0087, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing Iranian Ministry of Intelligence and Security-linked espionage activity reported across travel, hospitality, academia, and telecommunications.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0096, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a China-sponsored espionage cluster also reported conducting financially motivated operations across many sectors.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0040, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing APT41 information-gathering activity from 2023 through July 2024 against organizations in Europe, Asia, and the Middle East.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G1044, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing an Iranian-sponsored espionage and surveillance cluster reported to use spearphishing, mobile malware, native features, and open-source tools.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G1023, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a China-based espionage actor reported against telecommunications, aerospace, and defense organizations, including networking devices.
Read the entry →ARP Cache Poisoning (T1557.002) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
Read the entry →AS-REP roasting targets Active Directory accounts that do not require Kerberos preauthentication, allowing an attacker to request an authentication response containing password-derived material and attempt offline password guessing.
Read the entry →AS-REP Roasting (T1558.004) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0073, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a web shell that can provide remote administration of a compromised web server.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S1061, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing Android malware reported in applications that abused known exploits to obtain root permissions.
Read the entry →An adversary misuses an operating-system mechanism intended to govern privilege elevation so activity runs with higher permissions.
Read the entry →Host access control lists extend basic owner-group-other permissions with named user and group entries, default inheritance, and more precise authorization for shared files and directories.
Read the entry →Access reviews verify that users, services, groups, roles, and privileged accounts still need the permissions they hold.
Read the entry →An adversary duplicates, creates, replaces, or impersonates Windows access tokens to act in another security context.
Read the entry →Access Tokens, ID Tokens, and Refresh Tokens is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →Accessibility Features (T1546.008) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →Account Access Removal (T1531) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Account deprovisioning removes or disables access, sessions, credentials, tokens, groups, roles, and recovery methods when access is no longer authorized.
Read the entry →An adversary enumerates local, domain, cloud, service, or application accounts and groups to identify useful identities and privileges.
Read the entry →Account Manipulation (T1098) is an Enterprise ATT&CK technique associated with Persistence, Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Establish rules for when accounts may be created, shared, elevated, accessed remotely, or used for administrative work. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Accountability makes people, roles, services, and organizations answerable for security decisions and actions by assigning ownership and preserving reliable evidence.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S1167, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing an x86 Linux wiping payload designed to affect multiple embedded, networking, IoT, and industrial device types.
Read the entry →Acquire Access (T1650) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →An operator obtains domains, servers, cloud resources, virtual private servers, certificates, or other infrastructure used to stage or conduct malicious activity.
Read the entry →Active defense uses authorized, bounded techniques that increase visibility, constrain adversary freedom, and create response opportunities without abandoning legal, safety, or governance controls.
Read the entry →Harden Active Directory so directory design, delegation, authentication, and replication do not create avoidable attack paths. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Active Directory organizes identities and resources into domains; related domains form trees, one or more trees form a forest, and trusts define which security principals may be recognized across boundaries.
Read the entry →Active Directory Fundamentals concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Read the entry →An operator actively probes addresses, domains, services, applications, or network ranges to learn what is reachable and how it may be exposed.
Read the entry →Active Setup (T1547.014) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Add-ins (T1137.006) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →Additional Cloud Credentials (T1098.001) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Additional Cloud Roles (T1098.003) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Additional Container Cluster Roles (T1098.006) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Additional Email Delegate Permissions (T1098.002) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Additional Local or Domain Groups (T1098.007) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Address Resolution Protocol (ARP) describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Read the entry →Apply GV.OV-02 to achieve this CSF 2.0 outcome: The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks.
Read the entry →Advanced Encryption Standard (AES) is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.
Read the entry →Advanced Persistent Threats is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Adversarial machine learning studies attacks and mitigations involving model training, inference, data, outputs, and operational dependencies.
Read the entry →Adversary emulation for SOC validation reproduces selected threat behaviors under controlled conditions to test people, telemetry, analytics, workflows, and decision authority end to end.
Read the entry →Adversary-in-the-Middle (T1557) is an Enterprise ATT&CK technique associated with Credential Access, Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Use DE.AE to manage analysis, correlation, context, impact, scope, information delivery, and incident declaration within the Detect Function.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0331, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a .NET-based information-stealing and monitoring malware family.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0092, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a worm known for spreading through removable media.
Read the entry →Agentic AI authorization ensures every tool call and consequential action is permitted for the initiating identity, current context, resource, and purpose.
Read the entry →Agile coaching and mentoring build capability through questions, observation, practice, feedback, modeling, and the deliberate transfer of judgment.
Read the entry →Agile collective ownership means the team shares responsibility for product outcomes, work quality, flow, knowledge, and improvement rather than protecting narrow individual tasks.
Read the entry →Agile feedback loops create frequent, purposeful opportunities to compare assumptions and work with user, operational, technical, and business evidence.
Read the entry →Agile metrics selection chooses a small set of measures that support decisions about value, flow, quality, predictability, learning, risk, and sustainability.
Read the entry →An agile mindset applies learning, customer value, collaboration, transparency, adaptation, and sustainable delivery as decision principles rather than as a set of ceremonies.
Read the entry →Agile product vision alignment connects daily prioritization and increment decisions to a shared purpose, target users, desired outcomes, constraints, and strategic direction.
Read the entry →Agile psychological safety is the shared confidence that people can raise concerns, admit uncertainty, ask for help, challenge assumptions, and report mistakes without retaliation or humiliation.
Read the entry →Agile retrospectives are structured learning sessions that examine how work occurred and commit to a small number of testable improvements.
Read the entry →Agile suitability assessment examines uncertainty, feedback availability, delivery constraints, stakeholder access, technical coupling, compliance, and organizational readiness before choosing an approach.
Read the entry →Agile tailoring selects and adjusts practices to fit the product, team, risk, governance, technology, and organizational environment while preserving rapid learning and value delivery.
Read the entry →Agile working agreements define how a team collaborates, makes decisions, handles interruptions, shares information, manages quality, and resolves conflict.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G1030, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing an Iranian activity cluster reported in ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S1095, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing an Android remote-access trojan derived from the AhMyth codebase.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0130, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing an Iran-linked cluster active since at least 2010 that shifted from website defacement toward malware-based espionage.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S1129, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing ransomware associated with Akira operations and reported in Windows and ESXi variants.
Read the entry →Alert actionability engineering designs alerts so a responder can understand the condition, impact, evidence, urgency, owner, and next safe step.
Read the entry →Alert classification and routing apply consistent categories, ownership rules, urgency, evidence requirements, and destination workflows so alerts reach the right responder quickly.
Read the entry →Alert engineering turns observable behavior and use cases into actionable detection logic with defined context, thresholds, evidence, owner, response path, and validation test.
Read the entry →Alert prioritization combines severity, confidence, asset importance, user context, exposure, active threat evidence, and potential business impact to order analyst attention.
Read the entry →Alert response capacity management balances incoming alert demand, analyst skill, queue health, service expectations, automation, and surge plans to keep response sustainable.
Read the entry →Alert triage is the rapid, evidence-based process of validating a security alert, estimating urgency and impact, and deciding the correct next action.
Read the entry →An algorithmic impact assessment examines purpose, affected people, benefits, harms, data, rights, alternatives, controls, and residual risk before a consequential AI use proceeds.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S1025, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a Trojan bot used to establish access and retrieve additional payloads.
Read the entry →Analytic confidence communicates how strongly evidence, source quality, consistency, and remaining gaps support an intelligence judgment.
Read the entry →Apply DE.AE-02 to achieve this CSF 2.0 outcome: Potentially adverse events are analyzed to better understand associated activities.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0504, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a backdoor family reported in operations that also used TrickBot.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0138, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a North Korean state-sponsored cluster associated with destructive and financially motivated activity, with acknowledged overlap in public naming.
Read the entry →Anonymization and de-identification reduce the ability to associate released or shared data with a specific person, while accounting for linkage and re-identification risk.
Read the entry →Anonymization aims to prevent data from being linked to an identifiable person, while pseudonymization replaces direct identifiers but retains a controlled path to re-link the data.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0062, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a September 2025 campaign in which a likely China-nexus actor manipulated Claude Code agents and MCP tools to automate portions of intrusions.
Read the entry →Antivirus, EDR, and XDR is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Use maintained antimalware capabilities to prevent, detect, quarantine, and investigate malicious code and known harmful artifacts. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0422, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing Android malware that evolved into a banking-trojan capability.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G1007, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected China-based espionage cluster reported against government, education, and telecommunications organizations in Southeast Asia and nearby regions.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S1133, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing malware reported with destructive wiper and ransomware behavior.
Read the entry →AppArmor profile enforcement confines programs with path-oriented rules that describe the files, capabilities, networking, and execution behavior each application is permitted to use.
Read the entry →AppCert DLLs (T1546.009) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →AppDomainManager (T1574.014) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →AppInit DLLs (T1546.010) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G1049, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a DPRK-linked revenue-generating cluster reported against the cryptocurrency sector and associated with the 3CX supply-chain campaign.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0584, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a family of downloaders delivered through trojanized cryptocurrency applications.
Read the entry →AppleScript (T1059.002) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Application Access Token (T1550.001) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Read the entry →Application allowlisting permits only approved executables, scripts, libraries, installers, or other code to run under defined rules.
Read the entry →Give developers actionable security requirements and patterns that reduce vulnerabilities before software reaches production. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Application Exhaustion Flood (T1499.003) is an Enterprise ATT&CK sub-technique under Endpoint Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Confine untrusted applications, content, and workloads so compromise has limited access to the host, identities, data, and adjacent services. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →An adversary uses common application protocols such as web, DNS, mail, or file transfer to carry command-and-control traffic.
Read the entry →Application security governance connects engineering work to risk ownership, secure design expectations, delivery controls, exceptions, evidence, and operational accountability.
Read the entry →Application Shimming (T1546.011) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →Application Window Discovery (T1010) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Application or System Exploitation (T1499.004) is an Enterprise ATT&CK sub-technique under Endpoint Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Apply RS.MA-05 to achieve this CSF 2.0 outcome: The criteria for initiating incident recovery are applied.
Read the entry →Approved Scanning Vendor scans provide externally performed vulnerability scanning for applicable internet-facing systems under PCI scanning rules, with defined scope, evidence, dispute, remediation, and passing criteria.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0143, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected China-based cluster with intelligence-collection and industrial-espionage missions against telecommunications, technology, and government entities.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0046, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2023–2024 campaign against networking devices in government and critical-infrastructure environments.
Read the entry →An architecture decision record captures an important design choice, its context, alternatives, rationale, consequences, and current status.
Read the entry →Architecture principles express enduring decision preferences, while guardrails define practical boundaries within which teams can design and deliver.
Read the entry →Architecture trade-off analysis compares design options across security, mission, cost, performance, usability, resilience, complexity, and lifecycle consequences.
Read the entry →Archive Collected Data (T1560) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Archive via Custom Method (T1560.003) is an Enterprise ATT&CK sub-technique under Archive Collected Data. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →Archive via Library (T1560.002) is an Enterprise ATT&CK sub-technique under Archive Collected Data. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →Archive via Utility (T1560.001) is an Enterprise ATT&CK sub-technique under Archive Collected Data. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0099, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing an operating-system utility used to display or modify the Address Resolution Protocol cache.
Read the entry →Artifact repository integrity protects packages, containers, models, and build outputs from unauthorized replacement, deletion, downgrade, or ambiguous reuse.
Read the entry →Artificial Intelligence (T1588.007) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S9031, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a modular .NET backdoor tracked in public threat reporting.
Read the entry →Apply ID.RA-10 to achieve this CSF 2.0 outcome: Critical suppliers are assessed prior to acquisition.
Read the entry →Apply ID.RA-09 to achieve this CSF 2.0 outcome: The authenticity and integrity of hardware and software are assessed prior to acquisition and use.
Read the entry →An asset inventory is an authoritative record of the hardware, software, services, cloud resources, data stores, operational technology, and other components the organization must manage and protect.
Read the entry →Asset inventory quality evaluates completeness, accuracy, freshness, ownership, classification, and reconciliation across the systems that produce inventory data.
Read the entry →Apply ID.AM-08 to achieve this CSF 2.0 outcome: Systems, hardware, software, services, and data are managed throughout their life cycles.
Read the entry →Use ID.AM to manage inventory, ownership, dependency, prioritization, data awareness, and life-cycle management within the Identify Function.
Read the entry →Apply ID.AM-05 to achieve this CSF 2.0 outcome: Assets are prioritized based on classification, criticality, resources, and impact on the mission.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0373, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a Trojan and information-stealing malware family.
Read the entry →Asymmetric Cryptography (T1573.002) is an Enterprise ATT&CK sub-technique under Encrypted Channel. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S1087, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing an open-source remote administration tool that has also been used in malicious campaigns.
Read the entry →Asynchronous Procedure Call (T1055.004) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →At (T1053.002) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.
Read the entry →An attack path is a sequence of reachable systems, identities, trust relationships, weaknesses, and actions that could let an adversary move from an initial foothold to a valuable objective.
Read the entry →Attack surface management identifies and tracks the systems, services, identities, data paths, and external dependencies that an attacker could reach or influence.
Read the entry →An attack vector is the route, method, or mechanism an adversary uses to reach a target and attempt an unauthorized action.
Read the entry →Attack-surface reduction validation confirms that patching, hardening, isolation, encryption, removal, access changes, and architectural controls actually eliminated or constrained the intended exposure.
Read the entry →Attacker communications governance defines who may communicate with an adversary, under what authority, through which channels, and with what legal, safety, and evidence controls.
Read the entry →Attribute-based access control evaluates characteristics of the subject, resource, action, and environment to make a contextual access decision.
Read the entry →Audio Capture (T1123) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Audio-Visual Content (T1683.002) is an Enterprise ATT&CK sub-technique under Generate Content. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Use independent, evidence-based assessment to determine whether security controls are designed appropriately and operating as intended. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Audit log retention and integrity controls preserve security-relevant records for operational analysis, investigations, accountability, compliance, and legal needs.
Read the entry →Audit logging architecture defines which events are produced, transported, normalized, protected, retained, correlated, analyzed, and made available for investigations and accountability.
Read the entry →Audit readiness is the ongoing ability to demonstrate control design, operation, ownership, evidence, scope, and remediation without a last-minute reconstruction effort.
Read the entry →Audit remediation management turns findings into owned, risk-informed corrective actions and verifies that the underlying condition and exposure were actually reduced.
Read the entry →Apply PR.AA-03 to achieve this CSF 2.0 outcome: Users, services, and hardware are authenticated.
Read the entry →Authentication factors are independent categories of evidence used to prove control of an identity, commonly something known, possessed, or inherent to the user.
Read the entry →Authentication Package (T1547.002) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →AAA separates three connected functions: verifying identity, deciding allowed actions, and recording activity for accountability and investigation.
Read the entry →Authenticity provides confidence that an identity, message, device, document, or software artifact is genuine and comes from the claimed source.
Read the entry →An authorization to operate is a formal decision by an authorized official to accept the risk of operating a system under stated conditions.
Read the entry →AutoHotKey & AutoIT (T1059.010) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Automated Collection (T1119) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Automated Exfiltration (T1020) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Automated remediation guardrails constrain corrective actions by confidence, impact, scope, authorization, reversibility, and evidence quality.
Read the entry →Automation blast-radius control limits the systems, accounts, data, regions, and actions a script, pipeline, agent, or remediation job can affect.
Read the entry →Automation dependency pinning fixes packages, images, modules, actions, and providers to reviewed versions or immutable digests instead of accepting unbounded future changes.
Read the entry →Automation idempotency means repeated execution against the same desired state produces the same acceptable result without accumulating unintended changes.
Read the entry →Automation input validation verifies type, format, range, origin, authorization, and business rules before data can drive scripts, APIs, templates, or infrastructure changes.
Read the entry →Automation output validation checks that generated files, API responses, model output, commands, and change plans conform to expected structure and permitted effects before downstream use.
Read the entry →Automation rollback safeguards prepare tested methods to reverse or contain changes when automated deployment, configuration, or remediation produces unacceptable results.
Read the entry →Automation secret management keeps passwords, tokens, keys, and certificates out of code and logs while delivering them only to authorized jobs at execution time.
Read the entry →Automotive cybersecurity protects vehicle electronic systems, software, communications, data, update infrastructure, service tools, manufacturing, and cloud services while preserving safety, reliability, privacy, and long product lifecycles.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S1053, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing ransomware offered through a ransomware-as-a-service model.
Read the entry →Use PR.AT to manage general awareness, role-specific knowledge, behavior, responsibilities, and task readiness within the Protect Function.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0001, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected Chinese espionage cluster reported against aerospace, defense, government, manufacturing, and media sectors.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0344, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a commercial information-stealing Trojan.
Read the entry →BGP route security applies policy, filtering, validation, monitoring, and operational discipline to reduce accidental or malicious route announcements.
Read the entry →BIOS and UEFI Security concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Read the entry →BITS Jobs (T1197) is an Enterprise ATT&CK technique associated with Stealth, Persistence, Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0190, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a legitimate Windows command-line utility for managing Background Intelligent Transfer Service jobs.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G1002, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected South Asian espionage cluster reported against government, energy, and engineering organizations.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0093, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a modular backdoor reported in operations against energy and industrial-control environments.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0135, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing an espionage cluster active since at least 2017 and reported against foreign ministries and telecommunications companies.
Read the entry →Backlog prioritization orders work using value, urgency, risk, learning, dependencies, cost of delay, capacity, and strategic commitments.
Read the entry →Backlog refinement develops shared understanding of upcoming work by clarifying value, users, scope, acceptance, dependencies, risk, and an appropriate level of detail.
Read the entry →Backup isolation and immutability reduce the chance that compromised production identities, systems, or administrators can alter or destroy recovery data.
Read the entry →Backup Software Discovery (T1518.002) is an Enterprise ATT&CK sub-technique under Software Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Read the entry →Backup and recovery strategies preserve usable copies of data and system state so services can be restored after failure, error, corruption, or attack.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0606, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing self-propagating ransomware used in disruptive incidents.
Read the entry →Bandwidth Hijacking (T1496.002) is an Enterprise ATT&CK sub-technique under Resource Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Bare-metal provisioning security protects installation media, firmware settings, deployment networks, bootstrap credentials, hardware identity, and the first configuration applied to a physical server.
Read the entry →Bastion-host architecture creates a controlled administrative entry point with hardened access, strong identity, session oversight, and limited paths to protected systems.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S1246, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing JavaScript and C++ malware reported in credential theft and downloader activity.
Read the entry →Prevent high-risk endpoint behavior by evaluating process, script, memory, file, and system activity rather than relying only on known signatures. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Benefits realization governs whether technology and security investments produce the intended measurable outcomes after delivery.
Read the entry →Bidirectional Communication (T1102.002) is an Enterprise ATT&CK sub-technique under Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Binary Padding (T1027.001) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Bind Mounts (T1564.013) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →BitLocker is a Windows full-volume encryption capability that protects data at rest by binding volume keys to trusted startup conditions, recovery methods, and optional user authentication.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S1070, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing ransomware associated with ransomware-as-a-service operations and Windows or ESXi targets.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G1043, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a ransomware activity cluster operating since at least 2021 and associated with multiple BlackByte ransomware versions.
Read the entry →Blameless root-cause analysis examines technical and organizational conditions that made an incident possible without substituting individual blame for system improvement.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0521, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a tool that maps Active Directory relationships and attack paths for administration, assessment, or adversary use.
Read the entry →Protect the chain of trust from firmware through operating-system startup so unauthorized boot components are blocked or exposed. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →An adversary changes startup or sign-in mechanisms so code runs automatically during system boot or user logon.
Read the entry →Boot or Logon Initialization Scripts (T1037) is an Enterprise ATT&CK technique associated with Persistence, Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Bootkit (T1542.003) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.
Read the entry →Bootkits describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Read the entry →Botnet (T1583.005) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Botnet (T1584.005) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Branch protection governance enforces review, status checks, signed or attributable changes, restricted force operations, and controlled exceptions on important source branches.
Read the entry →Break Process Trees (T1036.009) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Broken Object-Level Authorization is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →Browser Extensions (T1176.001) is an Enterprise ATT&CK sub-technique under Software Extensions. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →Browser Fingerprint (T1036.012) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Browser Information Discovery (T1217) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Browser Session Hijacking (T1185) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →An adversary repeatedly attempts passwords, keys, or authentication combinations, including guessing, spraying, cracking, and credential stuffing.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S1063, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a commercial adversary-simulation platform that has also been abused in real intrusions.
Read the entry →Build Image on Host (T1612) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Build provenance attestation is verifiable metadata describing what produced an artifact, from which inputs, under what process, and in which build environment.
Read the entry →Business continuity and recovery prepare an organization to maintain essential functions, operate through disruption, and restore dependable services at an acceptable level.
Read the entry →Business environment change response evaluates external and internal shifts that may alter project scope, assumptions, priorities, viability, compliance, or expected value.
Read the entry →A business impact analysis identifies essential activities, dependencies, outage consequences, and recovery priorities so continuity and disaster-recovery plans reflect business needs.
Read the entry →Business Relationships (T1591.002) is an Enterprise ATT&CK sub-technique under Gather Victim Org Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Bypass User Account Control (T1548.002) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.
Read the entry →Apply GV.SC-01 to achieve this CSF 2.0 outcome: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0010, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed cyber-espionage campaign reported against Israeli shipping, government, aviation, energy, and healthcare organizations.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0011, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed suspected espionage campaign reported against university and college students in India.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0015, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed five-day ransomware intrusion involving Bazar, Cobalt Strike, Conti, and other tools.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0017, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed APT41 campaign that compromised multiple United States state-government networks in 2021–2022.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0018, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed month-long intrusion that culminated in AvosLocker ransomware deployment.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0021, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed November 2018 spearphishing campaign against public, nonprofit, educational, and private-sector organizations.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0026, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed 2022 campaign that selectively delivered malware to prior ANDROMEDA victims in Ukraine.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0027, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed financially motivated 2022 campaign linked to Scattered Spider and focused on telecommunications and business-process outsourcing companies.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0032, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed 2019 campaign associated in public reporting with the Triton adversaries and focused on footholds in IT environments.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0033, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an unnamed PROMETHIUM campaign that used StrongPity against Android users.
Read the entry →CDNs (T1596.004) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →CI/CD pipeline security protects source, build services, runners, credentials, dependencies, artifacts, approvals, and deployment paths used to deliver software.
Read the entry →The CIA triad is a foundational model for describing what security is trying to preserve: authorized access, trustworthy information, and dependable service.
Read the entry →CIS Controls crosswalks map safeguards to requirements or outcomes in other frameworks so organizations can reuse evidence and understand overlapping intent.
Read the entry →CIS Controls Implementation Groups organize safeguards into prioritized sets that reflect organizational resources, complexity, data sensitivity, and threat exposure.
Read the entry →The CIS Controls provide a prioritized set of safeguards that organizations can use to improve defensive capability and reduce common attack paths.
Read the entry →CIS Safeguards are specific, actionable practices organized under the CIS Critical Security Controls and prioritized through Implementation Groups.
Read the entry →CMSTP (T1218.003) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →COR_PROFILER (T1574.012) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →CVE identifies publicly disclosed vulnerabilities, CWE describes classes of weakness, CVSS expresses technical severity, and EPSS estimates the probability of near-term exploitation.
Read the entry →Cached Domain Credentials (T1003.005) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0693, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a destructive data-wiping payload reported in attacks against Ukrainian organizations.
Read the entry →The cardholder data environment includes the people, processes, and technologies that store, process, or transmit cardholder data or sensitive authentication data, together with connected or security-impacting components in scope.
Read the entry →Apply RS.MA-03 to achieve this CSF 2.0 outcome: Incidents are categorized and prioritized.
Read the entry →Causal inference asks whether an intervention changed an outcome rather than merely identifying correlation.
Read the entry →Ccache Files (T1558.005) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Certificate Chain Validation is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.
Read the entry →Certificate Revocation Lists and OCSP is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.
Read the entry →Certificate Signing Requests is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.
Read the entry →Certificate transparency analysis examines publicly logged certificate issuance to discover domains, subdomains, infrastructure relationships, and changes over time.
Read the entry →Change automation evidence records what an automated change intended, who authorized it, what code and inputs ran, which targets changed, and whether outcomes matched the plan.
Read the entry →Change Default File Association (T1546.001) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →Change enablement maximizes successful changes by assessing risk, authorizing work, coordinating schedules, preserving evidence, and learning from results without imposing unnecessary friction.
Read the entry →Chat Messages (T1552.008) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Clear Command History (T1070.003) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Clear Linux or Mac System Logs (T1685.006) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Clear Mailbox Data (T1070.008) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Clear Network Connection History and Configurations (T1070.007) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Clear Persistence (T1070.009) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Clear Windows Event Logs (T1685.005) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →ClickOnce (T1127.002) is an Enterprise ATT&CK sub-technique under Trusted Developer Utilities Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →Clickjacking overlays or frames a legitimate interface so a user’s visible click lands on a hidden or disguised control, causing an unintended action in the user’s authenticated session.
Read the entry →Client Configurations (T1592.004) is an Enterprise ATT&CK sub-technique under Gather Victim Host Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →An adversary reads clipboard contents to collect copied credentials, commands, documents, or other data exchanged through the user interface.
Read the entry →Cloud AI services governance controls how managed machine-learning, generative AI, language, vision, and decision services are selected, configured, and used.
Read the entry →Cloud API (T1059.009) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Cloud API management publishes, secures, observes, versions, and governs interfaces used by applications, partners, and services.
Read the entry →Cloud Account (T1087.004) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Read the entry →Cloud Account (T1136.003) is an Enterprise ATT&CK sub-technique under Create Account. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →Cloud account and resource hierarchies organize tenants, organizations, accounts, subscriptions, projects, folders, resource groups, and resources into manageable administrative boundaries.
Read the entry →Cloud Accounts (T1078.004) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.
Read the entry →Cloud Accounts (T1585.003) is an Enterprise ATT&CK sub-technique under Establish Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Cloud Accounts (T1586.003) is an Enterprise ATT&CK sub-technique under Compromise Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Cloud Administration Command (T1651) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Cloud adoption frameworks organize the strategy, people, governance, platform, security, migration, and operations work required to adopt cloud services deliberately.
Read the entry →Cloud Application Integration (T1671) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Cloud audit evidence demonstrates how cloud controls are designed and operating through configuration, logs, assessments, access reviews, provider reports, tickets, approvals, and automated test results.
Read the entry →Cloud automation performs repeatable tasks through code and APIs, while orchestration coordinates multiple automated steps into a controlled workflow.
Read the entry →Cloud backup and recovery preserve restorable copies of data, configuration, and system state so services can recover after error, attack, corruption, or loss.
Read the entry →Break-glass access provides a tightly controlled emergency path when normal identity, federation, or administrative mechanisms are unavailable.
Read the entry →Cloud budgets and cost allocation connect consumption to accountable teams, products, environments, and business purposes.
Read the entry →Cloud compliance and assurance map obligations to provider, customer, and shared controls and collect evidence that those controls are designed and operating effectively.
Read the entry →Cloud computing delivers configurable computing resources as on-demand services over a network, with rapid provisioning, measured use, and shared provider infrastructure.
Read the entry →Cloud configuration drift occurs when deployed resources no longer match approved definitions, baselines, or intended architecture.
Read the entry →Cloud container security protects images, registries, orchestrators, nodes, runtime configuration, network policy, secrets, identities, and workloads throughout the container lifecycle.
Read the entry →The cloud control plane contains the APIs, consoles, identities, and orchestration functions used to create and change cloud resources.
Read the entry →Cloud control-plane logging records administrative and API actions that create, change, or delete cloud resources and policies.
Read the entry →Cloud cost anomaly detection identifies unexpected changes in spend or usage that may indicate waste, configuration errors, abuse, compromise, or legitimate demand changes.
Read the entry →Cloud cost management plans, allocates, monitors, and optimizes consumption-based technology spending while preserving required performance, security, and resilience.
Read the entry →Cloud cost optimization continually aligns resource configuration, purchasing choices, architecture, and usage with the value a workload delivers.
Read the entry →Cloud credential exposure paths include source code, build systems, images, logs, metadata services, environment variables, local files, browser sessions, and overprivileged automation.
Read the entry →Cloud distributed-denial-of-service protection combines provider-scale network defenses, traffic filtering, rate controls, resilient architecture, and response procedures.
Read the entry →Cloud data classification and discovery identify where sensitive or regulated information exists and apply handling rules according to value, harm, and obligation.
Read the entry →Cloud data governance assigns ownership and rules for classification, access, quality, lineage, retention, location, sharing, and disposal across cloud data services.
Read the entry →Cloud analytics platforms combine object storage, warehouses, catalogs, transformation services, and query engines to process data at scale.
Read the entry →Data residency concerns where data is stored or processed, while data sovereignty concerns the legal authority that may apply to that data and its providers.
Read the entry →Cloud data-access logging records reads, writes, deletes, queries, exports, and sharing actions involving stored or managed data.
Read the entry →Cloud data-plane security protects the operations that read, write, process, transmit, and delete workload and business data after cloud resources have been configured.
Read the entry →Cloud database security protects managed and self-managed data stores through identity, network access, encryption, configuration, auditing, backup, patching, and data governance.
Read the entry →Cloud database services provide relational, key-value, document, graph, cache, and other data models with varying levels of provider management.
Read the entry →Cloud deployment models describe how cloud infrastructure is owned, shared, located, and connected across public, private, community, and hybrid environments.
Read the entry →Cloud economics links metered consumption, pricing models, operating flexibility, and business value to technology decisions.
Read the entry →Cloud edge computing places processing, caching, networking, or service delivery closer to users, devices, or data sources than a central cloud region.
Read the entry →Cloud edge services place content, acceleration, routing, filtering, or application functions closer to users and devices.
Read the entry →Cloud egress control limits and monitors outbound communication from workloads, users, and services to reduce exfiltration, command-and-control, and unauthorized dependency risk.
Read the entry →Scalability is the ability to support increased demand by adding capacity, while elasticity is the ability to adjust that capacity quickly as demand changes.
Read the entry →Cloud exit planning defines how an organization can move, replace, or retire cloud services while preserving data, evidence, continuity, security, and legal obligations.
Read the entry →Cloud fault tolerance enables a system to continue performing required functions when components or dependencies fail.
Read the entry →Cloud Firewall (T1686.001) is an Enterprise ATT&CK sub-technique under Disable or Modify System Firewall. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Cloud forensics collects and analyzes provider logs, snapshots, object versions, identity records, network evidence, and service metadata for investigation.
Read the entry →Cloud governance establishes decision rights, policies, ownership, guardrails, evidence, and review processes for using cloud services in line with business and risk objectives.
Read the entry →Cloud tags, policies, and locks organize resources, enforce requirements, assign ownership, and prevent unauthorized or accidental change.
Read the entry →Cloud Groups (T1069.003) is an Enterprise ATT&CK sub-technique under Permission Groups Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Read the entry →Cloud guardrails are centrally defined controls that prevent, constrain, detect, or remediate unsafe configurations while allowing teams to work within approved boundaries.
Read the entry →Cloud high availability uses redundant components, failure isolation, health detection, and automated recovery to keep a service accessible despite expected faults.
Read the entry →Hybrid connectivity joins cloud environments with data centers, offices, edge locations, or other providers through VPNs, dedicated links, and routing services.
Read the entry →Cloud IAM policy analysis evaluates effective permissions, conditions, inheritance, wildcard use, trust relationships, resource scope, and paths to privilege escalation.
Read the entry →Cloud identity boundary validation tests whether accounts, subscriptions, projects, tenants, organizations, roles, and trust relationships enforce the intended separation of duties and blast radius.
Read the entry →Cloud identity federation allows an external identity provider to authenticate users or workloads and provide trusted assertions or tokens to cloud services.
Read the entry →Cloud identity and access management governs human and workload access to provider consoles, APIs, resources, data, secrets, and administrative functions.
Read the entry →Cloud image security protects virtual-machine and container images from vulnerable packages, malware, embedded secrets, untrusted changes, and unauthorized distribution.
Read the entry →Cloud incident response adapts preparation, detection, containment, eradication, and recovery to provider APIs, elastic resources, managed services, and shared responsibility.
Read the entry →Cloud Infrastructure Discovery (T1580) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Cloud Instance Metadata API (T1552.005) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Cloud instance metadata security protects workload identity and configuration services that can expose temporary credentials or sensitive context to code running on a compute resource.
Read the entry →Cloud interconnect security protects dedicated and virtual connectivity between enterprise networks, cloud providers, exchanges, and software-defined interconnection services.
Read the entry →Cloud key management governs the creation, storage, protection, use, rotation, recovery, and destruction of cryptographic keys used by cloud services and workloads.
Read the entry →Cloud key-use governance defines who and what may use encryption keys, for which operations, under what conditions, with what logging, and through which approval and recovery processes.
Read the entry →A cloud landing zone is a governed foundation for accounts or subscriptions, identity, networking, logging, policy, security services, and workload onboarding.
Read the entry →Cloud load balancing distributes traffic across healthy service instances, while auto scaling adjusts capacity according to demand, schedules, or operational signals.
Read the entry →Cloud forensic readiness ensures that logs, snapshots, metadata, identities, timestamps, and response procedures are available before an incident requires them.
Read the entry →Cloud logging and monitoring collect, protect, correlate, and analyze events from identities, control planes, networks, workloads, applications, data services, and security tools.
Read the entry →Cloud migration strategies define how an application, platform, or data set will move from its current environment into a cloud service or a new cloud operating model.
Read the entry →Cloud misconfiguration is an unsafe setting in identity, networking, storage, logging, encryption, compute, data, or organizational policy that creates unintended exposure or weakens control.
Read the entry →A cloud multi-account strategy separates workloads, environments, teams, and control functions into distinct accounts, subscriptions, or projects with centralized governance.
Read the entry →Cloud network flow logs record summarized connection metadata from virtual networks, interfaces, gateways, and security controls for monitoring, troubleshooting, and investigation.
Read the entry →Cloud network segmentation separates workloads and services into controlled communication zones to limit exposure and lateral movement.
Read the entry →Cloud networking connects workloads, services, users, data centers, and the internet through software-defined networks, routes, gateways, load balancers, name services, and provider backbones.
Read the entry →Virtual private clouds and virtual networks create logically isolated address spaces, subnets, routes, interfaces, and gateways inside cloud environments.
Read the entry →Cloud object storage security protects buckets, containers, objects, metadata, access policies, sharing links, encryption, versioning, and lifecycle settings.
Read the entry →Cloud observability uses logs, metrics, traces, events, and context to understand system behavior and investigate unexpected conditions.
Read the entry →A cloud operating model defines how teams make decisions, provide platforms, govern risk, manage cost, operate services, and improve capabilities in a cloud environment.
Read the entry →Cloud operational excellence uses automation, observability, controlled change, learning, and repeatable procedures to operate workloads safely at scale.
Read the entry →Cloud pricing models charge for measured consumption and may offer on-demand, committed-use, reserved-capacity, spot, subscription, license-included, or dedicated options.
Read the entry →Cloud private connectivity creates controlled paths between users, data centers, cloud networks, and managed services without exposing traffic directly through public endpoints.
Read the entry →Cloud privileged access governs identities and sessions capable of changing high-impact cloud configuration, identity, logging, networking, data protection, or organizational policy.
Read the entry →Cloud regions and availability zones divide provider infrastructure into geographic and failure-isolated locations for deployment, resilience, latency, and data-governance decisions.
Read the entry →Cloud reliability engineering identifies failure modes and distributes components across independent fault domains so services can continue or recover within defined objectives.
Read the entry →Cloud resilience is the ability to prepare for, withstand, recover from, and adapt to disruption while preserving important services and acceptable outcomes.
Read the entry →Cloud secrets management protects passwords, API keys, tokens, certificates, and other sensitive values needed by applications and automation.
Read the entry →Cloud Secrets Management Stores (T1555.006) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Security groups, firewall rules, and network access-control lists restrict traffic at resource, subnet, or network boundaries.
Read the entry →Cloud security posture management continuously evaluates cloud resources and configurations against security baselines, architecture rules, and compliance requirements.
Read the entry →Cloud Service Dashboard (T1538) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Cloud Service Discovery (T1526) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Cloud Service Hijacking (T1496.004) is an Enterprise ATT&CK sub-technique under Resource Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Cloud service quotas limit the number, rate, size, or regional availability of resources and API operations.
Read the entry →Cloud service models describe which layers a provider manages, while deployment models describe how cloud resources are owned, shared, and connected.
Read the entry →A cloud service-level agreement defines provider commitments and remedies for specified aspects of service availability or performance.
Read the entry →Service-level objectives define measurable reliability targets for a service, such as availability, latency, durability, or successful request rate.
Read the entry →Cloud Services (T1021.007) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Read the entry →Cloud session and token security governs issuance, scope, lifetime, storage, revocation, audience, refresh, and monitoring for interactive and workload access.
Read the entry →Shared responsibility explains how cloud providers and customers divide security duties, while the customer remains accountable for understanding and operating its part of the service.
Read the entry →Cloud storage classes balance availability, access speed, durability, retrieval delay, and price for different patterns of data use.
Read the entry →Cloud storage exfiltration detection looks for unusual reads, downloads, copies, sharing changes, presigned access, cross-account movement, and data-transfer patterns.
Read the entry →Cloud storage lifecycle and versioning manage how data copies are created, retained, transitioned, archived, recovered, and deleted over time.
Read the entry →Cloud storage commonly uses object, block, and file models, each with different access patterns, performance characteristics, durability options, and security controls.
Read the entry →Cloud Storage Object Discovery (T1619) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Streaming data pipelines ingest and process events continuously for analytics, monitoring, automation, and application integration.
Read the entry →Cloud subnets divide address space, route tables determine forwarding, and gateways connect workloads to other networks or provider services.
Read the entry →Cloud sustainability considers the environmental effects of computing demand, resource efficiency, hardware utilization, data movement, software design, and service location.
Read the entry →Cloud tags, labels, accounts, subscriptions, and projects provide metadata that supports ownership, policy, inventory, automation, and cost allocation.
Read the entry →Cloud threat detection identifies suspicious behavior across identities, control planes, workloads, networks, storage, and managed services.
Read the entry →Cloud threat-informed defense prioritizes controls and detections according to the ways adversaries actually abuse cloud identities, APIs, services, configurations, and data paths.
Read the entry →Cloud vulnerability management identifies, prioritizes, and reduces exploitable weaknesses across images, hosts, containers, functions, applications, libraries, services, and configuration.
Read the entry →Cloud well-architected frameworks provide structured principles and review questions for evaluating reliability, security, operations, performance, cost, and sustainability decisions.
Read the entry →Cloud workload identities let applications, services, virtual machines, containers, and automation authenticate without sharing human accounts or embedding permanent secrets.
Read the entry →Cloud workload protection applies preventive and detective controls to virtual machines, containers, serverless functions, and managed compute environments.
Read the entry →Code Repositories (T1213.003) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →Code Repositories (T1593.003) is an Enterprise ATT&CK sub-technique under Search Open Websites/Domains. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Use cryptographic signatures and trusted publishing processes to verify software origin and integrity before execution or deployment. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Code Signing (T1553.002) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Code Signing Certificates (T1587.002) is an Enterprise ATT&CK sub-technique under Develop Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Code Signing Certificates (T1588.003) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Code Signing Policy Modification (T1553.006) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Cognitive bias can distort how analysts search for, interpret, remember, and communicate evidence about adversaries and campaigns.
Read the entry →Collaborate and promote visibility means involving the right contributors and making work, constraints, risks, decisions, and results understandable to the people who depend on them.
Read the entry →Adversaries gather, stage, capture, or aggregate information of interest before using or removing it.
Read the entry →Command injection occurs when untrusted data is incorporated into an operating-system command or shell expression and changes the command’s intended structure, arguments, control flow, or executed program.
Read the entry →Command Obfuscation (T1027.010) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Command and Control Channels is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Command and control detection identifies the channels, timing patterns, protocol misuse, infrastructure, and host behavior used to direct compromised systems.
Read the entry →Adversaries communicate with compromised resources to issue instructions, receive results, transfer tools, or maintain operational control.
Read the entry →An adversary uses a shell, command interpreter, scripting language, or administrative console to execute instructions and automate activity.
Read the entry →Common controls support multiple systems, inherited controls are received from another provider or environment, and system-specific controls are implemented for one system.
Read the entry →Apply RC.CO-03 to achieve this CSF 2.0 outcome: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders.
Read the entry →Communicating cyber risk in business terms connects plausible scenarios, affected outcomes, uncertainty, options, cost, and decision deadlines without stripping away material technical truth.
Read the entry →Communication Through Removable Media (T1092) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Community-sourced detection content includes shared rules, signatures, queries, mappings, and playbooks that can accelerate coverage when teams validate and adapt them to local data and risk.
Read the entry →A compensating control is an alternate safeguard used when the prescribed control cannot be implemented, while still addressing the original security or privacy objective.
Read the entry →Compile After Delivery (T1027.004) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Compiled HTML File (T1218.001) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Complete mediation requires every security-relevant access request to be checked against current authorization rules rather than relying indefinitely on an earlier decision.
Read the entry →Compliance evidence and artifacts show how a requirement is implemented and whether the related control operates effectively.
Read the entry →A compliance exception or risk waiver documents an authorized, time-bound decision to deviate from a requirement while the resulting exposure, compensating measures, owner, and remediation plan remain visible.
Read the entry →Component Firmware (T1542.002) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.
Read the entry →Component Object Model (T1559.001) is an Enterprise ATT&CK sub-technique under Inter-Process Communication. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Component Object Model Hijacking (T1546.015) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →Compression (T1027.015) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Compromise Accounts (T1586) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Compromise Hardware Supply Chain (T1195.003) is an Enterprise ATT&CK sub-technique under Supply Chain Compromise. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
Read the entry →Compromise Host Software Binary (T1554) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Compromise Infrastructure (T1584) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Compromise Software Dependencies and Development Tools (T1195.001) is an Enterprise ATT&CK sub-technique under Supply Chain Compromise. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
Read the entry →Compromise Software Supply Chain (T1195.002) is an Enterprise ATT&CK sub-technique under Supply Chain Compromise. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
Read the entry →Compute Hijacking (T1496.001) is an Enterprise ATT&CK sub-technique under Resource Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Computer vision systems extract patterns from images or video to classify, detect, segment, track, or generate visual content.
Read the entry →Conditional Access Policies (T1556.009) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Read the entry →Conditional access for hybrid networks combines identity, device, location, risk, application, and session context to make dynamic access decisions across cloud and on-premises resources.
Read the entry →Configuration baseline enforcement ensures systems remain within approved security and operational settings or have documented, time-bounded exceptions.
Read the entry →Configuration compliance validation compares live settings against approved baselines and verifies that findings are corrected or explicitly accepted.
Read the entry →Configuration drift remediation detects differences from approved baselines, determines cause and risk, and restores or formally accepts the intended state.
Read the entry →Apply PR.PS-01 to achieve this CSF 2.0 outcome: Configuration management practices are established and applied.
Read the entry →Confluence (T1213.001) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →Consent management records, enforces, and updates a person's choices about defined data uses where consent is the appropriate basis or control.
Read the entry →Consent withdrawal and preference operations propagate a person’s choice across interfaces, profiles, downstream systems, vendors, and future processing.
Read the entry →Apply RS.MI-01 to achieve this CSF 2.0 outcome: Incidents are contained.
Read the entry →Container API (T1552.007) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Container Administration Command (T1609) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Container CLI/API (T1059.013) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Container network security controls service exposure, east-west communication, port publishing, name resolution, administrative planes, and traffic policy across container hosts and clusters.
Read the entry →Container Orchestration Job (T1053.007) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.
Read the entry →Container image security protects the build, storage, distribution, approval, and use of container images.
Read the entry →Container runtime isolation constrains containers through namespaces, cgroups, capabilities, syscall controls, user separation, and hardened runtime configuration rather than assuming an image boundary is sufficient.
Read the entry →Container Runtime Security is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Container Service (T1543.005) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Container volume security protects persistent and host-mounted data by controlling ownership, labels, mount modes, secret placement, backup behavior, and the host paths a workload may reach.
Read the entry →Container and Resource Discovery (T1613) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Content Injection (T1659) is an Enterprise ATT&CK technique associated with Initial Access, Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Content Security Policy is an HTTP response policy that tells supporting browsers which sources and execution patterns are permitted for scripts, styles, images, frames, connections, and other resources, reducing the impact of many content-injection flaws.
Read the entry →Contingency actions are prepared for defined triggers, fallback actions are alternatives when the primary response fails, and reserves provide time or money for recognized uncertainty.
Read the entry →Continuous asset discovery uses multiple authoritative and observed sources to identify devices, cloud resources, virtual systems, and other enterprise assets as they appear and change.
Read the entry →Continuous control monitoring uses defined data, tests, and review cycles to identify changes in control condition and risk between formal assessments.
Read the entry →Use DE.CM to manage monitoring networks, facilities, personnel activity, external services, platforms, and runtime environments within the Detect Function.
Read the entry →A control baseline is a starting set of safeguards selected for a defined impact or risk context; tailoring adjusts that set to the system, organization, threats, and applicable requirements.
Read the entry →Control design asks whether a control is capable of addressing the intended risk, while operating effectiveness asks whether it works consistently in the real environment.
Read the entry →Control implementation evidence demonstrates that a control is designed, configured, operated, monitored, and corrected as claimed within a defined scope and time period.
Read the entry →A control objective states the security or risk outcome a control or group of controls is intended to achieve, providing a basis for design, implementation, and assessment.
Read the entry →Control Panel (T1218.002) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Controlled system reentry restores cleaned or rebuilt assets to production in stages, with validation, monitoring, rollback criteria, and explicit acceptance of remaining risk.
Read the entry →Cookies are browser-managed name-value records scoped by domain, path, security attributes, and lifetime; web applications often use them to carry a session identifier that binds requests to server-side authentication and authorization state.
Read the entry →Apply DE.AE-03 to achieve this CSF 2.0 outcome: Information is correlated from multiple sources.
Read the entry →Cost baseline and forecasting combine approved funding, time-phased planned expenditure, actual cost, commitments, remaining estimates, and uncertainty into a current financial view.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0004, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a suspected hacker-for-hire espionage campaign reported across multiple industries and regions.
Read the entry →An adversary creates a local, domain, cloud, service, or application account that can be used for continued access.
Read the entry →Create Cloud Instance (T1578.002) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Create Process with Token (T1134.002) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →Create Snapshot (T1578.001) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Create or Modify System Process (T1543) is an Enterprise ATT&CK technique associated with Persistence, Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Apply PR.DS-11 to achieve this CSF 2.0 outcome: Backups of data are created, protected, maintained, and tested.
Read the entry →Credential API Hooking (T1056.004) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
Read the entry →Credential access includes techniques used to obtain passwords, hashes, tokens, keys, tickets, cookies, or other material that can authenticate an identity.
Read the entry →Reduce credential theft by limiting where secrets exist, how they are stored, and which processes or administrators can retrieve them. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Adversaries obtain passwords, hashes, tokens, tickets, keys, cookies, or other secrets that can be used to authenticate or impersonate an identity.
Read the entry →Credential attack incident response addresses password spraying, stuffing, brute force, phishing, token theft, session hijacking, and unauthorized account use.
Read the entry →Credential Stuffing is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →Credential Stuffing (T1110.004) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Credentials (T1589.001) is an Enterprise ATT&CK sub-technique under Gather Victim Identity Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Credentials In Files (T1552.001) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →An adversary extracts credentials, keys, cookies, or tokens from browsers, password managers, operating-system stores, or application repositories.
Read the entry →Credentials from Web Browsers (T1555.003) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Credentials in Registry (T1552.002) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Critical business process mapping connects products and services to people, technology, data, facilities, suppliers, timing needs, and failure consequences.
Read the entry →Cron (T1053.003) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.
Read the entry →A cross-border data-flow inventory identifies where personal data originates, transits, is accessed, is stored, and is supported across jurisdictions and legal entities.
Read the entry →Cross-functional security negotiation searches for workable agreements across risk, delivery, cost, authority, and timing while protecting non-negotiable security outcomes.
Read the entry →Cross-jurisdiction compliance analysis identifies where legal, regulatory, contractual, data-transfer, reporting, retention, and access obligations conflict or overlap across locations.
Read the entry →Cross-Site Request Forgery is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Read the entry →Cross-Site Scripting is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Read the entry →Cryptographic agility is the ability to inventory, evaluate, replace, and validate cryptographic mechanisms without emergency redesign of every dependent system.
Read the entry →Cryptographic architecture defines where and why cryptography is used, how keys and trust anchors are managed, and how algorithms and implementations change over time.
Read the entry →Cryptographic Hash Functions is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.
Read the entry →Cryptographic key management governs key generation, registration, distribution, storage, use, rotation, backup, recovery, revocation, archival, and destruction.
Read the entry →Customer Relationship Management Software (T1213.004) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0029, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a China-nexus espionage campaign that exploited Ivanti Connect Secure zero-day vulnerabilities beginning in late 2023.
Read the entry →Campaign analysis groups related activity across time, targets, infrastructure, malware, techniques, and objectives to understand an adversary operation as a coherent whole.
Read the entry →Cyber crisis communications coordinates timely, accurate, authorized messages for employees, customers, partners, regulators, media, and other stakeholders.
Read the entry →Cyber incident exercises use discussion or simulated operations to test plans, decisions, coordination, communications, and recovery under realistic conditions.
Read the entry →Cyber incident reporting documents what occurred, impact, scope, actions, evidence, decisions, recovery status, and remaining risk for the intended audience.
Read the entry →Cyber Kill Chain analysis organizes adversary activity into stages so defenders can identify opportunities to disrupt an operation before its objective is achieved.
Read the entry →Cyber threat attribution assesses who is responsible for activity at a stated level of confidence using technical, behavioral, contextual, and sometimes nontechnical evidence.
Read the entry →Cyber threat information sharing exchanges relevant observations, indicators, techniques, judgments, and defensive guidance under agreed trust and handling rules.
Read the entry →Cyber threat intelligence is analyzed information about adversaries, capabilities, infrastructure, intent, and activity that supports a specific decision.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G1027, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected Iranian IRGC-affiliated cluster reported in PLC and HMI targeting and device-interface defacement.
Read the entry →A cybersecurity after-action review compares intended and actual response, identifies strengths and gaps, and converts lessons into owned improvements.
Read the entry →Cybersecurity professional ethics applies duty, honesty, proportionality, competence, confidentiality, and public-interest judgment to security decisions where rules alone do not settle the answer.
Read the entry →Apply GV.RM-05 to achieve this CSF 2.0 outcome: Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties.
Read the entry →Cybersecurity risk management connects assets, threats, vulnerabilities, controls, consequences, uncertainty, priorities, and accountable decisions.
Read the entry →A cybersecurity roadmap sequences capabilities, investments, dependencies, milestones, and decisions needed to move from the current security posture toward a defined target state.
Read the entry →Use GV.SC to manage supplier criticality, requirements, due diligence, monitoring, incident coordination, and life-cycle risk within the Govern Function.
Read the entry →Cybersecurity and information security overlap substantially, but information security centers on protecting information while cybersecurity emphasizes risks arising from connected digital systems and cyberspace.
Read the entry →Apply GV.RM-03 to achieve this CSF 2.0 outcome: Cybersecurity risk management activities and outcomes are included in enterprise risk management processes.
Read the entry →Apply GV.RR-04 to achieve this CSF 2.0 outcome: Cybersecurity is included in human resources practices.
Read the entry →DCSync is an abuse of Active Directory replication rights in which an attacker makes a system act like a domain controller and requests password-derived credential data through normal directory replication protocols.
Read the entry →DCSync (T1003.006) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →DHCP Security describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Read the entry →DHCP Spoofing (T1557.003) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
Read the entry →DHCP automates network configuration for clients, while IP address management tracks address plans, allocations, reservations, and ownership.
Read the entry →DLL (T1574.001) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →DNS (T1071.004) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →DNS (T1590.002) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →DNS Calculation (T1568.003) is an Enterprise ATT&CK sub-technique under Dynamic Resolution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →DNS encryption and resolution security protect name-resolution traffic and resolver behavior while preserving authentication, policy, observability, and operational reliability.
Read the entry →DNS Resolution Process describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Read the entry →Domain Name System security protects the naming process that maps human-readable names to network information and directs clients toward services.
Read the entry →DNS Security Extensions (DNSSEC) describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Read the entry →DNS Server (T1583.002) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →DNS Server (T1584.002) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →DNS maps names to network resources, while DHCP supplies devices with addressing and configuration information needed to participate on a network.
Read the entry →DNS/Passive DNS (T1596.001) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G1034, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a PRC-linked advanced persistent threat cluster reported against individuals, governments, NGOs, and telecommunications companies.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0070, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing an activity cluster attributed in public reporting to the Lebanese General Directorate of General Security and active since at least 2012.
Read the entry →A dark pattern review tests whether interface structure, language, defaults, repetition, friction, or visual emphasis steers people away from a free and informed privacy choice.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0079, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a cluster reported against government agencies and educational institutions in the Middle East using open-source tools and custom payloads.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0105, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a financially motivated cluster reported against financial institutions in Eastern Europe.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0012, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected South Korean cluster reported in East Asian espionage operations involving hotel networks, spearphishing, and file-sharing networks.
Read the entry →Maintain recoverable copies of critical data and configurations that remain available after deletion, corruption, ransomware, or operational failure. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Data classification assigns meaningful categories to information so protection, access, retention, sharing, monitoring, and disposal can be aligned with risk.
Read the entry →Data Destruction (T1485) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Data dictionaries and metadata describe fields, formats, meanings, allowed values, ownership, sensitivity, and relationships so data can be interpreted consistently.
Read the entry →Data Encoding (T1132) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →An adversary encrypts files, databases, virtual machines, or other information to disrupt availability and pressure the victim.
Read the entry →Data exfiltration detection looks for unauthorized movement of information through network, cloud, endpoint, application, and removable-media paths.
Read the entry →Privacy data-flow mapping traces personal data from collection through transformation, use, storage, disclosure, archival, and deletion across trust and jurisdictional boundaries.
Read the entry →A data inventory identifies important data assets, while data mapping shows where data comes from, how it moves, who uses it, where it is stored, and where it leaves the organization.
Read the entry →Data-labeling quality and ground-truth governance define how labels are created, reviewed, reconciled, versioned, and interpreted for analytics and machine learning.
Read the entry →Data labeling and security tags attach machine-usable and human-readable handling context to information so access, movement, retention, and monitoring controls can act consistently.
Read the entry →Data lakehouse security applies consistent identity, governance, classification, encryption, isolation, and audit controls across open files, metadata catalogs, compute engines, and analytic tables.
Read the entry →The data lifecycle follows information through creation or collection, use, sharing, storage, archival, retention, and secure disposal.
Read the entry →Data lineage records how information moves from origin to destination, including transformations, joins, systems, owners, and reporting products.
Read the entry →Data loss prevention identifies and controls sensitive information as it moves through endpoints, networks, applications, cloud services, and storage locations.
Read the entry →Identify and constrain unauthorized movement, disclosure, or handling of sensitive information across endpoints, networks, applications, and cloud services. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Data Manipulation (T1565) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Data masking and tokenization replace or transform sensitive values so systems and users can work with lower-exposure representations.
Read the entry →Data migration integrity verifies that transferred files, databases, metadata, permissions, ownership, timestamps, and records remain complete, accurate, authorized, and recoverable across platforms.
Read the entry →Data minimization limits collection, use, sharing, precision, and retention to what is necessary for a defined and legitimate purpose.
Read the entry →Data Obfuscation (T1001) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Data ownership assigns accountability for decisions about a data domain, while stewardship performs or coordinates the day-to-day practices that maintain quality, protection, access, and lifecycle rules.
Read the entry →Data pipeline security protects the identities, code, connectors, queues, transformations, storage locations, and orchestration used to move data between systems.
Read the entry →Data processing agreement controls translate privacy obligations into enforceable purpose, instruction, security, rights, retention, transfer, incident, audit, and exit requirements.
Read the entry →A data processing inventory records how personal data is collected, used, stored, shared, retained, protected, and governed across business activities and systems.
Read the entry →Data provenance establishes the origin, custody, processing history, and authoritative context of a data item or dataset.
Read the entry →Data quality dimensions provide a repeatable way to judge whether information is complete, accurate, consistent, timely, valid, and fit for its intended use.
Read the entry →Data quality monitoring continuously evaluates whether incoming and stored data meet defined expectations for structure, completeness, validity, freshness, consistency, and distribution.
Read the entry →Data retention and legal holds govern how long information is kept, when normal disposal must pause, and how records remain discoverable and protected.
Read the entry →Use PR.DS to manage data at rest, in transit, and in use, plus protected and tested backups within the Protect Function.
Read the entry →Data Staged (T1074) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Data Staging and Exfiltration describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Read the entry →Data subject rights are mechanisms through which individuals may request access, correction, deletion, restriction, portability, objection, or other actions under applicable rules and promises.
Read the entry →Data Transfer Size Limits (T1030) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Data-visualization integrity and accessibility ensure charts, dashboards, maps, and reports represent data honestly and can be understood and operated by intended audiences, including people with disabilities.
Read the entry →Apply ID.AM-07 to achieve this CSF 2.0 outcome: Inventories of data and corresponding metadata for designated data types are maintained.
Read the entry →Data from Cloud Storage (T1530) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Data from Configuration Repository (T1602) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Data from Information Repositories (T1213) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →An adversary searches for and reads files, databases, application data, or other information stored on a compromised local system.
Read the entry →Data from Network Shared Drive (T1039) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Data from Removable Media (T1025) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Data-center physical security layers site boundaries, controlled entry, surveillance, visitor handling, equipment protection, media controls, and emergency procedures around critical infrastructure.
Read the entry →Database activity monitoring analyzes database sessions and commands to identify suspicious access, policy violations, misuse, and operational anomalies.
Read the entry →Database audit logging records security-relevant access, administrative changes, authentication events, and sensitive data operations with enough context for investigation and assurance.
Read the entry →Database backup verification confirms that backup files are complete, readable, protected, and capable of restoring the intended database state.
Read the entry →Database configuration hardening reduces unnecessary functions, insecure defaults, exposed interfaces, weak authentication, and excessive privileges in a database platform.
Read the entry →Database credential and service-account security limits how nonhuman identities are created, stored, rotated, monitored, and granted database privileges.
Read the entry →Database encryption and key management protect database files, backups, fields, and network connections while governing the keys that enable access.
Read the entry →Database high-availability architecture uses redundancy, health detection, quorum, replication, and controlled failover to keep data services within agreed availability objectives.
Read the entry →Point-in-time recovery combines a consistent base backup with ordered transaction logs so a database can be restored to a selected moment before an error or attack.
Read the entry →Database replication security protects the identities, channels, privileges, integrity, and operational controls used to copy data between database nodes or services.
Read the entry →Database schema change control governs how tables, fields, constraints, indexes, and dependent code are proposed, tested, deployed, and reversed.
Read the entry →Transaction isolation defines how concurrent database operations can observe or interfere with one another and which anomalies an application is willing to accept.
Read the entry →Databases (T1213.006) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →Dead Drop Resolver (T1102.001) is an Enterprise ATT&CK sub-technique under Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Debugger Evasion (T1622) is an Enterprise ATT&CK technique associated with Stealth, Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Decision intelligence combines predictions, constraints, objectives, and human judgment to choose actions rather than only estimate outcomes.
Read the entry →Decision rights specify who may make which decisions, under what conditions, with whose input, and with what accountability.
Read the entry →Apply DE.AE-08 to achieve this CSF 2.0 outcome: Incidents are declared when adverse events meet the defined incident criteria.
Read the entry →Apply RC.RP-06 to achieve this CSF 2.0 outcome: The end of incident recovery is declared based on criteria, and incident-related documentation is completed.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0009, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected Chinese cluster reported against government, defense, financial, healthcare, and telecommunications targets, with overlap ambiguity in public reporting.
Read the entry →Defacement (T1491) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Default Accounts (T1078.001) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.
Read the entry →Adversaries weaken, disable, reconfigure, or bypass security controls so later activity is less likely to be blocked or observed.
Read the entry →Defense in depth uses overlapping controls across people, process, technology, and physical environments to reduce the impact of any single weakness.
Read the entry →Delay Execution (T1678) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Delete Cloud Instance (T1578.003) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Deletion verification confirms that approved deletion reaches active systems, derived stores, archives, vendors, and future restoration paths while preserving documented legal exceptions.
Read the entry →Demilitarized Zones is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Deobfuscate/Decode Files or Information (T1140) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Deploy Container (T1610) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →These value-chain activities turn requirements and designs into ready capabilities, deploy them safely, operate them, fulfill demand, and support users through controlled end-to-end flow.
Read the entry →Use the Detect Function to monitor environments and analyze events so potentially adverse activity is discovered, correlated, understood, and escalated.
Read the entry →Detection coverage and gap analysis determines which priority adversary behaviors, misuse cases, control failures, and business risks are observable and actionable, and where missing telemetry, analytic logic, context, or response capacity leaves a gap.
Read the entry →Detection data-source requirements specify the events, fields, timestamps, identity context, retention, quality, and availability an analytic or investigation needs.
Read the entry →Detection tuning feedback loops use analyst dispositions, missed detections, environmental change, testing, and workload evidence to improve analytic precision without erasing useful coverage.
Read the entry →Detection use-case acceptance criteria define the threat behavior, data, logic, context, expected alert, performance, ownership, response path, and evidence required before a detection is treated as operational.
Read the entry →Detection use-case engineering converts priority threats and business exposure into defined data needs, analytic logic, triage steps, expected evidence, and validation criteria.
Read the entry →Detection validation and testing confirms that analytics receive required data, trigger on expected behavior, generate useful evidence, route correctly, and continue working after environmental change.
Read the entry →Detection as code manages analytic rules, queries, parsers, tests, documentation, and deployment through version-controlled engineering practices so detection changes are reviewable, reproducible, testable, and safely promoted.
Read the entry →Detection by design makes required telemetry, time integrity, identity context, sensor placement, retention, alerting, and investigation access explicit architecture requirements.
Read the entry →Determine Physical Locations (T1591.001) is an Enterprise ATT&CK sub-technique under Gather Victim Org Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →An operator creates malware, exploits, certificates, tools, or other capabilities tailored to the intended operation.
Read the entry →Device Driver Discovery (T1652) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Device Registration (T1098.005) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →The Diamond Model examines relationships among adversary, capability, infrastructure, and victim while adding context such as time, direction, and confidence.
Read the entry →Differential privacy deployment uses a quantified privacy-loss model, controlled query or release mechanisms, and implementation safeguards to limit what outputs reveal about individuals.
Read the entry →Diffie-Hellman Key Exchange is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.
Read the entry →Digital Certificates (T1587.003) is an Enterprise ATT&CK sub-technique under Develop Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Digital Certificates (T1588.004) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Digital Certificates (T1596.003) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Digital forensics applies repeatable methods to identify, preserve, collect, examine, analyze, and communicate evidence from digital systems and services.
Read the entry →The digital product and service lifecycle connects discovery, design, acquisition, build, transition, operation, delivery, and support as one governed path to value.
Read the entry →Digital Signatures is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.
Read the entry →Digital signatures use asymmetric cryptography to support message integrity, signer authentication, and evidence that an action came from a particular key holder.
Read the entry →Direct Cloud VM Connections (T1021.008) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Read the entry →Direct Network Flood (T1498.001) is an Enterprise ATT&CK sub-technique under Network Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Direct prompt injection is an attempt by a user to override or manipulate an AI application's intended instructions through supplied input.
Read the entry →Direct Volume Access (T1006) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Disable Crypto Hardware (T1600.002) is an Enterprise ATT&CK sub-technique under Weaken Encryption. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Disable or Modify Cloud Log (T1685.002) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Disable or Modify Linux Audit System Log (T1685.004) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Disable or Modify System Firewall (T1562.004) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
Read the entry →Disable or Modify System Firewall (T1686) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Disable or Modify Tools (T1562.001) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
Read the entry →Disable or Modify Tools (T1685) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Disable or Modify Windows Event Log (T1685.001) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Reduce attack surface by removing or disabling software, services, interpreters, protocols, and features that are not required. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Adversaries query systems, networks, identities, applications, policies, and cloud resources to understand the environment and select follow-on actions.
Read the entry →Discretionary Access Control is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →Disk Content Wipe (T1561.001) is an Enterprise ATT&CK sub-technique under Disk Wipe. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Disk forensics acquires and examines storage media and file-system artifacts to reconstruct user, application, operating-system, and adversary activity while preserving evidence integrity and provenance.
Read the entry →Disk Structure Wipe (T1561.002) is an Enterprise ATT&CK sub-technique under Disk Wipe. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Disk Wipe (T1561) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Distributed Component Object Model (T1021.003) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Read the entry →Represent a deliberate decision not to apply a direct preventive treatment to a specific adversary behavior while governing the remaining risk. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Domain Account (T1087.002) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Read the entry →Domain Account (T1136.002) is an Enterprise ATT&CK sub-technique under Create Account. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →Domain Accounts (T1078.002) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.
Read the entry →Domain Controller Authentication (T1556.001) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Read the entry →Domain Fronting (T1090.004) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Domain Generation Algorithms (T1568.002) is an Enterprise ATT&CK sub-technique under Dynamic Resolution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Domain Groups (T1069.002) is an Enterprise ATT&CK sub-technique under Permission Groups Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Read the entry →Domain Properties (T1590.001) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Domain registration intelligence uses registrar, registrant, nameserver, timing, and related metadata to support infrastructure analysis and campaign research.
Read the entry →Domain Trust Discovery (T1482) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →An adversary changes domain, federation, identity-provider, tenant, or cloud policy to weaken controls, grant access, or alter trusted behavior.
Read the entry →Domains (T1583.001) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Domains (T1584.001) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Double File Extension (T1036.007) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Downgrade Attack (T1689) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Downgrade System Image (T1601.002) is an Enterprise ATT&CK sub-technique under Modify System Image. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0035, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a cyber-espionage cluster attributed to Russia’s FSB Center 16 and reported against industrial-control and critical-infrastructure sectors.
Read the entry →A user is exposed to malicious web content that exploits a browser or convinces the user to retrieve and run harmful content, creating an entry path through normal browsing.
Read the entry →Drive-by Target (T1608.004) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Due care means taking reasonable protective action, while due diligence means continually understanding risk and verifying that those actions remain appropriate.
Read the entry →Dylib Hijacking (T1574.004) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →Dynamic API Resolution (T1027.007) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Dynamic Data Exchange (T1559.002) is an Enterprise ATT&CK sub-technique under Inter-Process Communication. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Dynamic Linker Hijacking (T1574.006) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →Dynamic Resolution (T1568) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Dynamic-link Library Injection (T1055.001) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →ESXi Administration Command (T1675) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →ETL and ELT security governs how extraction, transformation, and loading jobs handle privileges, staging areas, code, secrets, quality checks, and sensitive data.
Read the entry →Edge AI runs inference on local devices to reduce latency, support offline use, and keep some data near its source.
Read the entry →Electron Applications (T1218.015) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Elevated Execution with Prompt (T1548.004) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.
Read the entry →Elliptic Curve Cryptography is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.
Read the entry →Email Account (T1087.003) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Read the entry →Email Accounts (T1585.002) is an Enterprise ATT&CK sub-technique under Establish Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Email Accounts (T1586.002) is an Enterprise ATT&CK sub-technique under Compromise Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Email Addresses (T1589.002) is an Enterprise ATT&CK sub-technique under Gather Victim Identity Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Email attack incident response addresses phishing, business email compromise, malicious attachments, impersonation, mailbox abuse, and related identity compromise.
Read the entry →Email authentication and DNS security combine DNSSEC, SPF, DKIM, DMARC, TLS, certificate validation, and resolver protections to reduce spoofing, tampering, and delivery abuse.
Read the entry →Email Bombing (T1667) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Email Collection (T1114) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Email Forwarding Rule (T1114.003) is an Enterprise ATT&CK sub-technique under Email Collection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →Email Hiding Rules (T1564.008) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Email security controls combine authentication, filtering, attachment and link analysis, impersonation protection, account security, user reporting, and response workflows.
Read the entry →Email Spoofing (T1684.002) is an Enterprise ATT&CK sub-technique under Social Engineering. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Embedded Payloads (T1027.009) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Embedded systems security protects purpose-built computing devices whose software, hardware, interfaces, timing, physical environment, and long support lifecycle are tightly coupled to a product or physical process.
Read the entry →Embeddings represent meaning as numeric vectors, and vector databases retrieve items based on similarity rather than exact wording.
Read the entry →Emond (T1546.014) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →Employee Names (T1589.003) is an Enterprise ATT&CK sub-technique under Gather Victim Identity Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Protect sensitive information from unauthorized disclosure by applying appropriate encryption in storage, transit, processing, and backup contexts. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →An adversary protects command traffic with encryption or an encrypted protocol to conceal content and complicate inspection.
Read the entry →Encrypted/Encoded File (T1027.013) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Encryption protects confidentiality, hashing produces fixed-length representations for integrity and comparison, and certificates bind public keys to identities or services.
Read the entry →Endpoint Application Control concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Read the entry →Endpoint Denial of Service (T1499) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Endpoint detection and response collects endpoint activity, identifies suspicious behavior, supports investigation, and provides response actions such as isolation or process termination.
Read the entry →EDR telemetry records endpoint behavior such as process execution, modules, files, registry, users, network connections, scripts, drivers, security events, and response actions so analysts can detect and investigate activity in context.
Read the entry →Endpoint hardening reduces unnecessary exposure on workstations, laptops, servers, and mobile devices through secure configuration and controlled functionality.
Read the entry →Engineering workstation hardening protects systems that configure controllers, logic, firmware, safety parameters, and other high-impact OT assets.
Read the entry →Enterprise architecture governance guides technology, information, application, and infrastructure decisions toward a coherent target state.
Read the entry →Enterprise IAM troubleshooting isolates failures across identity proofing, directory data, federation, tokens, conditional access, authorization, MFA, session, and application integration layers.
Read the entry →Enterprise risk management coordinates risk decisions across business objectives, technology, operations, finance, compliance, and cybersecurity.
Read the entry →Enterprise security architecture aligns security capabilities, patterns, standards, and decision rules across business services and technology portfolios.
Read the entry →Prevent unauthorized users and processes from changing environment variables that influence execution, search paths, libraries, credentials, or application behavior. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Environmental Keying (T1480.001) is an Enterprise ATT&CK sub-technique under Execution Guardrails. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Apply RS.MI-02 to achieve this CSF 2.0 outcome: Incidents are eradicated.
Read the entry →Apply RS.MA-04 to achieve this CSF 2.0 outcome: Incidents are escalated or elevated as needed.
Read the entry →Escape to Host (T1611) is an Enterprise ATT&CK technique associated with Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →The essential characteristics of cloud computing describe the operating behaviors that distinguish cloud services from ordinary hosting.
Read the entry →Establish Accounts (T1585) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Apply RS.AN-03 to achieve this CSF 2.0 outcome: Analysis is performed to establish what has taken place during an incident and the root cause of the incident.
Read the entry →Apply RC.RP-04 to achieve this CSF 2.0 outcome: Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms.
Read the entry →Apply GV.PO-01 to achieve this CSF 2.0 outcome: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced.
Read the entry →Apply ID.RA-04 to achieve this CSF 2.0 outcome: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded.
Read the entry →Apply RS.AN-08 to achieve this CSF 2.0 outcome: An incident’s magnitude is estimated and validated.
Read the entry →Apply GV.OV-03 to achieve this CSF 2.0 outcome: Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed.
Read the entry →Event Triggered Execution (T1546) is an Enterprise ATT&CK technique associated with Privilege Escalation, Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Evidence handling protects the integrity, identity, context, and accountability of information collected during an investigation or legal process.
Read the entry →Evidence-based risk prioritization uses exposure, criticality, threat activity, control performance, uncertainty, and consequence to make funding and sequencing choices defensible.
Read the entry →Evil Twin (T1557.004) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
Read the entry →Exclusive Control (T1668) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Executable Installer File Permissions Weakness (T1574.005) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →Apply RS.MA-01 to achieve this CSF 2.0 outcome: The incident response plan is executed in coordination with relevant third parties once an incident is declared.
Read the entry →Apply RC.RP-01 to achieve this CSF 2.0 outcome: The recovery portion of the incident response plan is executed once initiated from the incident response process.
Read the entry →Execution Guardrails (T1480) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Block unapproved code, scripts, macros, binaries, and interpreters from executing in contexts where they are not required. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Adversaries run commands, scripts, code, interpreters, APIs, or user-driven content to carry out malicious actions in an environment.
Read the entry →Executive incident briefings summarize current impact, confidence, decisions, risks, resource needs, and next milestones without overwhelming leaders with raw technical detail.
Read the entry →Executive security reporting gives decision makers a concise view of material exposure, control performance, incidents, obligations, trends, and choices requiring action.
Read the entry →Executive sponsorship for security change provides visible authority, resources, conflict resolution, accountability, and reinforcement so cross-organizational change can survive resistance.
Read the entry →Exfiltration Over Alternative Protocol (T1048) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (T1048.002) is an Enterprise ATT&CK sub-technique under Exfiltration Over Alternative Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Read the entry →Exfiltration Over Bluetooth (T1011.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Other Network Medium. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Read the entry →An adversary sends collected data through the same command-and-control channel used to manage compromised systems.
Read the entry →Exfiltration Over Other Network Medium (T1011) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Exfiltration Over Physical Medium (T1052) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Exfiltration Over Symmetric Encrypted Non-C2 Protocol (T1048.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Alternative Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Read the entry →Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003) is an Enterprise ATT&CK sub-technique under Exfiltration Over Alternative Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Read the entry →An adversary uploads information through a web service, cloud-storage provider, code-sharing service, or other internet platform that may resemble normal use.
Read the entry →Exfiltration Over Webhook (T1567.004) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Read the entry →Exfiltration over USB (T1052.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Physical Medium. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Read the entry →Exfiltration to Cloud Storage (T1567.002) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Read the entry →Exfiltration to Code Repository (T1567.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Read the entry →Exfiltration to Text Storage Sites (T1567.003) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Read the entry →Adversaries transfer collected information outside an authorized boundary through command channels, web services, cloud storage, physical media, or alternate paths.
Read the entry →Expected monetary value combines the probability of an uncertain outcome with its financial effect to compare choices, contingencies, and decision paths.
Read the entry →Experiment tracking and versioning connect hypotheses, datasets, code, parameters, environments, metrics, artifacts, reviewers, and decisions for analytic and machine-learning work.
Read the entry →Use platform and application protections that make vulnerability exploitation less reliable or prevent common exploit behaviors. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →An adversary exploits a weakness in an internet-accessible application, service, appliance, management interface, or workload to gain access.
Read the entry →Exploitation for Client Execution (T1203) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Exploitation for Credential Access (T1212) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Exploitation for Defense Impairment (T1687) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →An adversary exploits a software or configuration weakness to cross a local or workload privilege boundary.
Read the entry →Exploitation for Stealth (T1211) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →An adversary exploits a weakness in an internal remote service to gain access to another system without relying solely on valid credentials.
Read the entry →An exploit is code, a technique, or a sequence of actions that takes advantage of a vulnerability or unsafe condition to produce unintended behavior.
Read the entry →Exploits (T1587.004) is an Enterprise ATT&CK sub-technique under Develop Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Exploits (T1588.005) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Exposure is the condition of being reachable, visible, accessible, or otherwise subject to loss or attack because assets, identities, data, or services are presented to a threat.
Read the entry →Extended Attributes (T1564.014) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →External Defacement (T1491.002) is an Enterprise ATT&CK sub-technique under Defacement. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →External Proxy (T1090.002) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →An adversary uses externally reachable VPN, remote desktop, SSH, virtual application, management, or other remote-access services to enter or return to an environment.
Read the entry →Apply GV.OC-04 to achieve this CSF 2.0 outcome: Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated.
Read the entry →Extra Window Memory Injection (T1055.011) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →Extreme-but-plausible impact analysis explores severe scenarios that remain credible enough to challenge assumptions about concentration, dependency, recovery, safety, and decision thresholds.
Read the entry →FIDO2 combines public-key authentication protocols with WebAuthn so users can sign in using phishing-resistant credentials bound to legitimate services.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0053, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing activity conducted through a hybrid operational-relay-box network combining compromised devices and leased virtual private servers.
Read the entry →Fail-safe and fail-secure design determines how a system behaves when components, dependencies, communications, or controls fail.
Read the entry →Fallback Channels (T1008) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →False positives are benign events incorrectly classified as malicious, while false negatives are harmful events that a control or analytic fails to detect.
Read the entry →Fast Flux DNS (T1568.001) is an Enterprise ATT&CK sub-technique under Dynamic Resolution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Feature engineering converts raw data into variables that make relevant patterns usable by a learning algorithm.
Read the entry →Feature-store security protects reusable machine-learning features, definitions, historical values, serving paths, and access policies across training and inference.
Read the entry →FedRAMP establishes security requirements and repeatable authorization processes for cloud services used by United States federal agencies.
Read the entry →Federation allows one trusted identity system to assert information to another service, while single sign-on reduces repeated authentication across connected applications.
Read the entry →Federation and Trust Relationships is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →File Deletion (T1070.004) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →File Integrity Monitoring is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →File systems organize stored data and enforce permissions that determine who can read, write, execute, modify, or delete files and directories.
Read the entry →File Transfer Protocols (T1071.002) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →File Upload Security is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Read the entry →File and Directory Discovery (T1083) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →File and Directory Permissions Modification (T1222) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →File/Path Exclusions (T1564.012) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Fileless Malware describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Read the entry →Fileless Storage (T1027.011) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Filesystem mount hardening uses mount boundaries and options to reduce executable content, device access, privilege transitions, and unsafe write behavior on selected filesystems.
Read the entry →Permit only necessary network communication and inspect, block, or constrain traffic that violates approved flows and trust boundaries. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →FinOps is a collaborative operating practice that brings engineering, finance, product, procurement, and leadership together to maximize the business value of cloud spending.
Read the entry →Financial Theft (T1657) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Firewalls enforce network communication policy by allowing, denying, inspecting, or recording traffic between defined security zones and endpoints.
Read the entry →Firmware (T1592.003) is an Enterprise ATT&CK sub-technique under Gather Victim Host Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Firmware analysis examines the software image and supporting metadata that control an embedded device to identify architecture, components, configuration, secrets, services, update logic, vulnerabilities, and runtime behavior.
Read the entry →Firmware Corruption (T1495) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Firmware security protects the low-level code and configuration that initialize and control hardware through trusted update, integrity verification, access control, inventory, monitoring, and recovery.
Read the entry →Firmware signing uses protected private keys and verified metadata to let a bootloader, device, installer, or update service determine that firmware was authorized by the product owner and has not been modified since signing.
Read the entry →Flow optimization improves the movement of valuable work through a system by managing demand, capacity, queues, dependencies, variability, quality, and feedback.
Read the entry →Focus on value requires every activity, investment, control, and improvement to remain connected to outcomes that matter to customers, users, sponsors, and the organization.
Read the entry →Forced Authentication (T1187) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Forensic timeline analysis orders and correlates events from systems, files, identities, networks, applications, and people to explain what happened, when it happened, how confidently it is known, and where evidence is missing or contradictory.
Read the entry →Forge Web Credentials (T1606) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Forward Proxies is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Forward secrecy limits the value of later key compromise for past sessions, while authenticated encryption with associated data provides confidentiality and integrity within a defined protocol context.
Read the entry →The four dimensions provide a balanced view of organizations and people, information and technology, partners and suppliers, and value streams and processes.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0117, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected Iranian-nexus cluster reported across multiple sectors and regions.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0001, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a highly targeted 2019 campaign whose operators assembled multiple unrelated open-source components.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0041, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a January 2024 incident against a Ukrainian municipal heating provider involving FrostyGoop and legitimate Modbus commands.
Read the entry →Full-Disk Encryption is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.
Read the entry →Functional analysis identifies what a system must do and allocates those functions and security responsibilities to people, processes, hardware, software, data, and external services.
Read the entry →Functional security requirements describe required security behavior, while nonfunctional requirements set qualities such as assurance, performance, resilience, usability, and maintainability.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0007, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a suspected Chinese espionage campaign reported against government and foreign organizations in Southeast Asia.
Read the entry →Fuzz testing sends generated, mutated, malformed, or unexpected inputs to software to reveal crashes, hangs, memory errors, state problems, and unsafe behavior.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0093, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a likely China-based cyber-espionage cluster reported against telecommunications, finance, and government organizations.
Read the entry →GUI Input Capture (T1056.002) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0047, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected Russian and FSB-linked cluster reported in persistent operations focused on Ukraine.
Read the entry →Gatekeeper Bypass (T1553.001) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Gather Victim Host Information (T1592) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →An operator collects names, usernames, email addresses, roles, relationships, or other identity details that can support targeting, credential attacks, and believable pretexts.
Read the entry →Gather Victim Network Information (T1590) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Gather Victim Org Information (T1591) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Apply PR.AT-01 to achieve this CSF 2.0 outcome: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind.
Read the entry →General-purpose AI governance addresses models that can support many downstream tasks and whose risks depend partly on capabilities, distribution, and later integration.
Read the entry →Generate Content (T1683) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Apply PR.PS-04 to achieve this CSF 2.0 outcome: Log records are generated and made available for continuous monitoring.
Read the entry →GitOps security treats version-controlled declarations and automated reconciliation as a production control plane that requires protected repositories, signed changes, policy checks, and trustworthy deployment identities.
Read the entry →Golden image security establishes a versioned, patched, scanned, minimally configured, and reproducible template for deploying servers or virtual machines without carrying hidden state forward.
Read the entry →Golden Ticket (T1558.001) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Use the Govern Function to establish decision rights, risk direction, accountability, policy, oversight, and supply chain governance so cybersecurity risk is managed as an enterprise concern.
Read the entry →Governance frameworks organize principles, structures, processes, information, culture, skills, and accountability so important decisions are made by the right people at the right level.
Read the entry →Governance performance management measures whether governance structures, decisions, and processes are producing intended enterprise outcomes.
Read the entry →Governance of enterprise IT ensures that technology-related decisions support enterprise objectives, deliver value, manage risk, and use resources responsibly.
Read the entry →GraphQL security protects a typed query interface in which clients select fields and traverse relationships; the server must enforce authorization, resource limits, safe resolver behavior, and controlled schema exposure for every requested object and field.
Read the entry →Group Managed Service Accounts are Active Directory accounts whose complex passwords are automatically managed and made available only to authorized hosts, reducing the need to store or manually rotate service credentials.
Read the entry →Group Policy Discovery (T1615) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Group Policy Modification (T1484.001) is an Enterprise ATT&CK sub-technique under Domain or Tenant Policy Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Privilege Escalation context.
Read the entry →Group Policy Preferences (T1552.006) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Group Policy Security concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0125, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a likely China state-sponsored cluster reported against a broad range of United States sectors.
Read the entry →The HITRUST CSF combines requirements from multiple sources into a structured control framework used for risk management and assurance.
Read the entry →HTML Smuggling (T1027.006) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →HTTP methods express the intended action on a resource, while status codes communicate the outcome; secure applications enforce authorization and state rules for every method and return responses that are accurate without disclosing unnecessary detail.
Read the entry →HTTP and HTTPS describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Read the entry →Hardware (T1592.001) is an Enterprise ATT&CK sub-technique under Gather Victim Host Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Hardware Additions (T1200) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Hardware failure risk management identifies component, power, cooling, media, controller, cable, and environmental failure modes and connects them to monitoring, spares, redundancy, maintenance, and recovery.
Read the entry →Apply ID.AM-01 to achieve this CSF 2.0 outcome: Inventories of hardware managed by the organization are maintained.
Read the entry →Apply PR.PS-03 to achieve this CSF 2.0 outcome: Hardware is maintained, replaced, and removed commensurate with risk.
Read the entry →A hardware root of trust provides protected functions and measurements used to establish device identity, key custody, boot integrity, attestation, or isolated execution.
Read the entry →Hardware Security Modules is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Hashing transforms data into a fixed-length digest, while salts and peppers strengthen password storage by making precomputed and large-scale guessing attacks more difficult.
Read the entry →Hidden File System (T1564.005) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Hidden Files and Directories (T1564.001) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Hidden Users (T1564.002) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Hidden Window (T1564.003) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →An adversary conceals files, directories, processes, windows, accounts, services, or cloud resources from ordinary inspection.
Read the entry →Hide Infrastructure (T1665) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →A high-assurance system is engineered to provide unusually strong confidence that critical security and safety properties hold in its intended environment.
Read the entry →High-pressure security communications deliver concise, accurate, prioritized messages with clear actions, uncertainty, ownership, and update timing when attention and time are limited.
Read the entry →Hijack Execution Flow (T1574) is an Enterprise ATT&CK technique associated with Stealth, Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0038, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a disruptive 2022 campaign by Iranian state-affiliated actors against Albanian government networks.
Read the entry →Homomorphic encryption permits selected computations on encrypted data so a processor can produce an encrypted result without receiving the plaintext.
Read the entry →Host firewall policy limits inbound, outbound, and forwarded traffic at the workload boundary using explicit service intent, stateful rules, controlled administration, and verified persistence.
Read the entry →Host-Based Firewalls is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Human oversight design gives qualified people timely information, authority, capacity, and practical controls to understand and intervene in AI-supported decisions.
Read the entry →Human risk assessment examines roles, access, incentives, workload, behaviors, and likely failure modes so awareness and controls address real exposure rather than generic messaging.
Read the entry →Human-AI interaction design shapes how people understand, question, correct, and rely on an AI system.
Read the entry →Human-machine interface security protects operator visibility and control while preserving rapid, reliable access to accurate process information and safe actions.
Read the entry →Hunt-to-detection feedback converts validated hunt findings into durable analytics, playbooks, telemetry requirements, asset improvements, and threat-intelligence questions.
Read the entry →Hybrid architecture trust boundaries identify where identity, administration, data, network, and service trust crosses on-premises, cloud, partner, SaaS, and third-party environments.
Read the entry →Hybrid Identity (T1556.007) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Read the entry →Hybrid network architecture connects on-premises, cloud, edge, remote, and third-party environments through explicitly designed zones, routes, identities, controls, and failure domains.
Read the entry →Hybrid cloud combines cloud services with on-premises or edge environments, while multicloud uses services from more than one cloud provider.
Read the entry →Hypervisor CLI (T1059.012) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Hypervisor management-plane security protects the privileged interfaces, APIs, accounts, consoles, networks, and automation that can create, inspect, move, or control virtual workloads.
Read the entry →IDE Extensions (T1176.002) is an Enterprise ATT&CK sub-technique under Software Extensions. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →IDE Tunneling (T1219.001) is an Enterprise ATT&CK sub-technique under Remote Access Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →IIS Components (T1505.004) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →IP Addresses (T1590.005) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →IP addressing and routing explain how hosts identify network locations and how routers select paths that move packets between local and remote networks.
Read the entry →IPv6 Neighbor Discovery is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →IPv6 security applies secure architecture, filtering, neighbor-discovery protections, address management, monitoring, and transition controls to IPv6 traffic.
Read the entry →ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system.
Read the entry →IT investment governance evaluates, selects, funds, monitors, and retires technology-enabled investments according to enterprise value, risk, capacity, and strategic priorities.
Read the entry →IT portfolio management evaluates investments, services, applications, infrastructure, and technical debt as a connected set rather than as isolated projects.
Read the entry →IT resource optimization aligns people, skills, information, applications, infrastructure, suppliers, and funding with enterprise priorities and constraints.
Read the entry →IT service incident management restores normal service operation as quickly as practical while controlling impact, communication, escalation, evidence, and handoff to deeper analysis.
Read the entry →IT service problem management reduces the likelihood and impact of incidents by identifying causes, managing known errors and workarounds, and driving durable corrective action.
Read the entry →The continual improvement model provides a repeatable path from vision and current-state evidence through target definition, execution, measurement, and sustained momentum.
Read the entry →The engage activity establishes transparent relationships and a continuing understanding of stakeholder needs, expectations, experience, demand, and feedback.
Read the entry →The ITIL guiding principles are adaptable recommendations that help people make coherent decisions across governance, value streams, practices, technologies, suppliers, and improvement work.
Read the entry →The improve activity ensures continual enhancement of products, services, practices, value-chain activities, and the service-management system using prioritized evidence.
Read the entry →The plan activity creates shared understanding of vision, current status, priorities, policies, architecture, and improvement direction across products, services, and stakeholders.
Read the entry →The ITIL service value chain is a flexible operating model whose activities combine in different value streams to create, deliver, support, and improve products and services.
Read the entry →The ITIL service value system brings guiding principles, governance, the service value chain, practices, and continual improvement together to convert opportunity and demand into value.
Read the entry →Use the Identify Function to maintain an evidence-based understanding of assets, dependencies, threats, vulnerabilities, likelihood, impact, and opportunities for improvement.
Read the entry →Identify Business Tempo (T1591.003) is an Enterprise ATT&CK sub-technique under Gather Victim Org Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Apply ID.RA-03 to achieve this CSF 2.0 outcome: Internal and external threats to the organization are identified and recorded.
Read the entry →Identify Roles (T1591.004) is an Enterprise ATT&CK sub-technique under Gather Victim Org Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Apply ID.RA-01 to achieve this CSF 2.0 outcome: Vulnerabilities in assets are identified, validated, and recorded.
Read the entry →Identity architecture defines how people, workloads, devices, services, and organizations are identified, authenticated, authorized, governed, and audited.
Read the entry →Identity lifecycle management governs how accounts and access are requested, created, changed, reviewed, suspended, and removed.
Read the entry →Use PR.AA to manage identity life cycle, proofing, credentials, authentication, assertions, authorization, permissions, and physical access within the Protect Function.
Read the entry →Identity proofing establishes evidence that an applicant is the person or entity they claim to be before an identity is enrolled or credentials are issued.
Read the entry →Apply PR.AA-02 to achieve this CSF 2.0 outcome: Identities are proofed and bound to credentials based on the context of interactions.
Read the entry →Ignore Process Interrupts (T1564.011) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Image File Execution Options Injection (T1546.012) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →Immutable infrastructure replaces deployed components with newly built versions instead of modifying them in place.
Read the entry →Adversaries disrupt availability, destroy or manipulate information, impair recovery, consume resources, or otherwise affect mission and business operations.
Read the entry →Impair Defenses (T1562) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
Read the entry →Impersonation (T1684.001) is an Enterprise ATT&CK sub-technique under Social Engineering. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Implant Internal Image (T1525) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Apply ID.IM-04 to achieve this CSF 2.0 outcome: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved.
Read the entry →Use ID.IM to manage learning from evaluations, tests, exercises, operations, incidents, and plan execution within the Identify Function.
Read the entry →Apply ID.IM-01 to achieve this CSF 2.0 outcome: Improvements are identified from evaluations.
Read the entry →Apply ID.IM-03 to achieve this CSF 2.0 outcome: Improvements are identified from execution of operational processes, procedures, and activities.
Read the entry →Apply ID.IM-02 to achieve this CSF 2.0 outcome: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties.
Read the entry →Use RS.AN to manage facts, root cause, evidence preservation, action records, and magnitude estimation within the Respond Function.
Read the entry →Incident artifact analysis examines files, memory, metadata, processes, network records, messages, and other evidence to extract indicators, behavior, provenance, and investigative leads.
Read the entry →Incident closure criteria define the evidence and approvals required before an event leaves active response and enters monitoring, remediation, or normal operations.
Read the entry →Incident command automation boundaries specify which coordination, communication, evidence, and technical actions may be automated and which require accountable human command.
Read the entry →Incident decision logging records significant choices, authority, time, evidence, assumptions, alternatives, and expected consequences.
Read the entry →Incident hypothesis development frames testable explanations for observed activity, expected evidence, competing possibilities, and the next collection actions needed to reduce uncertainty.
Read the entry →Use RS.MA to manage plan execution, report validation, categorization, prioritization, escalation, and recovery initiation within the Respond Function.
Read the entry →An incident management team brings together authorized leaders and specialists to direct technical response, business coordination, communications, legal decisions, and recovery.
Read the entry →Use RS.MI to manage containment, eradication, risk tradeoffs, and preventing recurrence or spread within the Respond Function.
Read the entry →Use RC.CO to manage recovery status, stakeholder expectations, public updates, and coordinated transition within the Recover Function.
Read the entry →Use RC.RP to manage plan execution, prioritization, restoration, verification, post-incident norms, and recovery closure within the Recover Function.
Read the entry →Incident recovery validation confirms that services are restored, attacker access is removed, controls are effective, data is trustworthy, and monitoring can detect recurrence.
Read the entry →Incident responder fatigue management uses staffing, shifts, handoffs, rest, psychological support, and workload controls to sustain sound decisions during extended events.
Read the entry →Incident response is a coordinated capability that combines preparation, analysis, action, recovery, communication, evidence, and improvement.
Read the entry →Incident response metrics evaluate readiness, detection, decision speed, containment, recovery, communication, recurrence, and improvement rather than counting tickets alone.
Read the entry →Incident response objectives define the outcomes the team must achieve, such as stopping harm, protecting evidence, sustaining critical services, removing access, and restoring trusted operations.
Read the entry →Incident response process improvement uses incidents, exercises, metrics, audits, and near misses to reduce friction and increase future speed, quality, and resilience.
Read the entry →Incident response readiness ensures roles, authority, communications, tooling, access, evidence procedures, exercises, and dependencies are prepared before an incident begins.
Read the entry →Use RS.CO to manage stakeholder notification, coordination, information sharing, and obligation-aware communication within the Respond Function.
Read the entry →An incident response training program develops role-specific knowledge, decision skills, tool proficiency, communication habits, and backup coverage for responders and stakeholders.
Read the entry →Incident root-cause analysis identifies the technical, process, organizational, and environmental conditions that allowed an incident to begin, spread, or remain undetected.
Read the entry →Incident severity classification assigns a consistent priority using factors such as mission impact, data sensitivity, scope, safety, legal obligations, adversary activity, and recovery difficulty.
Read the entry →Incident task tracking records actions, owners, dependencies, deadlines, status, blockers, and completion evidence throughout a response.
Read the entry →Incident timeline reconstruction orders events, observations, actions, and decisions across systems and teams to explain what happened and when.
Read the entry →Apply GV.SC-08 to achieve this CSF 2.0 outcome: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities.
Read the entry →Increment goals describe the coherent outcome sought in a delivery cycle, while acceptance criteria define the observable conditions required for work to be considered suitable.
Read the entry →Independent verification and validation evaluates whether software was built correctly and whether it satisfies its intended needs, with sufficient separation from the team responsible for delivery.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0043, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing PRC-linked intrusions during 2021–2022 against Indian electric-utility, logistics, and related IT environments.
Read the entry →An adversary deletes or alters logs, files, timestamps, command history, accounts, or other evidence to reduce the visible record of activity.
Read the entry →Indicator Removal from Tools (T1027.005) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Indicators of compromise describe evidence associated with a suspected intrusion, while indicators of attack emphasize behavior that may reveal an attack in progress.
Read the entry →Indirect Command Execution (T1202) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Indirect prompt injection places hostile instructions in content the model later retrieves or processes, such as a webpage, document, email, or tool result.
Read the entry →Inference API security protects model-serving interfaces against unauthorized use, abuse, extraction, privacy attacks, resource exhaustion, and unsafe input or output handling.
Read the entry →Information governance directs how information is created, classified, owned, used, shared, protected, retained, and disposed to support enterprise objectives and obligations.
Read the entry →Information governance establishes decision rights and policies for the value, quality, security, privacy, retention, use, and disposal of information.
Read the entry →The information and technology dimension addresses the data, knowledge, applications, infrastructure, automation, architecture, and security needed to manage products and services.
Read the entry →Infrastructure state management records the relationship between declared resources and real deployed objects so automation can plan changes safely.
Read the entry →Infrastructure as code defines cloud and platform resources through machine-readable, version-controlled declarations or programs rather than ad hoc manual configuration.
Read the entry →Infrastructure-as-code policy enforcement evaluates proposed configurations against security, compliance, resilience, cost, and architecture rules before and after deployment.
Read the entry →Infrastructure-as-code state security protects the files, backends, locks, credentials, and metadata used to compare declared infrastructure with real resources and plan changes.
Read the entry →An adversary transfers tools or files from an external location into a compromised environment, often through an existing command channel.
Read the entry →Inherent risk is the exposure before considering relevant controls, while residual risk is the exposure that remains after controls and other responses are applied.
Read the entry →An adversary deletes, disables, corrupts, or reconfigures backups, snapshots, recovery partitions, services, or boot options to make restoration harder.
Read the entry →Initial access techniques are the phishing, exploitation, credential, supply-chain, and trusted-relationship methods adversaries use to obtain a first foothold.
Read the entry →Adversaries obtain the first foothold through people, internet-facing services, remote access, trusted relationships, removable media, or other entry paths.
Read the entry →Initialization Vectors and Nonces is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.
Read the entry →Input Capture (T1056) is an Enterprise ATT&CK technique associated with Collection, Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Input Injection (T1674) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Insecure Deserialization is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Read the entry →Install Digital Certificate (T1608.003) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Install Root Certificate (T1553.004) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →InstallUtil (T1218.004) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Installer Packages (T1546.016) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →Apply GV.SC-03 to achieve this CSF 2.0 outcome: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes.
Read the entry →Apply DE.AE-07 to achieve this CSF 2.0 outcome: Cyber threat intelligence and other contextual information are integrated into the analysis.
Read the entry →Integrated physical and logical access control coordinates identity, credentials, badges, devices, locations, systems, authorization, logging, and revocation without creating hidden trust escalation.
Read the entry →Integrated project planning coordinates scope, schedule, cost, resources, quality, risk, procurement, communications, stakeholders, and change assumptions as one connected management system.
Read the entry →Intelligence collection management identifies needed information, selects appropriate sources, assigns collection tasks, and tracks whether gaps are being resolved.
Read the entry →Intelligence handling caveats communicate restrictions, sensitivities, source protections, legal limits, and conditions that apply in addition to general sharing labels.
Read the entry →Intelligence-led threat hunting converts validated adversary knowledge into hypotheses, data requirements, analytic methods, and searches for activity that existing detections may miss.
Read the entry →Inter-Process Communication (T1559) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Internal Defacement (T1491.001) is an Enterprise ATT&CK sub-technique under Defacement. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Internal Proxy (T1090.001) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Internal Spearphishing (T1534) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Internet Connection Discovery (T1016.001) is an Enterprise ATT&CK sub-technique under System Network Configuration Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Read the entry →Internet Control Message Protocol (ICMP) describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Read the entry →Internet of Things Security is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Intrusion detection systems identify suspicious activity, while intrusion prevention systems can also block or disrupt traffic that matches defined conditions.
Read the entry →Invalid Code Signature (T1036.001) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Invisible Unicode (T1027.018) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →IoT device identity is the set of cryptographic and lifecycle mechanisms used to distinguish one physical or logical device from another, authenticate it to services and peers, and bind actions and data to an accountable device record.
Read the entry →IoT network segmentation places connected devices into controlled zones and communication paths according to function, trust, ownership, and consequence so compromise of one device does not provide unrestricted access to users, servers, management systems, or other devices.
Read the entry →IoT secure update mechanisms let a device authenticate update metadata and payloads, verify integrity and authorization, install changes safely, resist rollback, recover from failure, and report update state throughout a long product lifecycle.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0050, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2023–2024 campaign that used a tailored J-magic backdoor against Juniper routers serving as VPN gateways.
Read the entry →JTAG and UART security controls debug, test, programming, and serial interfaces that can expose firmware, memory, boot state, credentials, consoles, and privileged device control when physically accessible.
Read the entry →JamPlus (T1127.003) is an Enterprise ATT&CK sub-technique under Trusted Developer Utilities Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →JavaScript (T1059.007) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0044, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2022 OilRig campaign that targeted Israeli organizations with the Mango backdoor.
Read the entry →Junk Code Insertion (T1027.016) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Junk Data (T1001.001) is an Enterprise ATT&CK sub-technique under Data Obfuscation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Just-in-Time Access is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0035, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing activity involving compromised end-of-life SOHO equipment used to obscure access to critical-infrastructure victims.
Read the entry →Keep it simple and practical means using the fewest steps and controls needed to achieve the intended outcome without discarding necessary assurance, accountability, or resilience.
Read the entry →Kerberoasting is an attack technique in which an authenticated domain user requests Kerberos service tickets for service principal names and attempts to crack the ticket material offline to recover weak service-account passwords.
Read the entry →Kerberoasting (T1558.003) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Kerberos is a ticket-based network authentication protocol that lets users and services prove identity without repeatedly sending passwords across the network.
Read the entry →Kerberos in Active Directory is a ticket-based authentication system in which domain controllers acting as key distribution centers issue time-limited tickets that let users and services prove identity without repeatedly transmitting passwords.
Read the entry →Kernel module security governs which code may extend the operating-system kernel, when modules may load, and how unsupported or unnecessary drivers are prevented from expanding privilege.
Read the entry →Kernel Modules and Extensions (T1547.006) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →KernelCallbackTable (T1574.013) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →Key Derivation Functions is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.
Read the entry →Key risk indicators are measures that signal changing exposure, deteriorating conditions, or movement toward an unacceptable risk threshold.
Read the entry →Keychain (T1555.001) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Keylogging (T1056.001) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
Read the entry →Knowledge representation structures facts, relationships, categories, and rules so an AI system can reason over information rather than only store it.
Read the entry →Kubernetes security protects the cluster control plane, nodes, workloads, images, network paths, secrets, and administrative interfaces.
Read the entry →LC_LOAD_DYLIB Addition (T1546.006) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →Jailbreak resistance is the ability of an AI application to maintain enforced restrictions despite persuasive, encoded, multi-turn, or role-play attempts to bypass them.
Read the entry →LNK Icon Smuggling (T1027.012) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →LSA Secrets (T1003.004) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →LSASS Driver (T1547.008) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →LSASS Memory (T1003.001) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →The Local Security Authority Subsystem Service enforces local security policy, validates certain logons, creates access tokens, and handles credential material; protecting LSASS is central to limiting credential theft from Windows endpoints.
Read the entry →Lateral movement is the use of credentials, remote services, trust relationships, and administrative tools to move from one system or account to another.
Read the entry →Adversaries move from one account, system, workload, or trust zone to another using remote services, credentials, exploits, or transferred tools.
Read the entry →An adversary copies tools or files between systems inside the target environment to support continued movement and execution.
Read the entry →Launch Agent (T1543.001) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Launch Daemon (T1543.004) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Launchctl (T1569.001) is an Enterprise ATT&CK sub-technique under System Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Apply GV.RR-01 to achieve this CSF 2.0 outcome: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.
Read the entry →Leadership credibility and follow-through grow when security leaders are consistent, candid about uncertainty, fair in tradeoffs, reliable in commitments, and visible in correcting mistakes.
Read the entry →Least functionality limits systems to the services, features, protocols, software, accounts, and permissions required for their intended purpose.
Read the entry →Least privilege reduces avoidable exposure by limiting users, services, applications, and devices to the permissions they actually require.
Read the entry →Legacy system security applies isolation, compensating controls, strict access, monitoring, change discipline, recovery planning, and retirement governance where modern controls cannot be installed.
Read the entry →Apply GV.OC-03 to achieve this CSF 2.0 outcome: Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0049, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing long-term intrusions in Australia involving external-service exploitation, credential capture, lateral movement, and data theft.
Read the entry →Apply GV.SC-09 to achieve this CSF 2.0 outcome: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
Read the entry →Lifecycle-Triggered Deletion (T1485.001) is an Enterprise ATT&CK sub-technique under Data Destruction. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Likelihood estimates how plausible or frequent a harmful event is, while impact estimates the magnitude of consequences if it occurs.
Read the entry →Reduce remote attack paths by limiting which identities, systems, zones, and protocols can reach sensitive resources. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Control attachment and installation of hardware that could introduce code, storage, network access, or unauthorized interfaces. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Restrict who and what may install software so unapproved tools, packages, drivers, and persistence mechanisms are harder to introduce. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Link Target (T1608.005) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Linux account lifecycle management governs creation, modification, suspension, deletion, home directories, shells, group membership, service identities, and residual access from onboarding through deprovisioning.
Read the entry →The Linux Audit Framework records security-relevant system calls, identity activity, object access, and policy events according to rules designed for investigation and accountability.
Read the entry →Linux capabilities and controlled privilege delegation split broad superuser power into narrower rights so services and administrators receive only the authority required for a task.
Read the entry →Linux Security Modules provide a common kernel framework for mandatory access-control and other security mechanisms that enforce policy beyond traditional user and group permissions.
Read the entry →Linux and Mac Permissions (T1222.002) is an Enterprise ATT&CK sub-technique under File and Directory Permissions Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →ListPlanting (T1055.015) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →Living off the land describes adversary use of legitimate system tools, interpreters, services, and administration features to blend malicious actions into ordinary operations.
Read the entry →Living-off-the-Land Techniques is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Local Account (T1087.001) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Read the entry →Local Account (T1136.001) is an Enterprise ATT&CK sub-technique under Create Account. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →Local Accounts (T1078.003) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.
Read the entry →Local Data Staging (T1074.001) is an Enterprise ATT&CK sub-technique under Data Staged. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →Local Email Collection (T1114.001) is an Enterprise ATT&CK sub-technique under Email Collection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →Local Groups (T1069.001) is an Enterprise ATT&CK sub-technique under Permission Groups Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Read the entry →Local Storage Discovery (T1680) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Log analysis interprets recorded events to answer questions about system behavior, user activity, failures, attacks, and the sequence of an incident.
Read the entry →Log Enumeration (T1654) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Log quality engineering measures and improves whether security events are complete, accurate, timely, consistent, attributable, protected, and usable for the detections and investigations that depend on them.
Read the entry →Log rotation and retention balance evidence needs, storage limits, privacy, performance, legal obligations, and reliable archival so important events remain available for the required period.
Read the entry →Log source onboarding is the controlled process of bringing a new event source into security monitoring with validated collection, parsing, timestamps, identifiers, access controls, retention, health checks, and documented analytic value.
Read the entry →Login Hook (T1037.002) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Login Items (T1547.015) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Logon Script (Windows) (T1037.001) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Lua (T1059.011) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →A media access control address is a link-layer identifier used by network interfaces and local network technologies to deliver frames within a broadcast domain.
Read the entry →MITRE ATT&CK for ICS organizes observed adversary tactics and techniques that affect industrial control systems and can support threat modeling, detection, testing, and response.
Read the entry →How to measure coverage without equating a colored matrix cell with a validated detection or effective control.
Read the entry →How defenders move from required observations to analytic logic, testing, tuning, ownership, and response-ready evidence.
Read the entry →A structured, versioned learning center that connects Enterprise ATT&CK adversary behavior to architecture, telemetry, detection, mitigation, investigation, recovery, and Bare Metal Cyber coursework.
Read the entry →How ATT&CK connects named groups, malware, tools, campaigns, and evidence-backed procedure examples to techniques without treating labels as permanent truth.
Read the entry →How stable identifiers, versions, modified dates, deprecation, and revocation support defensible mappings and repeatable maintenance.
Read the entry →How ATT&CK mitigation objects can inform layered control design while avoiding the false assumption that one mitigation universally stops a technique.
Read the entry →How ATT&CK platform metadata helps analysts distinguish Windows, Linux, macOS, cloud, identity, SaaS, containers, network devices, ESXi, and pre-compromise activity.
Read the entry →How ATT&CK separates adversary goals, general behaviors, more specific behavior variants, and the observed procedures used in real operations.
Read the entry →How three complementary models answer different questions about adversary behavior, operation progression, relationships, and analytic context.
Read the entry →MLOps security protects the pipelines, repositories, registries, features, models, identities, approvals, and deployment mechanisms used across the machine-learning lifecycle.
Read the entry →MMC (T1218.014) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →MSBuild (T1127.001) is an Enterprise ATT&CK sub-technique under Trusted Developer Utilities Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →Machine identity governance manages service accounts, workload identities, certificates, tokens, and keys used by automation as governed identities with owners and life cycles.
Read the entry →Machine-learning observability combines system, data, model, and business evidence so teams can understand whether an AI service is healthy and trustworthy in operation.
Read the entry →Mail Protocols (T1071.003) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Apply PR.IR-04 to achieve this CSF 2.0 outcome: Adequate resource capacity to ensure availability is maintained.
Read the entry →Make and Impersonate Token (T1134.003) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →Malicious Copy and Paste (T1204.004) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Malicious File (T1204.002) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Malicious Image (T1204.003) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Malicious Library (T1204.005) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Malicious Link (T1204.001) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Malvertising (T1583.008) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Malware (T1587.001) is an Enterprise ATT&CK sub-technique under Develop Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Malware (T1588.001) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Malware defense validation tests whether prevention, detection, isolation, and response controls work against relevant behaviors without exposing production systems to uncontrolled risk.
Read the entry →Malware intelligence converts static features, runtime behavior, configuration, infrastructure, and family relationships into information defenders can use.
Read the entry →Malware sandboxing executes or emulates suspicious code in a controlled environment to observe processes, files, registry changes, network activity, persistence, evasion, and other behavior without exposing production systems.
Read the entry →Malware is software or code used to disrupt, spy, steal, persist, evade, manipulate, or provide unauthorized control.
Read the entry →Apply ID.RA-07 to achieve this CSF 2.0 outcome: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked.
Read the entry →Apply PR.AA-01 to achieve this CSF 2.0 outcome: Identities and credentials for authorized users, services, and hardware are managed by the organization.
Read the entry →Apply PR.AA-05 to achieve this CSF 2.0 outcome: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties.
Read the entry →Managed cloud services shift infrastructure and operational tasks to the provider while leaving customers responsible for configuration, identities, data, integrations, and appropriate use.
Read the entry →Managed service security governance defines how an organization directs, monitors, and assures security outcomes when important capabilities are operated by external providers.
Read the entry →Management plane security protects the interfaces, protocols, identities, networks, and workflows used to configure infrastructure and security systems.
Read the entry →Managing resistance to security change distinguishes legitimate operational concerns from avoidance, engages affected groups, adapts implementation, and protects non-negotiable outcomes.
Read the entry →Mandatory access control enforces centrally defined rules using security labels, classifications, and clearances that ordinary users cannot alter.
Read the entry →A disciplined method for mapping observed behavior to ATT&CK techniques, preserving evidence, confidence, scope, and the difference between an action and an inferred objective.
Read the entry →Mark-of-the-Web Bypass (T1553.005) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0020, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2000 incident in which a wastewater control system was abused to disrupt operations and release sewage.
Read the entry →Masquerade Account Name (T1036.010) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Masquerade File Type (T1036.008) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Masquerade Task or Service (T1036.004) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →An adversary makes an artifact, process, account, service, or task appear legitimate by using misleading names, locations, metadata, or presentation.
Read the entry →Master-data management defines authoritative records for shared entities and governs how duplicates, conflicts, reference values, and downstream copies are resolved.
Read the entry →Match Legitimate Resource Name or Location (T1036.005) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Mavinject (T1218.013) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Maximum tolerable downtime is the longest disruption a business process can endure before consequences become unacceptable.
Read the entry →Mean time metrics summarize average durations for activities such as detection, acknowledgment, response, repair, recovery, or failure, but require precise definitions to be useful.
Read the entry →Medical device cybersecurity manages the confidentiality, integrity, availability, authenticity, resilience, and safe operation of connected or software-enabled devices throughout design, clinical use, maintenance, vulnerability response, and retirement.
Read the entry →Memory Forensics is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Read the entry →Messaging Applications (T1213.005) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →Microsegmentation governance defines how fine-grained workload communication policies are designed, approved, deployed, monitored, and maintained as applications change.
Read the entry →Misuse and abuse cases describe how a system could be intentionally misused, manipulated, or driven into unsafe behavior.
Read the entry →Mobile app permissions authorize access to protected device capabilities and data such as location, camera, microphone, contacts, files, sensors, notifications, nearby devices, and background activity.
Read the entry →Mobile application architecture combines device code, operating-system services, local storage, backend APIs, identity providers, push services, update channels, and third-party SDKs; security depends on how trust and data move across all of those components.
Read the entry →Mobile application security testing evaluates architecture, storage, cryptography, authentication, network communication, platform interaction, code quality, resilience, privacy, backend APIs, and release integrity across supported mobile platforms.
Read the entry →Mobile authentication and authorization combine user, device, application, and backend trust decisions so a mobile client can establish an identity while servers enforce what that identity may do with each resource and transaction.
Read the entry →Mobile certificate validation verifies that a server certificate chains to a trusted authority, matches the intended service, is valid for the current time and policy, and has not been revoked or otherwise rejected; pinning adds a narrower application trust decision for selected keys or certificates.
Read the entry →Mobile device security protects phones, tablets, and portable endpoints through device management, secure configuration, identity controls, application governance, and data protection.
Read the entry →Model data leakage occurs when training or evaluation uses information that would not legitimately be available at prediction time, causing performance to appear better than it will be in practice.
Read the entry →Model drift monitoring detects when input distributions, relationships, outcomes, or operational conditions move away from those used to build and validate a model.
Read the entry →Model explainability and transparency provide appropriate information about a model’s purpose, inputs, limitations, behavior, uncertainty, and decision role to affected audiences.
Read the entry →Model performance metrics summarize different kinds of error, such as accuracy, precision, recall, calibration, and regression loss.
Read the entry →Model risk management establishes governance for selecting, approving, using, changing, challenging, and retiring models according to their impact and uncertainty.
Read the entry →Model supply-chain security verifies the origin, integrity, dependencies, licenses, safety, and allowed use of models and supporting artifacts obtained or moved across organizational boundaries.
Read the entry →Model validation and testing determine whether a model is appropriate, reproducible, robust, secure, fair, and effective for a defined population and decision context.
Read the entry →Model-based systems engineering uses connected models to describe requirements, structure, behavior, interfaces, constraints, and verification across the system lifecycle.
Read the entry →Modify Authentication Process (T1556) is an Enterprise ATT&CK technique associated with Defense Impairment, Persistence, Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Modify Cloud Compute Configurations (T1578.005) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Modify Cloud Compute Infrastructure (T1578) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Modify Cloud Resource Hierarchy (T1666) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Modify Registry (T1112) is an Enterprise ATT&CK technique associated with Defense Impairment, Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Modify System Image (T1601) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Modify or Spoof Tool UI (T1685.003) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Apply DE.CM-09 to achieve this CSF 2.0 outcome: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events.
Read the entry →Apply DE.CM-06 to achieve this CSF 2.0 outcome: External service provider activities and services are monitored to find potentially adverse events.
Read the entry →Apply DE.CM-01 to achieve this CSF 2.0 outcome: Networks and network services are monitored to find potentially adverse events.
Read the entry →Apply DE.CM-03 to achieve this CSF 2.0 outcome: Personnel activity and technology usage are monitored to find potentially adverse events.
Read the entry →Apply GV.SC-07 to achieve this CSF 2.0 outcome: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
Read the entry →Apply DE.CM-02 to achieve this CSF 2.0 outcome: The physical environment is monitored to find potentially adverse events.
Read the entry →Mshta (T1218.005) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Msiexec (T1218.007) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Multi-cloud security governs identity, data, networking, workloads, monitoring, and operations across services from more than one cloud provider.
Read the entry →Multi-Factor Authentication (T1556.006) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Read the entry →Multi-Factor Authentication Interception (T1111) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Multi-Factor Authentication Request Generation (T1621) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Multi-Stage Channels (T1104) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Require more than one independent factor for sensitive authentication so a stolen password or token alone is insufficient. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Multi-hop Proxy (T1090.003) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Multifactor authentication strengthens sign-in by requiring independent evidence from different factor categories rather than relying on one credential alone.
Read the entry →Multimodal AI security addresses systems that combine text, images, audio, video, sensor data, or other modalities in one decision process.
Read the entry →Mutual Exclusion (T1480.002) is an Enterprise ATT&CK sub-technique under Execution Guardrails. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →NFS security protects shared Unix-style filesystems through controlled exports, identity mapping, network restrictions, transport protection, least privilege, and careful handling of root access.
Read the entry →The NIST Cybersecurity Framework organizes cybersecurity outcomes so organizations can understand current capability, identify priorities, communicate risk, and improve over time.
Read the entry →NIST SP 800-53 provides a broad catalog of security and privacy controls that organizations can select, tailor, implement, assess, and monitor according to risk and requirements.
Read the entry →NTDS (T1003.003) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →NTFS File Attributes (T1564.004) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →NTLM is a Windows challenge-response authentication family retained for compatibility when Kerberos or modern authentication cannot be used; its weaker trust properties make dependency reduction an important defensive goal.
Read the entry →Name Resolution Poisoning and SMB Relay (T1557.001) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
Read the entry →An adversary calls operating-system or runtime application programming interfaces directly to perform actions that might otherwise require ordinary utilities.
Read the entry →Natural language processing converts human language into representations that support classification, extraction, generation, translation, and dialogue.
Read the entry →Netsh Helper DLL (T1546.007) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →Network access control evaluates who or what is connecting and applies an access decision based on identity, device posture, location, role, and policy.
Read the entry →Network address planning allocates IPv4 and IPv6 space so networks can scale, summarize routes, isolate environments, avoid overlap, and support operations.
Read the entry →Network Address Translation (NAT) is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Network Address Translation Traversal (T1599.001) is an Enterprise ATT&CK sub-technique under Network Boundary Bridging. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Network architecture validation proves that a design and its implementation satisfy documented business, technical, security, compliance, availability, and operational requirements.
Read the entry →Network Boundary Bridging (T1599) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Apply ID.AM-03 to achieve this CSF 2.0 outcome: Representations of the organization’s authorized network communication and internal and external network data flows are maintained.
Read the entry →Network Denial of Service (T1498) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Network detection and response uses traffic, flow, protocol, and metadata observations to identify suspicious behavior and support investigation across network boundaries.
Read the entry →Network Device Authentication (T1556.004) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Read the entry →Network Device CLI (T1059.008) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Network Device Configuration Dump (T1602.002) is an Enterprise ATT&CK sub-technique under Data from Configuration Repository. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →Network Device Firewall (T1686.002) is an Enterprise ATT&CK sub-technique under Disable or Modify System Firewall. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Network Devices (T1584.008) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Detect and block malicious or policy-violating network activity in line before it reaches its intended target. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Network Logon Script (T1037.003) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Network Provider DLL (T1556.008) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Read the entry →Network route resilience ensures that routing converges safely through link, device, provider, and policy failures without creating loops, blackholes, or uncontrolled paths.
Read the entry →Network Security Appliances (T1590.006) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Network segmentation separates systems and traffic into controlled zones so access can be constrained, monitored, and aligned with risk.
Read the entry →Divide networks and trust zones so compromise in one area does not provide unrestricted access to users, services, management paths, or critical assets. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Network Segmentation and Microsegmentation is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Network Service Discovery (T1046) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Network Share Connection Removal (T1070.005) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Network Share Discovery (T1135) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Network Sniffing (T1040) is an Enterprise ATT&CK technique associated with Credential Access, Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Network Time Protocol Security describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Read the entry →Network time security ensures systems receive accurate, resilient, and authenticated time appropriate to their operational and security requirements.
Read the entry →Network Topology (T1590.004) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Network traffic analysis examines packet, flow, DNS, proxy, TLS, routing, and session metadata to understand communication patterns, identify suspicious behavior, and reconstruct activity across network trust boundaries.
Read the entry →Network Traffic Flow Records is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Network Trust Dependencies (T1590.003) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Network-attached storage security protects shared file appliances through hardened management, segmented data access, strong identity, protocol controls, snapshots, monitoring, and recoverable configuration.
Read the entry →A neural network transforms inputs through weighted layers and nonlinear functions that are adjusted during training.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0002, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an espionage campaign reported against oil, energy, and petrochemical companies and related individuals.
Read the entry →Non-Application Layer Protocol (T1095) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Non-Standard Encoding (T1132.002) is an Enterprise ATT&CK sub-technique under Data Encoding. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Non-Standard Port (T1571) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Nonproduction data governance controls what data may enter development, test, QA, staging, training, and demonstration environments and how it is transformed, accessed, retained, and removed.
Read the entry →Notebook security protects interactive analytic environments against unauthorized access, secret exposure, untrusted code, unsafe outputs, uncontrolled packages, and accidental publication.
Read the entry →Apply RS.CO-02 to achieve this CSF 2.0 outcome: Internal and external stakeholders are notified of incidents.
Read the entry →OAuth 2.0 is an authorization framework that lets a client obtain limited access to a resource on behalf of a user or itself without receiving the user's password.
Read the entry →OAuth 2.0 Authorization is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →OPC UA trust management governs application identities, certificates, trust lists, security policies, endpoint configuration, and lifecycle actions for industrial data exchange.
Read the entry →An adversary reads operating-system memory, databases, caches, registry material, or directory replication data to obtain credential artifacts.
Read the entry →OS Exhaustion Flood (T1499.001) is an Enterprise ATT&CK sub-technique under Endpoint Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →The OSI model organizes network communication into seven conceptual layers, from physical transmission through user-facing application services.
Read the entry →OT asset criticality ranks components and functions by their contribution to safety, process control, environmental protection, quality, continuity, and recovery.
Read the entry →OT asset inventory confidence measures how complete, accurate, current, attributable, and operationally useful an inventory is for devices, software, communications, ownership, and dependencies.
Read the entry →OT consequence-driven risk analysis starts with unacceptable physical, safety, environmental, operational, and business outcomes, then identifies the cyber-enabled paths that could produce them.
Read the entry →OT edge and cloud integration moves data, analytics, management, and sometimes control-related functions across boundaries that must preserve safety, autonomy, latency, trust, and recoverability.
Read the entry →OT historian security protects time-series process data, tags, events, interfaces, and analytics that support operations, engineering, quality, investigation, and business decisions.
Read the entry →OT incident command integration aligns cyber investigation and containment with operations, engineering, safety, emergency management, communications, legal, vendors, and business continuity.
Read the entry →OT incident exercises rehearse how people, systems, procedures, vendors, and physical operations respond to cyber events under realistic safety and continuity constraints.
Read the entry →An OT job safety analysis breaks work into steps, identifies hazards and cyber dependencies, and defines controls before maintenance, testing, configuration, or incident activity begins.
Read the entry →An OT jump server is a controlled intermediary for administrative or support access into restricted environments and must be treated as a high-consequence security boundary.
Read the entry →OT legacy system compensating controls reduce exposure when obsolete hardware, operating systems, software, or protocols cannot support preferred security safeguards.
Read the entry →OT log collection under constraints prioritizes high-value security and operational evidence while respecting limited storage, bandwidth, device capability, vendor support, safety, and timing requirements.
Read the entry →OT network monitoring baselines describe expected devices, peers, protocols, commands, direction, timing, volume, and maintenance behavior so meaningful deviations can be investigated.
Read the entry →OT zones group assets with similar function, trust, criticality, and security requirements, while conduits define and control the communications allowed between them.
Read the entry →OT patch and vulnerability decisions balance exploitability and exposure against safety, availability, vendor support, compatibility, maintenance windows, rollback, and recovery.
Read the entry →OT recovery restores trustworthy control, visibility, configuration, data, and operations in a sequence that protects people, environment, equipment, and process stability.
Read the entry →OT remote access governance limits who can connect, from what managed path, for what approved purpose, to which assets, for how long, and under what monitoring and response controls.
Read the entry →OT safety and cybersecurity integrate protection of people, environment, equipment, process quality, continuity, and information across systems that affect the physical world.
Read the entry →An OT scenario-based risk assessment describes a credible actor or failure path, affected assets and process, enabling conditions, controls, consequences, uncertainty, and response options.
Read the entry →OT supply chain risk includes weaknesses, malicious functionality, counterfeit components, insecure development, remote services, support dependencies, and lifecycle failures in products and providers.
Read the entry →OT vendor access monitoring observes and evaluates external support sessions, commands, file transfers, configuration changes, tools, targets, and outcomes against approved work.
Read the entry →OT wireless security controls radio-based monitoring, control, maintenance, telemetry, and backhaul across technologies with different range, bandwidth, reliability, and security properties.
Read the entry →An adversary encodes, encrypts, packs, fragments, or otherwise transforms files and information to make discovery or analysis more difficult.
Read the entry →Observability correlation identifiers connect related logs, traces, metrics, events, jobs, users, changes, and requests across distributed automation.
Read the entry →Observability coverage analysis compares priority assets, identities, behaviors, paths, and failure modes with actual sensors, logs, fields, retention, analytics, and response access.
Read the entry →An operator purchases, steals, downloads, or otherwise acquires exploits, malware, credentials, information, or tools rather than developing them independently.
Read the entry →Odbcconf (T1218.008) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Office Application Startup (T1137) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Office Template Macros (T1137.001) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →Office Test (T1137.002) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →On-Path Attacks describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Read the entry →One-Way Communication (T1102.003) is an Enterprise ATT&CK sub-technique under Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →OpenID Connect adds an identity layer to OAuth 2.0 so a relying application can authenticate a user and receive standardized identity claims.
Read the entry →Harden operating systems through secure defaults, least functionality, protected administration, and continuously enforced configuration baselines. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Operating System Fundamentals concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0060, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2024 MirrorFace spearphishing campaign against organizations in Japan and Central Europe.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0012, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a cyber-espionage campaign against technology and manufacturing companies reported since at least 2019.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0061, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2024 suspected PRC-nexus campaign against business-to-business IT service providers in Southern Europe.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0022, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an espionage operation using employment-themed lures against defense, aerospace, government, and other sectors.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0016, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a long-running espionage campaign reported across industries in East Asia, Southeast Asia, Europe, and the United States.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0023, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing an APT29 campaign beginning in 2013 against foreign ministries and a European embassy in Washington, D.C..
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0006, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2017–2018 campaign against humanitarian-aid and inter-Korean affairs organizations across several countries.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0048, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a March–April 2024 campaign that exploited a PAN-OS GlobalProtect zero-day vulnerability.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0013, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a global espionage campaign reported against nuclear, defense, government, energy, and financial organizations.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0005, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a campaign reported against Colombian government and private-sector organizations, especially energy and metallurgical entities.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0054, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a mobile campaign that used zero-click iMessage exploit chains and the TriangleDB implant against iOS devices.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0014, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a global cyber-espionage campaign reported against governments, managed-service providers, and many industries.
Read the entry →Operational technology security protects systems that monitor or control physical processes, including industrial control systems, building systems, manufacturing equipment, and safety-related environments.
Read the entry →Operational transition and handover move a deliverable into sustained service with accepted ownership, documentation, training, support, monitoring, access, recovery, maintenance, and unresolved-risk records.
Read the entry →Optimize and automate requires improving the underlying work before automating it and retaining human judgment, accountability, observability, and recovery around automated decisions.
Read the entry →Organizational change support prepares affected people, processes, structures, incentives, and operating practices to adopt and sustain a project outcome.
Read the entry →Use GV.OC to manage mission, stakeholders, dependencies, and obligations that shape cybersecurity risk decisions within the Govern Function.
Read the entry →Apply GV.OC-05 to achieve this CSF 2.0 outcome: Outcomes, capabilities, and services that the organization depends on are understood and communicated.
Read the entry →Apply GV.OC-01 to achieve this CSF 2.0 outcome: The organizational mission is understood and informs cybersecurity risk management.
Read the entry →Organizational units are Active Directory containers used to organize objects, apply Group Policy, and delegate narrowly defined administrative tasks without granting broad domain privileges.
Read the entry →The organizations and people dimension covers structure, culture, roles, authority, communication, competence, capacity, and the human conditions required to create and support value.
Read the entry →Maintain a communications path independent of potentially compromised production identity, messaging, and network services. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0042, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a 2021 OilRig campaign that targeted Israeli organizations using the SampleCheck5000 downloader and Solar backdoor.
Read the entry →Outlook Forms (T1137.003) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →Outlook Home Page (T1137.004) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →Outlook Rules (T1137.005) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →Overfitting occurs when a model fits training examples or noise too closely and does not generalize to new conditions.
Read the entry →Use GV.OV to manage reviewing outcomes, coverage, performance, and changes that require strategy adjustment within the Govern Function.
Read the entry →Overwrite Process Arguments (T1036.011) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Pluggable Authentication Modules centralize Linux authentication decisions through ordered policy stacks that can combine passwords, lockouts, multifactor methods, directories, and session controls.
Read the entry →A PCI Attestation of Compliance is the signed declaration that identifies the assessed entity, validation method, applicable environment, and compliance status supported by the associated assessment.
Read the entry →PCI business-as-usual compliance embeds payment-security responsibilities, control operation, evidence, change review, monitoring, and remediation into normal work throughout the year.
Read the entry →PCI cloud scoping identifies payment-data flows, cloud resources, management planes, identities, services, providers, regions, logging, and shared responsibilities that store, process, transmit, or affect account-data security.
Read the entry →PCI compensating controls address a legitimate technical or documented business constraint by providing additional protection that meets the intent and rigor of the original requirement.
Read the entry →PCI cryptographic key control evidence demonstrates that key generation, distribution, storage, access, rotation, replacement, revocation, destruction, and split knowledge or dual control operate as designed.
Read the entry →The PCI DSS customized approach allows an entity to meet a requirement’s customized objective through controls designed for its environment, supported by targeted risk analysis and rigorous validation.
Read the entry →The PCI DSS defined approach implements and assesses the stated requirements and testing procedures as written in the standard.
Read the entry →PCI DSS scope determination identifies the people, processes, technologies, facilities, and third parties that store, process, transmit, or can affect the security of payment account data.
Read the entry →PCI data retention and secure purge limit payment account data to documented business or legal need and remove it reliably from production, logs, backups, archives, endpoints, exports, and provider systems when no longer required.
Read the entry →PCI e-commerce payment page security protects the scripts, content, headers, integrations, and change paths that can influence how a customer’s browser captures or transmits payment data.
Read the entry →PCI evidence sampling selects representative systems, locations, users, events, configurations, and time periods so an assessor can form a defensible conclusion about control operation.
Read the entry →PCI file integrity monitoring detects unauthorized changes to critical system files, configuration files, content, and other security-relevant objects and routes meaningful alerts for investigation.
Read the entry →PCI incident response testing exercises payment-data scenarios, roles, communications, containment, evidence, third-party coordination, legal obligations, recovery, and lessons before a real compromise.
Read the entry →PCI PIN security protects personal identification numbers and cryptographic keys used in payment transactions through controlled devices, encryption, key management, processing, and operational procedures.
Read the entry →PCI penetration test evidence shows that qualified testers evaluated relevant internal and external attack paths, segmentation, applications, network layers, scope assumptions, exploitable findings, and remediation.
Read the entry →PCI point-to-point encryption protects account data from the point of interaction through decryption within a validated solution, using controlled devices, applications, keys, and operational responsibilities.
Read the entry →A PCI Report on Compliance records the assessor’s scope, methods, evidence, observations, testing, findings, and conclusion for an on-site PCI DSS assessment.
Read the entry →PCI segmentation validation demonstrates that controls intended to isolate the cardholder data environment are correctly designed, implemented, maintained, and resistant to bypass.
Read the entry →PCI self-assessment questionnaire selection matches an eligible merchant or service environment to the validation instrument that reflects its payment channels, technology, outsourcing, and account-data handling.
Read the entry →A PCI shared responsibility matrix assigns each applicable requirement and control activity among the assessed entity, service providers, customers, and other parties, including the evidence each must produce.
Read the entry →The PCI Software Security Framework establishes security expectations for payment software and its lifecycle, including secure design, development, testing, release, vulnerability management, and ongoing maintenance.
Read the entry →A PCI targeted risk analysis uses documented threat, likelihood, impact, asset, control, and operating context to justify certain frequencies or support customized-approach controls.
Read the entry →PCI third-party service provider oversight establishes which payment-security responsibilities a provider performs, how compliance is evidenced, and how the customer monitors changes, incidents, subcontractors, and gaps.
Read the entry →PCI time synchronization keeps security-relevant systems aligned to trusted time sources so logs, alerts, transactions, authentication events, and forensic evidence can be correlated accurately.
Read the entry →PCI tokenization replaces account data with substitute values while preserving tightly controlled tokenization, detokenization, key, vault, and administrative components that remain security-critical.
Read the entry →PKI architecture defines certificate authorities, registration, trust anchors, certificate profiles, validation, revocation, key protection, issuance workflows, and relying-party behavior.
Read the entry →PLC logic change monitoring detects and verifies modifications to control logic, parameters, firmware, operating mode, and controller configuration against approved work.
Read the entry →Package repository trust verifies the origin, integrity, authorization, and lifecycle of software packages before they are introduced into managed systems.
Read the entry →Packet Capture and PCAP Analysis is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Read the entry →Parent PID Spoofing (T1134.004) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →The partners and suppliers dimension considers external capabilities, contracts, shared responsibilities, concentration risk, integration, assurance, and relationship governance.
Read the entry →Pass the Hash (T1550.002) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Read the entry →Pass the Ticket (T1550.003) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Read the entry →Pass-the-Hash is a credential replay technique in which an attacker uses a captured NTLM password hash to authenticate without learning or typing the original plaintext password.
Read the entry →Passive DNS analysis uses historical domain-to-address observations to examine infrastructure changes, relationships, reuse, and timing without directly querying adversary systems.
Read the entry →Passive OT asset discovery infers devices, roles, communications, protocols, and changes from observed traffic without actively interrogating sensitive control equipment.
Read the entry →Passkeys are FIDO credentials that use public-key cryptography to provide passwordless, phishing-resistant sign-in through a device or credential provider.
Read the entry →Password aging and lockout policy coordinates credential lifetime, failed-attempt controls, recovery, service-account handling, and monitoring without creating predictable resets or denial-of-service risk.
Read the entry →Password Attacks describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Read the entry →Password Cracking (T1110.002) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Password Filter DLL (T1556.002) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Read the entry →Password Guessing (T1110.001) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Password Managers (T1555.005) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Set password and passphrase requirements that resist guessing, reuse, default credentials, and unsafe recovery practices without encouraging predictable workarounds. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Password Policy Discovery (T1201) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Password security combines user-friendly length, protection against reuse and compromise, secure storage, rate limiting, recovery controls, and stronger authentication where needed.
Read the entry →Password Spraying describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Read the entry →Password Spraying (T1110.003) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Passwordless authentication verifies identity without requiring the user to enter a memorized password, using methods such as public-key credentials, device-bound keys, or one-time links.
Read the entry →Patch management identifies, evaluates, tests, deploys, and verifies updates that correct vulnerabilities, defects, and unsupported components.
Read the entry →Patch System Image (T1601.001) is an Enterprise ATT&CK sub-technique under Modify System Image. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Patch workflow rollback readiness prepares tested recovery paths when an update causes instability, incompatibility, or security regression.
Read the entry →Patches, Updates, and Upgrades is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Path Interception by PATH Environment Variable (T1574.007) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →Path Interception by Search Order Hijacking (T1574.008) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →Path Interception by Unquoted Path (T1574.009) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →Path traversal occurs when untrusted input influences a file or directory path and allows access outside the application’s intended storage boundary through relative segments, alternate encodings, symbolic links, or platform-specific path behavior.
Read the entry →Payment data flow mapping records where account data is captured, transmitted, processed, stored, displayed, backed up, logged, tokenized, and destroyed across every payment channel.
Read the entry →A payment page script inventory records each script authorized to execute in the consumer’s browser, including source, owner, purpose, integrity, dependencies, approval, and monitoring status.
Read the entry →Payment terminal security protects point-of-interaction devices through approved design, inventory, deployment, physical inspection, tamper awareness, access control, maintenance, and replacement procedures.
Read the entry →Penetration test remediation validation confirms that reported attack paths are closed, compensating controls work as intended, and related weaknesses are not still exploitable.
Read the entry →A penetration test report explains what was tested, what was demonstrated, why it matters, how confident the tester is, and what should happen next.
Read the entry →A penetration test moves through authorization, planning, reconnaissance, analysis, controlled exploitation, post-exploitation, evidence handling, reporting, cleanup, and retesting.
Read the entry →People, process, and technology form an interdependent security system: skilled people make decisions, repeatable processes coordinate work, and technology implements or supports controls.
Read the entry →Peripheral Device Discovery (T1120) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Permission Groups Discovery (T1069) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Adversaries preserve access through accounts, services, scheduled mechanisms, startup locations, application components, cloud resources, or configuration changes.
Read the entry →Phishing uses deceptive messages, sites, calls, or prompts to persuade a person to reveal information, approve access, send money, or run malicious content.
Read the entry →Phishing (T1566) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Phishing for Information (T1598) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Physical security dependencies are facilities, power, environmental systems, devices, access controls, and supply conditions whose failure can undermine digital security and service continuity.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0036, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a February 2024 malicious-email campaign distributing a substantially revised Pikabot variant.
Read the entry →Pipeline approval gates prevent code, infrastructure, models, or configuration from advancing until required automated checks and accountable human decisions are satisfied.
Read the entry →A Plan of Action and Milestones records an identified weakness, the corrective work, accountable owner, resources, milestones, schedule, status, dependencies, and remaining risk.
Read the entry →Use PR.PS to manage configuration, maintenance, logs, software control, secure development, and platform life cycle within the Protect Function.
Read the entry →Plist File Modification (T1647) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Pluggable Authentication Modules (T1556.003) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Read the entry →Poisoned Pipeline Execution (T1677) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Policies state organizational intent, standards define required conditions, and procedures explain how people perform specific work.
Read the entry →Use GV.PO to manage risk-informed policy establishment, communication, enforcement, review, and revision within the Govern Function.
Read the entry →Policy as code expresses security, compliance, architecture, and operational rules in machine-evaluable form so they can be tested and enforced consistently.
Read the entry →Polymorphic Code (T1027.014) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Port Address Translation (PAT) is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Port Knocking (T1205.001) is an Enterprise ATT&CK sub-technique under Traffic Signaling. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Command and Control context.
Read the entry →Port Monitors (T1547.010) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Portable Executable Injection (T1055.002) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →Ports help identify application services at transport endpoints, while protocols define the rules systems use to exchange information.
Read the entry →A post-implementation security review evaluates whether delivered controls, requirements, operations, benefits, and risk outcomes remain effective after the system has entered real use.
Read the entry →Post-quantum cryptography readiness inventories cryptographic dependencies, identifies long-lived confidentiality and signature needs, tests approved algorithms, plans interoperability, and sequences migration.
Read the entry →Apply GV.SC-10 to achieve this CSF 2.0 outcome: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement.
Read the entry →Power Settings (T1653) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →PowerShell (T1059.001) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →PowerShell Profile (T1546.013) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →PowerShell Security and Logging is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Read the entry →Pre-commit secret detection identifies likely credentials and sensitive values before they enter repository history, while server-side controls provide a second enforcement layer.
Read the entry →Pre-OS Boot (T1542) is an Enterprise ATT&CK technique associated with Stealth, Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Reduce the information, exposure, trust, and infrastructure opportunities an adversary can exploit before obtaining access. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Apply RS.AN-07 to achieve this CSF 2.0 outcome: Incident data and metadata are collected, and their integrity and provenance are preserved.
Read the entry →Apply RS.AN-06 to achieve this CSF 2.0 outcome: Actions performed during an investigation are recorded, and the records’ integrity and provenance are preserved.
Read the entry →Prevent Command History Logging (T1690) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Apply PR.PS-05 to achieve this CSF 2.0 outcome: Installation and execution of unauthorized software are prevented.
Read the entry →Primary account number storage protection reduces retained payment data and renders stored PAN unreadable through approved methods while controlling display, access, keys, backups, and recovery.
Read the entry →Print Processors (T1547.012) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Apply GV.SC-04 to achieve this CSF 2.0 outcome: Suppliers are known and prioritized by criticality.
Read the entry →Privacy audit evidence management preserves relevant, reliable, traceable, and access-controlled records so an independent reviewer can reconstruct what a control did and when.
Read the entry →A privacy breach assessment workflow applies defined facts, legal tests, risk factors, and approval authority to decide whether an event requires notification or another response.
Read the entry →Privacy complaint operations provide a controlled path to receive, classify, investigate, resolve, communicate, and learn from concerns about personal-data handling.
Read the entry →Privacy control effectiveness testing evaluates whether a control is appropriately designed, implemented, and operating consistently enough to achieve its stated objective.
Read the entry →Privacy data classification groups personal data by sensitivity, identifiability, context, legal constraints, and potential impact so handling controls can be applied consistently.
Read the entry →Privacy engineering objectives turn broad values and obligations into measurable system properties that manage predictability, manageability, and disassociability risks.
Read the entry →A privacy governance operating model describes how oversight, policy, execution, assurance, escalation, and reporting work together across centralized and distributed teams.
Read the entry →A privacy impact assessment examines how a system, process, or change affects individuals and how privacy risks will be managed.
Read the entry →Privacy incident management addresses events that may harm individuals or violate expectations for how personal information is handled.
Read the entry →A privacy incident register is the authoritative record of suspected and confirmed events, affected processing, decisions, notifications, remediation, and lessons learned.
Read the entry →Privacy notice change management keeps public and internal disclosures synchronized with actual collection, use, sharing, retention, automation, and rights practices.
Read the entry →A privacy policy and control hierarchy connects principles and policy statements to standards, procedures, technical requirements, evidence, and accountable owners.
Read the entry →A privacy program charter states the program’s mandate, scope, authority, decision rights, priorities, and reporting obligations in terms that leaders and operators can use.
Read the entry →A privacy program maturity assessment evaluates how consistently governance, processes, people, technology, evidence, and improvement operate across the organization.
Read the entry →Privacy program metrics show whether privacy obligations, controls, and outcomes are improving, deteriorating, or requiring a decision.
Read the entry →Privacy regulatory change monitoring identifies relevant legal, regulatory, and enforcement changes and translates them into scoped program, product, contract, and control updates.
Read the entry →Privacy rights request deadline management converts jurisdictional timing rules and internal service targets into tracked milestones, dependencies, escalation, and proof of completion.
Read the entry →Privacy rights request verification confirms that a requester is entitled to act without collecting excessive new data or exposing another person’s information.
Read the entry →Privacy risk in mergers and divestitures arises when data, systems, notices, permissions, vendors, obligations, and controls are combined, separated, transferred, or retired.
Read the entry →A privacy role accountability matrix assigns who is responsible, accountable, consulted, and informed for recurring privacy decisions and control activities.
Read the entry →Privacy runtime monitoring detects when deployed processing diverges from approved purpose, data scope, access, destination, retention, consent, or user-choice expectations.
Read the entry →Privacy threat modeling identifies how data processing can create surveillance, linkability, identification, disclosure, exclusion, loss of control, or other adverse consequences.
Read the entry →Privacy usability testing evaluates whether people can notice, understand, choose, change, and verify privacy-relevant actions without coercion or unnecessary effort.
Read the entry →Privacy governs appropriate processing of personal information and effects on people, while security protects information and systems from unauthorized access, change, disclosure, loss, and disruption.
Read the entry →Privacy by Design integrates privacy objectives into requirements, architecture, defaults, workflows, testing, and operations rather than adding notices after deployment.
Read the entry →Privacy-enhancing technologies reduce exposure or enable useful processing with less disclosure, linkage, or centralized access to personal data.
Read the entry →Privacy-preserving machine learning applies technical and governance measures to limit exposure of personal or sensitive information during training, evaluation, inference, and sharing.
Read the entry →Private Keys (T1552.004) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Private-link and service-endpoint security governs private access to managed cloud services, including DNS, identity, routing, policy, and data-exfiltration boundaries.
Read the entry →Adversaries gain permissions beyond their current access by exploiting weaknesses, abusing tokens, changing controls, or misusing elevation mechanisms.
Read the entry →Privileged access management protects accounts, roles, credentials, and workflows that can make high-impact changes or bypass ordinary controls.
Read the entry →Privileged Access Workflows is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →Control the creation, use, elevation, monitoring, and retirement of highly privileged human and machine accounts. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Protect privileged processes and security boundaries from injection, modification, debugging, credential extraction, and untrusted code. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Probabilistic reasoning represents uncertainty explicitly and combines evidence to estimate outcomes rather than pretending every decision is certain.
Read the entry →Probability–impact scoring combines an estimate of likelihood with the magnitude of effect on objectives to support relative risk prioritization.
Read the entry →Proc Filesystem (T1003.007) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Proc Memory (T1055.009) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →Process Argument Spoofing (T1564.010) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →An adversary lists running processes, services, containers, or workloads to identify security tools, applications, users, and possible targets.
Read the entry →Process Doppelgänging (T1055.013) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →Process Hollowing (T1055.012) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →Process Injection (T1055) is an Enterprise ATT&CK technique associated with Stealth, Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Processes, Services, and Daemons is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Progress iteratively with feedback divides work into manageable increments, tests assumptions early, and uses evidence from stakeholders and operations to redirect the next step.
Read the entry →Project artifact governance controls the creation, ownership, version, approval, access, retention, and authoritative status of records used to direct and evidence project work.
Read the entry →Project assumption analysis identifies statements treated as true, evaluates their stability and evidence, and determines the risk created if they prove wrong.
Read the entry →Project change control evaluates, authorizes, communicates, implements, verifies, and records proposed changes to scope, schedule, cost, quality, security, or operational configuration.
Read the entry →Project change control evaluates proposed changes, their combined effects, available options, authority, and implementation conditions before baselines are modified.
Read the entry →A project charter formally authorizes work, identifies the accountable sponsor and project leader, and establishes the initial purpose, boundaries, authority, and success conditions.
Read the entry →Project communications planning defines who needs what information, why they need it, when it is needed, how it will be delivered, and how understanding will be confirmed.
Read the entry →Project compliance management identifies applicable obligations, assigns evidence and control responsibilities, and integrates verification into planning, delivery, change, and acceptance.
Read the entry →Project conflict management identifies the source, stage, interests, power dynamics, and consequences of disagreement before selecting an appropriate resolution approach.
Read the entry →Project ethics and professional conduct guide decisions involving responsibility, respect, fairness, honesty, resources, people, data, suppliers, and the environment.
Read the entry →Project governance defines decision rights, oversight forums, approval thresholds, escalation paths, and accountability for a project across its life cycle.
Read the entry →Project issue management records active problems, assigns ownership, evaluates severity and impact, escalates when necessary, tracks resolution, and captures the final outcome.
Read the entry →Project issue triage and resolution turns current problems into owned actions by assessing impact, urgency, root cause, options, dependencies, and escalation needs.
Read the entry →Project knowledge transfer prepares people and organizations to operate, support, govern, and improve a delivered capability after project work changes hands.
Read the entry →Project opportunity management identifies and acts on uncertain conditions that could improve value, capability, schedule, cost, quality, learning, or strategic position.
Read the entry →Project phase closure confirms completion or authorized termination, obtains acceptance, resolves obligations, transfers ownership, preserves records, releases resources, and captures lessons.
Read the entry →Project phase gates are formal decision points that determine whether work may proceed based on evidence, unresolved risk, readiness, resources, quality, and security obligations.
Read the entry →Project procurement strategy determines what work or capability should be obtained externally, how suppliers will be selected, how risk will be allocated, and how performance will be governed.
Read the entry →Project quality planning converts stakeholder needs, technical requirements, standards, and risk into measurable criteria, prevention activities, assurance methods, and acceptance evidence.
Read the entry →Project resource planning determines the people, skills, facilities, tools, services, and timing needed to perform work while accounting for availability and competing commitments.
Read the entry →A project risk breakdown structure organizes sources of uncertainty into a hierarchy that supports systematic identification, analysis, ownership, and reporting.
Read the entry →Project risk governance roles assign accountability for owning exposure, performing actions, facilitating analysis, approving resources, accepting residual risk, and escalating decisions.
Read the entry →Project risk identification workshops use structured facilitation and diverse perspectives to discover threats, opportunities, assumptions, dependencies, causes, and early warning conditions.
Read the entry →A project risk management plan documents the approach, roles, categories, scales, methods, cadence, reporting, reserves, escalation, and records used to manage uncertainty.
Read the entry →A project risk management strategy establishes how uncertainty will be governed, integrated with decisions, resourced, communicated, and adapted across the project life cycle.
Read the entry →Project risk monitoring and closure track exposure, indicators, response progress, emerging risk, residual and secondary risk, and the evidence required to retire a risk responsibly.
Read the entry →A project risk register is the controlled record of identified risks, analysis, owners, responses, indicators, decisions, status, and closure evidence.
Read the entry →Project risk response planning selects and designs actions that change probability, impact, exposure, ownership, or preparedness for threats and opportunities.
Read the entry →Project risk statements describe an uncertain event or condition, its cause or context, and the potential effect on one or more objectives.
Read the entry →Project stakeholder engagement identifies affected parties, understands their interests and influence, and creates deliberate participation throughout decisions and delivery.
Read the entry →Project team ground rules are explicit agreements about behavior, communication, decision-making, conflict, accountability, focus, and respectful collaboration.
Read the entry →Project value and benefits delivery connects outputs to measurable outcomes, responsible owners, adoption conditions, timing, and continued verification after delivery.
Read the entry →Prompt injection attempts to influence an AI system through untrusted instructions, while agentic risk grows when a model can use tools, retrieve data, or take actions beyond producing text.
Read the entry →Use the Protect Function to apply safeguards across identity, awareness, data, platforms, and infrastructure so risk is reduced before and during adverse events.
Read the entry →Apply PR.DS-01 to achieve this CSF 2.0 outcome: The confidentiality, integrity, and availability of data-at-rest are protected.
Read the entry →Apply PR.DS-02 to achieve this CSF 2.0 outcome: The confidentiality, integrity, and availability of data-in-transit are protected.
Read the entry →Apply PR.DS-10 to achieve this CSF 2.0 outcome: The confidentiality, integrity, and availability of data-in-use are protected.
Read the entry →Apply PR.IR-01 to achieve this CSF 2.0 outcome: Networks and environments are protected from unauthorized logical access and usage.
Read the entry →Apply PR.IR-02 to achieve this CSF 2.0 outcome: The organization’s technology assets are protected from environmental threats.
Read the entry →Apply PR.AA-04 to achieve this CSF 2.0 outcome: Identity assertions are protected, conveyed, and verified.
Read the entry →Protocol Tunneling (T1572) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Protocol or Service Impersonation (T1001.003) is an Enterprise ATT&CK sub-technique under Data Obfuscation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Apply DE.AE-06 to achieve this CSF 2.0 outcome: Information on adverse events is provided to authorized staff and tools.
Read the entry →Provider SDK credential security controls how command-line tools and software development kits discover, store, select, refresh, and use cloud or service credentials.
Read the entry →Proxy (T1090) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Ptrace System Calls (T1055.008) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →PubPrn (T1216.001) is an Enterprise ATT&CK sub-technique under System Script Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Public Key Infrastructure Operations is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.
Read the entry →Publish/Subscribe Protocols (T1071.005) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Purchase Technical Data (T1597.002) is an Enterprise ATT&CK sub-technique under Search Closed Sources. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Purpose limitation requires personal data to be collected and used for specific, understandable purposes rather than reused without evaluation or authority.
Read the entry →The Pyramid of Pain ranks indicators by how costly they are for an adversary to change, encouraging defenders to move from fragile hashes and addresses toward behavior and tradecraft.
Read the entry →Python (T1059.006) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Python dependency isolation separates project packages and interpreters from system components so version conflicts, unreviewed libraries, and installation side effects do not spread across workloads.
Read the entry →Python Startup Hooks (T1546.018) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0055, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a botnet of compromised SOHO routers used as egress infrastructure by multiple China-affiliated threat actors.
Read the entry →Qualitative project risk analysis prioritizes individual risks using agreed scales and factors such as probability, impact, urgency, proximity, detectability, and manageability.
Read the entry →Qualitative risk analysis uses descriptive judgments and ordered scales, while quantitative analysis uses numeric estimates, ranges, distributions, or monetary values to support decisions.
Read the entry →Quantitative project risk analysis uses numerical models and distributions to estimate combined uncertainty, outcome ranges, confidence levels, drivers, and the value of response options.
Read the entry →Query Public AI Services (T1682) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Query Registry (T1012) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →RACI and security accountability identify who is responsible, accountable, consulted, and informed for security decisions, evidence, remediation, acceptance, and operational ownership.
Read the entry →RADIUS and TACACS+ is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →RAG security controls protect source ingestion, indexing, retrieval, context assembly, and grounded response generation.
Read the entry →RAID and backup boundaries distinguish device-failure tolerance from independent recovery copies that protect against deletion, corruption, ransomware, application error, and site loss.
Read the entry →RC Scripts (T1037.004) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →RDP Hijacking (T1563.002) is an Enterprise ATT&CK sub-technique under Remote Service Session Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Read the entry →REST API Security is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Read the entry →ROMMONkit (T1542.004) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.
Read the entry →RSA Cryptography is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.
Read the entry →Ransomware operations disrupt access to systems or data and may combine encryption with theft, extortion, public pressure, and attacks on recovery systems.
Read the entry →Ransomware communications coordinates internal updates, leadership decisions, legal and law-enforcement engagement, customer messaging, and any authorized adversary contact.
Read the entry →Re-opened Applications (T1547.007) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Apply ID.RA-02 to achieve this CSF 2.0 outcome: Cyber threat intelligence is received from information sharing forums and sources.
Read the entry →Recommender systems rank content, products, or actions using predicted relevance and feedback from prior behavior.
Read the entry →Reconnaissance gathers information about a target, while enumeration actively identifies services, accounts, resources, versions, trust relationships, and other usable details.
Read the entry →Adversaries collect information about people, organizations, technology, and exposed services before or during an operation so they can choose targets and shape later actions.
Read the entry →Records of processing activities organize accountable descriptions of personal-data processing, including purpose, categories, recipients, transfers, retention, safeguards, and owners.
Read the entry →Use the Recover Function to restore assets and operations, verify their integrity, communicate progress, and transition the organization back to stable operations.
Read the entry →Recovery testing and restore assurance verify that protected data, systems, dependencies, procedures, and personnel can meet defined recovery needs.
Read the entry →Recovery time objective describes the target time to restore an important function, while recovery point objective describes the acceptable amount of data loss measured in time.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0047, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing Mustang Panda phishing and PlugX activity against East and Southeast Asian entities from 2023 through 2024.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0056, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing investigative tracking of custom TINYSHELL variants deployed on Juniper MX routers.
Read the entry →Reduce Key Space (T1600.001) is an Enterprise ATT&CK sub-technique under Weaken Encryption. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Reference architectures and blueprints provide reusable structures, components, trust assumptions, and security decisions for recurring solution types.
Read the entry →Reflection Amplification (T1498.002) is an Enterprise ATT&CK sub-technique under Network Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Reflective Code Loading (T1620) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Registry Run Keys / Startup Folder (T1547.001) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Regsvcs/Regasm (T1218.009) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Regsvr32 (T1218.010) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Regulatory incident reporting identifies applicable notification duties, responsible authorities, required content, decision evidence, and deadlines for a specific organization and event.
Read the entry →Reinforcement learning improves behavior through rewards and penalties received while an agent interacts with an environment.
Read the entry →Relative estimation compares the effort, complexity, uncertainty, and risk of work items using shared reference points instead of pretending to know precise duration too early.
Read the entry →Relocate Malware (T1070.010) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Remote Access Hardware (T1219.003) is an Enterprise ATT&CK sub-technique under Remote Access Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Remote Access Tools (T1219) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Remote automation trust boundaries define how controllers, agents, targets, networks, credentials, and operators authenticate and authorize each other across administrative zones.
Read the entry →Remote Data Staging (T1074.002) is an Enterprise ATT&CK sub-technique under Data Staged. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →Keep recoverable or authoritative data copies in storage that is separated from the primary system and governed through independent access controls. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Remote Desktop Protocol (T1021.001) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Read the entry →Remote Desktop security protects Windows interactive administrative sessions by controlling who can connect, how endpoints authenticate, where credentials are exposed, which channels are redirected, and how activity is monitored and contained.
Read the entry →Remote Desktop Software (T1219.002) is an Enterprise ATT&CK sub-technique under Remote Access Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Remote Email Collection (T1114.002) is an Enterprise ATT&CK sub-technique under Email Collection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →Remote server administration protects consoles, RDP, SSH, web portals, out-of-band controllers, and support sessions through strong identity, segmented access, encryption, monitoring, and session control.
Read the entry →Remote Service Session Hijacking (T1563) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →An adversary uses authenticated remote services such as RDP, SMB, WinRM, SSH, VNC, or management protocols to access another system.
Read the entry →Remote System Discovery (T1018) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Removable media controls for OT govern authorization, sourcing, scanning, transfer, use, custody, sanitization, and evidence for portable storage that crosses trust boundaries.
Read the entry →Removable Media Security is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Rename Legitimate Utilities (T1036.003) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Replay Attacks describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Read the entry →Replication Through Removable Media (T1091) is an Enterprise ATT&CK technique associated with Lateral Movement, Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Reproducible data science enables an authorized reviewer to rerun an analysis with the documented data, code, environment, parameters, and random-state controls and obtain explainable results.
Read the entry →Apply PR.IR-03 to achieve this CSF 2.0 outcome: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations.
Read the entry →Resilience is the ability to continue or recover important functions under disruption, while fault tolerance allows operation despite specific component failures.
Read the entry →Adversaries establish infrastructure, accounts, capabilities, and operational resources that support access, command and control, evasion, or influence.
Read the entry →Resource Forking (T1564.009) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Resource Hijacking (T1496) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Use the Respond Function to manage, analyze, communicate, contain, and eradicate incidents using coordinated authority and tested procedures.
Read the entry →Apply least-privilege permissions to files and directories so unauthorized users and processes cannot read, alter, replace, or execute protected content. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Constrain which dynamic libraries, modules, drivers, and extensions privileged or sensitive processes may load. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Limit who and what can modify security-sensitive registry locations used for startup, services, policies, credentials, and application behavior. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Reduce exposure to malicious web content by controlling destinations, downloads, active content, browser behavior, and risky categories. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Retrieval-augmented generation combines a generative model with selected external information to ground responses in current or controlled sources.
Read the entry →Reverse Proxies is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Reversible Encryption (T1556.005) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Read the entry →Revert Cloud Instance (T1578.004) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Apply GV.OV-01 to achieve this CSF 2.0 outcome: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction.
Read the entry →Apply GV.PO-02 to achieve this CSF 2.0 outcome: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission.
Read the entry →Right-to-Left Override (T1036.002) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Risk appetite describes the amount and type of risk an organization is willing to pursue or retain, while risk tolerance defines acceptable variation around specific objectives.
Read the entry →Apply GV.RM-02 to achieve this CSF 2.0 outcome: Risk appetite and risk tolerance statements are established, communicated, and maintained.
Read the entry →Risk appetite expresses the broad amount and type of uncertainty an organization is willing to pursue or retain, while tolerances and thresholds translate that position into actionable boundaries.
Read the entry →Use ID.RA to manage vulnerabilities, threats, intelligence, likelihood, impact, inherent risk, response, change, authenticity, and supplier risk within the Identify Function.
Read the entry →Risk escalation triggers are predefined conditions that require a risk, decision, or response to move to a higher level of authority or broader organizational view.
Read the entry →Apply GV.RM-01 to achieve this CSF 2.0 outcome: Risk management objectives are established and agreed to by organizational stakeholders.
Read the entry →Use GV.RM to manage risk objectives, appetite, tolerance, assessment methods, communication, response direction, and strategic opportunity within the Govern Function.
Read the entry →Risk ownership assigns an accountable person or role to understand a risk, sponsor treatment, monitor changes, and accept or escalate the remaining exposure within delegated authority.
Read the entry →Risk quantification expresses uncertainty, frequency, and consequence in numerical terms so leaders can compare exposures and evaluate response options more consistently.
Read the entry →A risk register is a maintained record of identified risks, their causes, impacts, owners, ratings, responses, status, and supporting evidence.
Read the entry →Common risk treatments are to avoid, mitigate, transfer or share, and accept the risk, with monitoring and ownership continuing after the decision.
Read the entry →Risk urgency reflects how quickly action is needed, while proximity describes how soon an uncertain event could occur or begin affecting objectives.
Read the entry →Apply PR.AA-06 to achieve this CSF 2.0 outcome: Physical access to assets is managed, monitored, and enforced commensurate with risk.
Read the entry →Apply GV.RR-03 to achieve this CSF 2.0 outcome: Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies.
Read the entry →Robotics combines sensing, AI decision logic, and physical actuation to operate in an environment.
Read the entry →Rogue Domain Controller (T1207) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Role-based access control assigns permissions to defined job or functional roles and then assigns identities to those roles.
Read the entry →Role-based database access assigns permissions to managed job or service roles rather than granting broad rights directly to individual accounts.
Read the entry →Use GV.RR to manage leadership accountability, decision authority, role clarity, resources, and workforce integration within the Govern Function.
Read the entry →Apply GV.RR-02 to achieve this CSF 2.0 outcome: Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
Read the entry →Rollback and backout planning defines the conditions, data protection, technical steps, authority, timing, validation, and communication needed to reverse a change safely.
Read the entry →Root and Intermediate Certificate Authorities is a cryptographic or trust-management mechanism used to provide confidentiality, integrity, authenticity, non-repudiation, or secure key establishment.
Read the entry →Rootkit (T1014) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Rootkits describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Read the entry →Rule-Based Access Control is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →Run Virtual Instance (T1564.006) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Runbook automation safeguards convert operational procedures into controlled actions with validated preconditions, bounded permissions, approvals, logging, and clear handoff to people.
Read the entry →Rundll32 (T1218.011) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Runtime application protection observes and constrains application behavior while software is executing.
Read the entry →Runtime Data Manipulation (T1565.003) is an Enterprise ATT&CK sub-technique under Data Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Security Assertion Markup Language is an XML-based standard used to exchange authentication and authorization assertions between an identity provider and a service provider.
Read the entry →SAML Authentication is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →SAML Tokens (T1606.002) is an Enterprise ATT&CK sub-technique under Forge Web Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →SAN zoning and LUN masking restrict which initiators can communicate with storage targets and which logical units each host may discover or use.
Read the entry →SASE, SD-WAN, and software-defined networking separate policy and control from traditional appliances, enabling distributed connectivity and security while increasing dependence on identity, orchestration, and provider controls.
Read the entry →SCIM Provisioning is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →SELinux policy enforcement uses labels, types, roles, and policy rules to confine processes and data even when conventional ownership and mode bits would permit access.
Read the entry →SEO Poisoning (T1608.006) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →SID-History Injection (T1134.005) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →The SIEM use-case lifecycle manages a detection from threat and business requirement through data validation, analytic design, testing, deployment, triage, measurement, tuning, maintenance, and retirement.
Read the entry →SIP and Trust Provider Hijacking (T1553.003) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →SMB and Samba security combines share permissions, filesystem permissions, identity integration, protocol hardening, network restrictions, and auditing to protect cross-platform file services.
Read the entry →SMB/Windows Admin Shares (T1021.002) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Read the entry →SMS Pumping (T1496.003) is an Enterprise ATT&CK sub-technique under Resource Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →SNMP (MIB Dump) (T1602.001) is an Enterprise ATT&CK sub-technique under Data from Configuration Repository. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →SOC 2 reports provide independent assurance about a service organization’s controls relevant to security, availability, processing integrity, confidentiality, or privacy.
Read the entry →SOC bottleneck analysis identifies queues, dependencies, missing authority, skill constraints, tool friction, and data-quality problems that slow or degrade security decisions.
Read the entry →SOC handoffs and case management preserve context, evidence, ownership, priority, and decisions as work moves across shifts, tiers, teams, and response functions.
Read the entry →SOC mission and scope define which risks, services, systems, users, hours, and decisions the security operations capability is accountable for.
Read the entry →SOC operating models describe how in-house, outsourced, hybrid, distributed, and follow-the-sun teams divide monitoring, investigation, response, and accountability.
Read the entry →SOC operational analytics examines workload, outcomes, quality, coverage, recurrence, timing, and resource consumption to explain how the SOC is performing and where change will matter.
Read the entry →SOC performance metrics combine timeliness, detection quality, investigation accuracy, coverage, workload, recurrence, and business impact instead of rewarding raw ticket volume.
Read the entry →A SOC risk profile translates business criticality, threat exposure, technology, regulatory obligations, and response constraints into operational priorities and escalation thresholds.
Read the entry →A SOC service catalog and coverage model state what monitoring, investigation, response, intelligence, hunting, and support services exist, who receives them, and when they operate.
Read the entry →SOC staffing and escalation align roles, competencies, shift coverage, authority, backup depth, and escalation paths with the services the SOC promises to deliver.
Read the entry →SOC strategic planning converts risk, maturity evidence, performance, technology change, and service demand into sequenced capability outcomes, investments, and accountable milestones.
Read the entry →SOC technology hardening protects the monitoring and response stack with least privilege, segmentation, secure configuration, audit logging, resilient access, and controlled administration.
Read the entry →SOC tool integration connects telemetry, enrichment, analytics, case management, orchestration, and response while preserving identity, integrity, timing, and provenance across interfaces.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0052, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing activity conducted through commercially leased virtual-private-server operational-relay-box networks.
Read the entry →SQL injection prevention keeps untrusted input from changing the structure or intent of database commands.
Read the entry →SQL Stored Procedures (T1505.001) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →SSH (T1021.004) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Read the entry →SSH Authorized Keys (T1098.004) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →SSH Hijacking (T1563.001) is an Enterprise ATT&CK sub-technique under Remote Service Session Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Read the entry →SSH server hardening limits remote administrative exposure through strong cryptography, controlled authentication, restricted forwarding, explicit access rules, logging, and timely maintenance.
Read the entry →Inspect appropriately authorized encrypted traffic where risk, privacy, architecture, and legal requirements justify visibility into protected sessions. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →STIX provides a structured language for cyber threat and observable information, while TAXII provides application-layer services for exchanging that information.
Read the entry →SVG Smuggling (T1027.017) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Safe Mode Boot (T1688) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Safe retry and backoff controls repeat transiently failed operations without creating duplicate effects, resource exhaustion, synchronized storms, or indefinite execution.
Read the entry →Safety instrumented system cybersecurity protects independent sensing, logic, and final elements designed to move a process to a safe condition when hazardous limits are exceeded.
Read the entry →Security limits unauthorized or harmful actions, while safety limits unacceptable harm to people, property, the environment, or mission when systems operate or fail.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0059, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a campaign beginning in 2024 that used voice phishing to compromise Salesforce instances for data theft and extortion.
Read the entry →Same-Origin Policy and Cross-Origin Resource Sharing is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Read the entry →Scan Databases (T1596.005) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Scanning IP Blocks (T1595.001) is an Enterprise ATT&CK sub-technique under Active Scanning. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G1015, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing an English-speaking cybercriminal cluster reported to rely heavily on social engineering, identity compromise, and cloud access.
Read the entry →Schedule baseline control establishes an approved timing model and uses progress, dependencies, forecasts, and authorized changes to keep delivery expectations credible.
Read the entry →Schedule risk analysis examines uncertainty in activity duration, dependencies, resources, calendars, rework, external events, and path convergence to estimate completion exposure.
Read the entry →Scheduled Task (T1053.005) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.
Read the entry →An adversary creates or modifies a scheduled task, cron job, cloud schedule, or similar mechanism to run code at a chosen time or event.
Read the entry →Scheduled Transfer (T1029) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Scope baseline integrity means approved deliverables, boundaries, acceptance conditions, and decomposition remain traceable and change only through authorized control.
Read the entry →Scope defines what a security test may include, while rules of engagement define how, when, and under which conditions testing may occur.
Read the entry →An adversary captures screenshots or display content to collect information visible in applications, sessions, and user workflows.
Read the entry →Screensaver (T1546.002) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →Search Closed Sources (T1597) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Search Engines (T1593.002) is an Enterprise ATT&CK sub-technique under Search Open Websites/Domains. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Search Open Technical Databases (T1596) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →An operator searches public websites, social platforms, code repositories, technical forums, and organizational domains for information useful to an operation.
Read the entry →Search Threat Vendor Data (T1681) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Search Victim-Owned Websites (T1594) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Search and planning methods explore possible states, actions, and costs to find a path toward a defined objective.
Read the entry →Secondary use governance controls whether data collected for one purpose may be reused for analytics, targeting, model development, research, sharing, or another objective.
Read the entry →Secrets management controls the creation, storage, distribution, use, rotation, revocation, and auditing of passwords, tokens, API keys, certificates, and cryptographic material.
Read the entry →Secure Access Service Edge is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →Secure Boot concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Read the entry →Secure boot and trusted start protect the earliest stages of system startup by checking firmware, boot components, and configuration before the operating system assumes control.
Read the entry →Secure boot for embedded devices creates a chain of verified software from an initial trusted component through bootloader, operating system, firmware, and application so unauthorized code is not executed during startup.
Read the entry →Secure change management brings planning, review, testing, communication, evidence, and recovery into normal operational change.
Read the entry →Secure code review examines source and related configuration for weaknesses in logic, trust, data handling, authorization, error paths, and use of dangerous APIs.
Read the entry →Secure Configuration Management concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Read the entry →Secure design principles guide systems toward limited privilege, simple trust boundaries, safe defaults, layered controls, complete mediation, and resilient failure behavior.
Read the entry →Secure erase and cryptographic erasure make stored information infeasible to recover by applying media-appropriate clearing, purging, destruction, or controlled destruction of encryption keys.
Read the entry →Secure fine-tuning adapts a pretrained model while controlling training data, code, adapters, permissions, evaluation, and release lineage.
Read the entry →Secure incident communications provide trusted channels, controlled membership, identity verification, and resilient alternatives for coordinating a response.
Read the entry →Secure interface design controls how components exchange data, identity, commands, state, and errors across technical and organizational boundaries.
Read the entry →Secure logging pipelines move events from producers through collection, transport, parsing, storage, and analysis while preserving integrity, timing, availability, context, and access control.
Read the entry →Secure mobile data storage keeps secrets and sensitive information out of inappropriate files, caches, backups, logs, screenshots, clipboards, notifications, and shared locations while using platform protection suited to the data and threat model.
Read the entry →Secure Shell (SSH) is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Secure software decommissioning removes an application or service while protecting data, credentials, dependencies, integrations, records, and users throughout retirement.
Read the entry →Secure software deployment moves approved software into an environment using controlled identities, verified artifacts, protected configuration, rollback capability, and observable change.
Read the entry →Apply PR.PS-06 to achieve this CSF 2.0 outcome: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle.
Read the entry →A secure software development lifecycle integrates security requirements, design analysis, implementation practices, testing, release controls, and operational feedback throughout delivery.
Read the entry →Secure software requirements translate risk, policy, misuse cases, compliance, and design objectives into testable conditions for a system and its development process.
Read the entry →Secure web browsing controls reduce exposure from malicious sites, downloads, scripts, browser extensions, sessions, and unsafe content execution.
Read the entry →Secure and Insecure Protocols describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Read the entry →Secure by default means a product or service begins in a protective configuration and requires deliberate action to enable riskier access, features, or trust.
Read the entry →Security acceptance criteria define the measurable conditions, evidence, tolerances, and unresolved-risk decisions required before a feature, system, or project deliverable is accepted.
Read the entry →Security Account Manager (T1003.002) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Security architecture governance defines how architecture decisions are proposed, reviewed, approved, recorded, measured, and changed.
Read the entry →Security architecture review and validation examine whether a design is complete, internally consistent, risk-informed, implementable, and capable of meeting its protection objectives.
Read the entry →Security assumptions are conditions believed to be true about users, systems, threats, dependencies, and controls; they must be stated and tested because designs fail when hidden assumptions are wrong.
Read the entry →Security assurance is justified confidence that a system's security functions and properties are correct, effective, and suitable for their intended environment.
Read the entry →A security assurance case presents a structured argument that a system's security claims are supported by sufficient evidence under stated assumptions.
Read the entry →Security automation can reduce repetitive work and inconsistency, but it must be governed so brittle workflows, hidden failure, alert acceleration, or loss of analyst judgment do not increase burnout.
Read the entry →Security awareness effectiveness evaluates whether education and reinforcement change risky behavior, improve reporting, and reduce preventable exposure for specific audiences.
Read the entry →Security awareness training helps people recognize risk, make safer decisions, and know how to report suspicious activity before a small mistake becomes an incident.
Read the entry →A security baseline defines the minimum approved configuration and protection level for a class of systems, services, accounts, or devices.
Read the entry →Security Baselines and Benchmarks is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Security benchmark compliance compares system configuration with approved hardening guidance, evaluates justified deviations, and verifies that remediation does not break required services.
Read the entry →Security budgeting translates strategy, risk, service commitments, staffing, technology, compliance, and resilience needs into a funded plan that can be governed and adjusted.
Read the entry →A security business case explains the problem, options, expected outcomes, costs, risks, dependencies, and recommendation in a form decision makers can compare with other investments.
Read the entry →Security business value drivers are the revenue, mission, safety, trust, resilience, legal, customer, and strategic outcomes that determine why a security investment matters.
Read the entry →A security concept of operations describes how security capabilities, responsibilities, decisions, and responses work in the system's real operating environment.
Read the entry →Security configuration management defines, applies, monitors, and changes configuration baselines so that systems remain understandable and defensible.
Read the entry →A security control assessment determines whether selected controls are implemented correctly, operating as intended, and producing the desired outcome.
Read the entry →Security controls can be grouped by implementation category and by function, helping practitioners select, explain, and evaluate safeguards.
Read the entry →Security control placement determines where a preventive, detective, responsive, or recovery mechanism must sit in the architecture to see, decide, and act on the intended behavior.
Read the entry →Security culture is the pattern of real behavior created by leadership reactions, incentives, peer expectations, operating pressure, and the usability of security processes.
Read the entry →Security data collection pipelines move telemetry from diverse sources through secure transport, buffering, parsing, normalization, quality checks, storage, and access controls.
Read the entry →Security data enrichment adds asset, identity, vulnerability, threat, geography, ownership, and business context so analysts can make faster and more accurate decisions.
Read the entry →A security event is an observable occurrence, an alert is a notification that selected activity may need attention, and an incident is an event or series of events that meets defined criteria for harmful or policy-violating impact.
Read the entry →A SIEM centralizes selected security and operational data so teams can search, correlate, detect, investigate, report, and retain evidence across systems.
Read the entry →Security leader one-on-ones create a recurring space to surface blockers, clarify priorities, exchange feedback, develop judgment, and strengthen trust without replacing team governance.
Read the entry →Security leadership coaching uses structured observation, questions, feedback, practice, and accountability to improve judgment, performance, and ownership in security teams.
Read the entry →Security leadership aligns people and decisions around risk, resilience, trust, and enterprise outcomes, often without direct authority over every contributing team.
Read the entry →Security logging records relevant activity, while monitoring evaluates that activity for conditions that require attention, investigation, or action.
Read the entry →Security meeting facilitation structures purpose, participants, evidence, options, decisions, owners, and follow-up so meetings resolve issues instead of merely exchanging status.
Read the entry →Security metrics should clarify coverage, exposure, control performance, resilience, and business consequence so that leaders can make better decisions.
Read the entry →Monitoring coverage validation confirms that required events are generated, collected, parsed, retained, correlated, alerted, and investigated across the intended environment.
Read the entry →Security objectives describe the properties and outcomes a system or organization must preserve, including confidentiality, integrity, availability, authenticity, accountability, and resilience.
Read the entry →A security operating model defines how security work is organized, governed, delivered, funded, measured, and integrated across centralized and distributed teams.
Read the entry →SOAR coordinates tools, data, decisions, and repeatable response steps through playbooks that can assist analysts or perform approved actions automatically.
Read the entry →Security personnel development and retention use role clarity, coaching, growth paths, workload management, recognition, and succession depth to sustain security capability.
Read the entry →Security policy adoption metrics test whether affected groups understand, implement, and sustain required behavior, not merely whether a document was acknowledged.
Read the entry →Security policy drift is the growing gap between approved intent and actual practice caused by technology, process, ownership, exceptions, workarounds, or organizational change.
Read the entry →The security policy lifecycle governs conception, drafting, approval, communication, implementation, exception handling, measurement, review, revision, and retirement.
Read the entry →Security policy principles state durable intentions and decision boundaries that guide requirements even as technologies, structures, and procedures change.
Read the entry →Security policy retirement formally removes or supersedes obsolete requirements while preserving decision history, dependencies, communications, and any continuing obligations.
Read the entry →Security policy type selection determines whether an issue needs an enterprise policy, topic-specific policy, standard, baseline, procedure, or guideline based on authority and use.
Read the entry →Security policy validation uses pilots, stakeholder review, scenario testing, legal and operational checks, and evidence criteria before broad release.
Read the entry →Security priority setting converts strategy and risk into a limited set of measurable outcomes, explicit tradeoffs, owners, and sequencing decisions that focus effort.
Read the entry →Security procurement integrates risk, architecture, privacy, resilience, assurance, and lifecycle requirements into sourcing and contract decisions.
Read the entry →Security procurement incorporates protection, resilience, privacy, evidence, supply-chain, and lifecycle requirements into sourcing, evaluation, contracting, acceptance, and ongoing supplier oversight.
Read the entry →A security program charter establishes the program's purpose, authority, scope, leadership, responsibilities, decision rights, and relationship to enterprise objectives.
Read the entry →Security program management coordinates strategy, governance, people, services, architecture, risk, operations, suppliers, assurance, investment, and improvement as one managed system.
Read the entry →Security program maturity describes how consistently and effectively capabilities are governed, performed, measured, improved, and adapted to changing needs.
Read the entry →Security project business cases connect a proposed investment to mission need, risk reduction, benefits, costs, alternatives, dependencies, uncertainty, and measures of realized value.
Read the entry →Security project communication records preserve decisions, approvals, risks, actions, requirements, evidence, and sensitive correspondence with appropriate integrity, access, retention, and discoverability.
Read the entry →Security project management controls scope, schedule, dependencies, risk, acceptance evidence, and stakeholder commitments for work that changes security capability.
Read the entry →Security project scope management defines boundaries, deliverables, exclusions, assumptions, interfaces, acceptance, and controlled change so security obligations are neither omitted nor expanded informally.
Read the entry →Security project vendor oversight verifies that external providers meet contractual security, evidence, access, delivery, change, incident, and transition obligations throughout the engagement.
Read the entry →A security requirements baseline is the approved set of security requirements and assumptions against which the system is designed, built, verified, and changed.
Read the entry →Security requirements traceability connects stakeholder needs, risks, requirements, design elements, controls, implementation evidence, tests, findings, and operational outcomes.
Read the entry →Security roles and accountability define who owns outcomes, makes decisions, performs work, provides advice, verifies results, and accepts remaining risk.
Read the entry →Security Software Discovery (T1518.001) is an Enterprise ATT&CK sub-technique under Software Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Read the entry →Security stakeholder mapping identifies who owns outcomes, controls resources, bears risk, supplies expertise, can block change, and must understand or approve a decision.
Read the entry →Security strategy alignment connects protection priorities, capabilities, architecture, investment, and measures to enterprise mission, objectives, operating model, and risk appetite.
Read the entry →Security Support Provider (T1547.005) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Security telemetry prioritization ranks data sources by decision value, threat coverage, business relevance, quality, cost, retention needs, and operational feasibility.
Read the entry →A security telemetry strategy defines which events, states, and contextual data an organization must collect to prevent, detect, investigate, respond to, and learn from priority threat and failure scenarios.
Read the entry →Security trade-offs balance protection with usability, cost, performance, speed, privacy, safety, resilience, and mission needs rather than treating maximum restriction as the only goal.
Read the entry →Securityd Memory (T1555.002) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Apply RC.RP-02 to achieve this CSF 2.0 outcome: Recovery actions are selected, scoped, prioritized, and performed.
Read the entry →Apply ID.RA-06 to achieve this CSF 2.0 outcome: Risk responses are chosen, prioritized, planned, tracked, and communicated.
Read the entry →Selective Exclusion (T1679) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Semantic versioning communicates whether a release is intended to preserve compatibility, add compatible capability, or introduce breaking change.
Read the entry →Sensitive authentication data handling prevents storage of prohibited authentication data after authorization and tightly controls any transient processing needed to complete a payment.
Read the entry →Separation of duties divides sensitive work so one person cannot complete, approve, and conceal a high-risk action alone.
Read the entry →Serial industrial protocol security manages physical access, converters, gateways, command authority, monitoring, and compensating controls for communications that often lack modern authentication or encryption.
Read the entry →Server (T1583.004) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Server (T1584.004) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Server capacity and resilience translate workload demand, growth, failure tolerance, recovery targets, and performance thresholds into sufficient compute, memory, storage, and network headroom.
Read the entry →Server clustering and failover coordinate nodes, health checks, quorum, replication, service ownership, and recovery behavior so workloads can continue after selected failures.
Read the entry →Server monitoring and alerting convert metrics, logs, events, health checks, and capacity trends into actionable notifications tied to service impact and response ownership.
Read the entry →Server power resilience combines redundant supplies, independent circuits, UPS capacity, generators, distribution, monitoring, maintenance, and graceful shutdown to manage electrical failure.
Read the entry →Server role minimization installs and enables only the operating-system features, applications, ports, and administrative interfaces required for a defined workload.
Read the entry →An adversary adds or modifies a component within server software—such as a web shell, plug-in, module, or management extension—to preserve access or execute code.
Read the entry →Server-room environmental monitoring detects temperature, humidity, airflow, water, smoke, power, and access conditions early enough for operators to protect equipment and service continuity.
Read the entry →Server-Side Request Forgery is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Read the entry →Serverless (T1583.007) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Serverless (T1584.007) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Serverless event trigger security protects the queues, topics, schedules, storage events, webhooks, API routes, and other sources that invoke functions or workflows.
Read the entry →Serverless Execution (T1648) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Serverless security protects event-driven functions and managed compute services by controlling code, identities, triggers, data, dependencies, and runtime behavior.
Read the entry →Service account management governs nonhuman identities used by applications, services, automation, devices, and integrations throughout their lifecycle.
Read the entry →Service consumer roles distinguish customers who define requirements, users who interact with services, and sponsors who authorize budgets or resources.
Read the entry →Service dependency management maps and controls the services, mounts, networks, identities, secrets, timers, and startup conditions a workload requires to operate safely.
Read the entry →The service desk is the communication and coordination point between service providers and users for incidents, requests, questions, updates, and experience feedback.
Read the entry →Service Execution (T1569.002) is an Enterprise ATT&CK sub-technique under System Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Service Exhaustion Flood (T1499.002) is an Enterprise ATT&CK sub-technique under Endpoint Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Service level management sets business-based targets for service quality and experience, monitors actual performance, and uses continuing dialogue to improve both expectations and outcomes.
Read the entry →A service offering packages goods, access to resources, and service actions into a defined proposition, while the service relationship covers provision, consumption, and relationship management.
Read the entry →Service decisions should distinguish delivered outputs from stakeholder outcomes and should evaluate the costs and risks removed, introduced, or shared through the relationship.
Read the entry →Service request management handles predefined, user-initiated requests through clear models, approvals, fulfillment steps, communication, and measurement.
Read the entry →Service Stop (T1489) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Utility describes what a service does to support a need, while warranty describes the assurance that it will be available, secure, continuous, and capable enough for the intended use.
Read the entry →Service value co-creation is the joint process through which providers, consumers, users, sponsors, partners, and other stakeholders combine capabilities and decisions to produce useful outcomes.
Read the entry →A service-level agreement defines measurable service commitments, responsibilities, reporting, remedies, review processes, and escalation paths between a provider and customer.
Read the entry →Service-level objectives define measurable reliability targets, while error budgets express how much unreliability is acceptable over a period before delivery priorities must change.
Read the entry →Services File Permissions Weakness (T1574.010) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →Services Registry Permissions Weakness (T1574.011) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Read the entry →Session Hijacking is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →Session Management is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →Setuid and Setgid (T1548.001) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.
Read the entry →Shadow AI discovery and response identifies unauthorized AI tools, models, agents, extensions, data flows, and automated uses, then brings them under governance or removes them.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0045, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a campaign beginning in late 2023 that exploited exposed Ray AI framework instances across several sectors.
Read the entry →Apply RS.CO-03 to achieve this CSF 2.0 outcome: Information is shared with designated internal and external stakeholders.
Read the entry →Apply RC.CO-04 to achieve this CSF 2.0 outcome: Public updates on incident recovery are shared using approved methods and messaging.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0058, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing July 2025 exploitation waves against incompletely patched on-premises Microsoft SharePoint servers.
Read the entry →Shared Modules (T1129) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Sharepoint (T1213.002) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Read the entry →Shell environment secret protection keeps credentials, tokens, paths, history, startup files, and inherited variables from exposing authority or changing command behavior unexpectedly.
Read the entry →Shell History (T1552.003) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Shell script security reduces command injection, unsafe expansion, silent failure, secret exposure, and destructive mistakes through disciplined quoting, input handling, error checks, permissions, and review.
Read the entry →Shortcut Modification (T1547.009) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Sigma Rules is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Read the entry →Silver Ticket (T1558.002) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Simple Network Management Protocol Security describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Read the entry →A single point of failure is a component, person, service, dependency, or process whose loss can stop a critical function because no effective alternative exists.
Read the entry →Site reliability engineering applies software engineering, automation, measurement, and risk-based reliability practices to operate services at scale.
Read the entry →Small-batch delivery limits the size of work moving through the system so value, quality, uncertainty, and feedback can be evaluated sooner.
Read the entry →Snort and Suricata rules describe network traffic conditions that an intrusion detection or prevention engine can alert on, record, reject, or otherwise handle using protocol, flow, content, metadata, and state-aware inspection.
Read the entry →Social engineering manipulates trust, urgency, authority, fear, helpfulness, or curiosity to influence a person into taking an unsafe action.
Read the entry →Social Engineering (T1684) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Social Media (T1593.001) is an Enterprise ATT&CK sub-technique under Search Open Websites/Domains. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Social Media Accounts (T1585.001) is an Enterprise ATT&CK sub-technique under Establish Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Social Media Accounts (T1586.001) is an Enterprise ATT&CK sub-technique under Compromise Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Socket Filters (T1205.002) is an Enterprise ATT&CK sub-technique under Traffic Signaling. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Command and Control context.
Read the entry →Software (T1592.002) is an Enterprise ATT&CK sub-technique under Gather Victim Host Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Artifact signing proves that a trusted identity approved a specific software artifact, while provenance records describe how, where, and from what inputs it was built.
Read the entry →A software bill of materials is a structured inventory of components and relationships included in a software product or build.
Read the entry →Configure applications and services to minimize unnecessary features, unsafe defaults, excessive privileges, and exposed administrative functions. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Software Deployment Tools (T1072) is an Enterprise ATT&CK technique associated with Execution, Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Software Discovery (T1518) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Software escrow places source code, documentation, build instructions, keys, or other materials with a trusted third party for release under defined conditions.
Read the entry →Software Extensions (T1176) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Apply PR.PS-02 to achieve this CSF 2.0 outcome: Software is maintained, replaced, and removed commensurate with risk.
Read the entry →Software Packing (T1027.002) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Software supply chain security protects source, dependencies, build systems, artifacts, distribution, updates, and the people and services that influence delivered software.
Read the entry →Apply ID.AM-02 to achieve this CSF 2.0 outcome: Inventories of software, services, and systems managed by the organization are maintained.
Read the entry →Software-Defined Networking Security is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0024, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing the 2020 APT29 supply-chain operation involving the SolarWinds Orion software build process and follow-on access.
Read the entry →Space after Filename (T1036.006) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Spearphishing Attachment (T1566.001) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
Read the entry →Spearphishing Attachment (T1598.002) is an Enterprise ATT&CK sub-technique under Phishing for Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Spearphishing Link (T1566.002) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
Read the entry →Spearphishing Link (T1598.003) is an Enterprise ATT&CK sub-technique under Phishing for Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Spearphishing Service (T1598.001) is an Enterprise ATT&CK sub-technique under Phishing for Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Spearphishing Voice (T1566.004) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
Read the entry →Spearphishing Voice (T1598.004) is an Enterprise ATT&CK sub-technique under Phishing for Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Spearphishing via Service (T1566.003) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
Read the entry →Apply PR.AT-02 to achieve this CSF 2.0 outcome: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind.
Read the entry →Speech AI systems recognize, synthesize, identify, or transform spoken language and other audio signals.
Read the entry →Stage Capabilities (T1608) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Stakeholder engagement identifies whose objectives, authority, knowledge, incentives, and support affect a security decision or program outcome.
Read the entry →Stakeholder expectation management turns needs, constraints, assumptions, deadlines, and decision rights into explicit commitments that can be reviewed and renegotiated.
Read the entry →Apply GV.OC-02 to achieve this CSF 2.0 outcome: Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood.
Read the entry →Standard Encoding (T1132.001) is an Enterprise ATT&CK sub-technique under Data Encoding. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Apply GV.RM-06 to achieve this CSF 2.0 outcome: A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated.
Read the entry →Start where you are means assessing current services, data, practices, controls, skills, and results before replacing them, while refusing to preserve weak arrangements merely because they already exist.
Read the entry →Startup Items (T1037.005) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Stateful and Stateless Firewalls is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →SAST analyzes source or compiled code, DAST tests a running application from the outside, and IAST observes application behavior during execution with internal context.
Read the entry →Statistical disclosure control reduces the chance that published statistics, tables, queries, or analytic outputs reveal confidential information about individuals or small groups.
Read the entry →Steal Application Access Token (T1528) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Steal Web Session Cookie (T1539) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Steal or Forge Authentication Certificates (T1649) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Steal or Forge Kerberos Tickets (T1558) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Adversaries conceal their presence, blend with expected activity, alter indicators, disguise artifacts, or make analysis more difficult.
Read the entry →Steganography (T1001.002) is an Enterprise ATT&CK sub-technique under Data Obfuscation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Steganography (T1027.003) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Storage resilience and RAID use redundancy, striping, parity, mirroring, monitoring, and rebuild procedures to maintain service through selected device failures.
Read the entry →Stored Data Manipulation (T1565.001) is an Enterprise ATT&CK sub-technique under Data Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Apply GV.RM-07 to achieve this CSF 2.0 outcome: Strategic opportunities — positive risks — are characterized and are included in organizational cybersecurity risk discussions.
Read the entry →Apply GV.RM-04 to achieve this CSF 2.0 outcome: Strategic direction that describes appropriate risk response options is established and communicated.
Read the entry →Strategic, operational, and tactical intelligence serve different decision horizons, from leadership risk choices to campaign understanding and immediate defensive action.
Read the entry →Stripped Payloads (T1027.008) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Structured analytic techniques make assumptions, alternatives, evidence, and uncertainty visible so judgments can be challenged and repeated.
Read the entry →Subnet masks and classless inter-domain routing notation identify the network prefix of an IP address and define the size and boundaries of address ranges.
Read the entry →Subvert Trust Controls (T1553) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Sudo policy design grants named users or groups tightly scoped administrative commands while preserving accountability, command context, and safer alternatives to persistent root sessions.
Read the entry →Sudo and Sudo Caching (T1548.003) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.
Read the entry →Supervised learning trains a model from labeled examples so it can predict a class or numerical value for new observations.
Read the entry →Apply GV.SC-06 to achieve this CSF 2.0 outcome: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.
Read the entry →Apply ID.AM-04 to achieve this CSF 2.0 outcome: Inventories of services provided by suppliers are maintained.
Read the entry →Supply Chain Compromise is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Supply Chain Compromise (T1195) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Supply chain incident response coordinates investigation and containment when a vendor, dependency, update channel, service provider, or trusted product may be compromised.
Read the entry →Apply GV.SC-05 to achieve this CSF 2.0 outcome: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
Read the entry →Apply GV.SC-02 to achieve this CSF 2.0 outcome: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally.
Read the entry →Sustaining security change embeds new behavior through ownership, cadence, reinforcement, recognition, measurement, training, and correction after initial attention fades.
Read the entry →Symbolic AI represents knowledge and rules explicitly, while statistical AI learns patterns from examples and probability distributions.
Read the entry →Symmetric Cryptography (T1573.001) is an Enterprise ATT&CK sub-technique under Encrypted Channel. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Symmetric encryption uses the same secret key for encryption and decryption, while asymmetric encryption uses a mathematically related public and private key pair.
Read the entry →SyncAppvPublishingServer (T1216.002) is an Enterprise ATT&CK sub-technique under System Script Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Synthetic content provenance records information about the origin, edits, and production process of digital media so consumers and systems can assess authenticity claims.
Read the entry →Synthetic data governance evaluates how generated records are produced, validated, labeled, shared, and protected, including whether they preserve sensitive patterns or distort intended use.
Read the entry →Sysmon is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →System Binary Proxy Execution (T1218) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →A system boundary identifies the components, data, people, services, interfaces, and dependencies included in a security or privacy assessment.
Read the entry →System categorization determines the potential impact of losing confidentiality, integrity, or availability for the information and services a system supports.
Read the entry →System Checks (T1497.001) is an Enterprise ATT&CK sub-technique under Virtualization/Sandbox Evasion. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Discovery context.
Read the entry →System Firmware (T1542.001) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.
Read the entry →System Hardening concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Read the entry →An adversary queries operating-system, architecture, hardware, version, patch, hostname, or instance information to guide later actions.
Read the entry →System Language Discovery (T1614.001) is an Enterprise ATT&CK sub-technique under System Location Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Read the entry →System Location Discovery (T1614) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →An adversary queries addresses, interfaces, routes, DNS settings, proxies, adapters, and other network configuration to understand connectivity.
Read the entry →System Network Connections Discovery (T1049) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →System Owner/User Discovery (T1033) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →System Script Proxy Execution (T1216) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →System Service Discovery (T1007) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →System Services (T1569) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →System Shutdown/Reboot (T1529) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →System Time Discovery (T1124) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Systemctl (T1569.003) is an Enterprise ATT&CK sub-technique under System Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Systemd Service (T1543.002) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Systemd Timers (T1053.006) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.
Read the entry →Systems security engineering integrates security into the technical and organizational processes used to conceive, build, operate, and retire a system.
Read the entry →TCC Manipulation (T1548.006) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.
Read the entry →TCP Three-Way Handshake describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Read the entry →TCP and UDP provide different transport behaviors: TCP emphasizes connection state and reliable delivery, while UDP favors low overhead and application-managed reliability.
Read the entry →The TCP/IP model groups the protocols that support modern internetworking into practical layers for link access, internet routing, transport, and applications.
Read the entry →TFTP Boot (T1542.005) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.
Read the entry →TLS Handshake is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →TLS inspection governance controls when encrypted traffic may be decrypted for security analysis, how trust is established, and how privacy, performance, compatibility, and key risk are managed.
Read the entry →Taint Shared Content (T1080) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →A troubleshooting methodology provides a disciplined sequence for identifying a problem, testing likely causes, implementing a fix, and verifying the outcome.
Read the entry →Use PR.IR to manage network and environment protection, environmental safeguards, resilience mechanisms, and capacity within the Protect Function.
Read the entry →Technology obsolescence and end-of-life risk arise when unsupported hardware, software, protocols, skills, components, or suppliers can no longer meet security and operational needs.
Read the entry →Template Injection (T1221) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Temporary cloud credentials provide time-limited access tokens or keys instead of persistent secrets.
Read the entry →Temporary Elevated Cloud Access (T1548.005) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.
Read the entry →Terminal Services DLL (T1505.005) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →How ATT&CK represents tactics, techniques, sub-techniques, relationships, detections, mitigations, groups, software, campaigns, and supporting references as connected objects.
Read the entry →How the Enterprise matrix organizes observed adversary behaviors by tactical objective without turning the matrix into a checklist of products.
Read the entry →Think and work holistically treats products, services, people, partners, technology, information, controls, and value streams as an interacting system rather than isolated components.
Read the entry →Third-party risk management identifies, evaluates, treats, monitors, and responds to cyber risk introduced by vendors, cloud services, software, partners, and other external dependencies.
Read the entry →Third-party privacy risk arises when suppliers, partners, processors, platforms, or data recipients handle personal information on an organization’s behalf or for a shared purpose.
Read the entry →Thread Execution Hijacking (T1055.003) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →Thread Local Storage (T1055.005) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →Threat actors differ in goals, resources, access, patience, risk tolerance, and preferred methods, which influences what they target and how they operate.
Read the entry →Threat applicability analysis tests whether an actor, technique, path, precondition, target, and consequence are relevant to a specific system before controls are selected or credited.
Read the entry →Threat data normalization converts inconsistent values, formats, timestamps, identifiers, and naming conventions into a common structure for analysis.
Read the entry →Threat hunting is a structured search for adversary behavior or hidden compromise that has not been fully identified by existing alerts.
Read the entry →Threat infrastructure analysis connects domains, addresses, certificates, hosting, services, accounts, and timing to understand how an adversary supports operations.
Read the entry →Threat Intel Vendors (T1597.001) is an Enterprise ATT&CK sub-technique under Search Closed Sources. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →The threat intelligence cycle organizes direction, collection, processing, analysis, dissemination, and feedback into a repeatable decision-support process.
Read the entry →Hypothesis development turns observations into testable explanations that guide collection, analysis, hunting, and validation.
Read the entry →Link analysis represents entities and relationships so analysts can examine clusters, central nodes, paths, shared attributes, and evidence gaps.
Read the entry →Threat intelligence platforms organize collection, normalization, enrichment, scoring, relationships, sharing, workflow, and dissemination for threat information used by multiple teams.
Read the entry →Operate a requirements-driven threat intelligence capability that turns external and internal information into decisions, priorities, detections, and defensive changes. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Threat intelligence program measurement evaluates whether intelligence changes decisions, improves defensive action, reduces uncertainty, or accelerates response.
Read the entry →Threat intelligence reporting presents judgments, evidence, confidence, implications, and recommended decisions in a format suited to the intended audience.
Read the entry →Threat intelligence requirements translate stakeholder decisions and uncertainties into specific questions that collection and analysis can answer.
Read the entry →Threat intelligence sharing communities create trusted relationships, common expectations, and repeatable mechanisms for exchanging information among participants.
Read the entry →Source evaluation considers reliability, access, motivation, timeliness, technical visibility, corroboration, and known limitations before information is trusted.
Read the entry →Threat modeling examines what must be protected, how a system works, where trust changes, what can go wrong, and which safeguards or design changes reduce risk.
Read the entry →Threat scenario prioritization ranks credible actor, path, target, consequence, and control-failure combinations by relevance to the organization and decisions at hand.
Read the entry →Threat-intelligence-driven detection engineering translates adversary behaviors, tools, infrastructure, and expected data into testable analytics and monitoring coverage.
Read the entry →A vulnerability is a weakness, a threat is something capable of exploiting or harming, and risk reflects the potential effect of that interaction on an objective or asset.
Read the entry →Time Based Checks (T1497.003) is an Enterprise ATT&CK sub-technique under Virtualization/Sandbox Evasion. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Discovery context.
Read the entry →Time Providers (T1547.003) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Time-series forecasting estimates future values from ordered observations, trends, seasonality, and related signals.
Read the entry →Timestomp (T1070.006) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Token Impersonation/Theft (T1134.001) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →Tool (T1588.002) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Traffic Duplication (T1020.001) is an Enterprise ATT&CK sub-technique under Automated Exfiltration. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Read the entry →The Traffic Light Protocol uses standardized labels to communicate how far potentially sensitive information may be shared by recipients.
Read the entry →Traffic Signaling (T1205) is an Enterprise ATT&CK technique associated with Stealth, Persistence, Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Training-data poisoning manipulates examples, labels, sources, or collection processes to alter a model’s learned behavior.
Read the entry →Transfer Data to Cloud Account (T1537) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →A transfer impact assessment evaluates the legal, operational, technical, and contextual risks of moving or permitting access to personal data across jurisdictions.
Read the entry →Transformer models use attention mechanisms to relate tokens across a sequence and support large-scale language and multimodal systems.
Read the entry →Transit-gateway security applies segmentation, route governance, inspection, ownership, and change control to centralized cloud and hybrid routing hubs.
Read the entry →Transmitted Data Manipulation (T1565.002) is an Enterprise ATT&CK sub-technique under Data Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Read the entry →Transport Agent (T1505.002) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →Trap (T1546.005) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →Apply RS.MA-02 to achieve this CSF 2.0 outcome: Incident reports are triaged and validated.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0030, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing a campaign against a petrochemical organization that targeted Triconex safety controllers with the Triton framework.
Read the entry →A trust boundary marks where the assumptions, authority, identity, or control conditions applied to data and interactions change.
Read the entry →A trust decision determines whether an identity, device, service, data source, network, or organization receives access or influence under defined evidence and conditions.
Read the entry →Trust Modification (T1484.002) is an Enterprise ATT&CK sub-technique under Domain or Tenant Policy Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Privilege Escalation context.
Read the entry →Trusted Developer Utilities Proxy Execution (T1127) is an Enterprise ATT&CK technique associated with Stealth, Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →An adversary abuses a supplier, partner, managed service, federation, software, or other trusted relationship to reach the target environment.
Read the entry →Type 1 and Type 2 Hypervisors concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Read the entry →A URI identifies a resource, a URL adds a method and location for reaching it, and an HTTP request carries a method, target, headers, and optional body that a server interprets within an application and trust context.
Read the entry →Udev Rules (T1546.017) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →Unattended installation security protects answer files, embedded credentials, scripts, drivers, repositories, and post-install actions used to automate operating-system deployment.
Read the entry →Unauthorized software management identifies, evaluates, removes, blocks, or formally approves software that is not permitted for the device or environment.
Read the entry →Apply DE.AE-04 to achieve this CSF 2.0 outcome: The estimated impact and scope of adverse events are understood.
Read the entry →Apply ID.RA-05 to achieve this CSF 2.0 outcome: Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0031, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing global intrusions that defaced Unitronics Vision Series PLC human-machine interfaces across multiple sectors.
Read the entry →Unix Shell (T1059.004) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Unix Shell Configuration Modification (T1546.004) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →An adversary searches files, repositories, scripts, logs, environment variables, instance metadata, or configuration for exposed authentication material.
Read the entry →Unsupervised learning identifies structure in unlabeled data, including clusters, latent dimensions, and unusual observations.
Read the entry →Unused/Unsupported Cloud Regions (T1535) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Reduce exploitable exposure by applying verified software, firmware, package, dependency, and platform updates within risk-based timelines. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Upload Malware (T1608.001) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Upload Tool (T1608.002) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Use Alternate Authentication Material (T1550) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →User Account Control limits routine use of administrative privileges by giving administrators a filtered standard token and requiring an elevation decision before a process receives the full administrative token.
Read the entry →Use operating-system elevation boundaries and prompts to separate ordinary user activity from administrative actions and reduce silent privilege use. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Manage user accounts through verified provisioning, change, review, suspension, and deprovisioning processes tied to business need. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →User Activity Based Checks (T1497.002) is an Enterprise ATT&CK sub-technique under Virtualization/Sandbox Evasion. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Discovery context.
Read the entry →An adversary depends on a user to open, launch, approve, install, or otherwise trigger malicious content or code.
Read the entry →User story and work decomposition divide large outcomes into coherent, testable slices that preserve user value and expose learning, dependencies, and risk.
Read the entry →Prepare people to recognize, avoid, report, and respond to adversary actions relevant to their role, systems, data, and authority. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →User and Entity Behavior Analytics models activity for users, devices, workloads, applications, and other entities to identify statistically or contextually unusual behavior that may indicate compromise, misuse, control failure, or operational change.
Read the entry →How Navigator layers can visualize threat intelligence, detection coverage, red-team plans, assessment results, and prioritized engineering work without misrepresenting uncertainty.
Read the entry →How to translate behaviors into hypotheses, data requirements, analytics, tests, tuning criteria, response actions, and measurable coverage.
Read the entry →How to evaluate whether people, processes, architecture, controls, and telemetry can prevent, observe, investigate, and recover from relevant behaviors.
Read the entry →How architecture teams can use relevant adversary behaviors to test trust boundaries, abuse cases, telemetry, and resilience decisions.
Read the entry →VBA Stomping (T1564.007) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →VDSO Hijacking (T1055.014) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Read the entry →VNC (T1021.005) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Read the entry →Valid Accounts (T1078) is an Enterprise ATT&CK technique associated with Stealth, Persistence, Privilege Escalation, Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Value stream mapping visualizes the steps, waits, decisions, handoffs, information, and feedback required to move from a need to a delivered outcome.
Read the entry →The value streams and processes dimension explains how activities, decisions, controls, information, and handoffs combine to transform demand or opportunity into outcomes.
Read the entry →Vendor privacy due diligence evaluates whether a provider’s processing, controls, governance, history, and supply chain are appropriate for the intended data and service risk.
Read the entry →Vendor security negotiation uses requirements, evidence, leverage, alternatives, and contract terms to reach defensible security outcomes with suppliers.
Read the entry →Verclsid (T1218.012) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Read the entry →Apply RC.RP-03 to achieve this CSF 2.0 outcome: The integrity of backups and other restoration assets is verified before using them for restoration.
Read the entry →Apply RC.RP-05 to achieve this CSF 2.0 outcome: The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0039, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing 2024 zero-day exploitation of Versa Director servers at service providers for credential capture and follow-on access.
Read the entry →Video Capture (T1125) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Virtual LANs (VLANs) is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Read the entry →Virtual Machine Discovery (T1673) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Virtual Machine Security concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Read the entry →Virtual machine snapshot security governs point-in-time state copies that may contain memory, credentials, sensitive data, vulnerable software, and configuration that later returns during rollback.
Read the entry →Virtual network security applies segmentation, traffic policy, monitoring, address controls, and management separation to software-defined switches, interfaces, overlays, and workload networks.
Read the entry →Virtual Private Network Protocols describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Read the entry →A virtual private network creates a protected communication path across an untrusted or shared network for users, sites, or systems.
Read the entry →Virtual Private Server (T1583.003) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Virtual Private Server (T1584.003) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Virtual project team management deliberately creates communication, coordination, trust, inclusion, security, and decision practices for people working across locations and time zones.
Read the entry →Virtualization and containers isolate workloads and share underlying resources through hypervisors, operating-system controls, images, and orchestration platforms.
Read the entry →Virtualization/Sandbox Evasion (T1497) is an Enterprise ATT&CK technique associated with Stealth, Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Visual Basic (T1059.005) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Vulnerabilities (T1588.006) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Apply ID.RA-08 to achieve this CSF 2.0 outcome: Processes are established for receiving, analyzing, and responding to vulnerability disclosures.
Read the entry →Vulnerability management is a continuous program for discovering weaknesses, understanding exposure and consequence, selecting treatment, verifying remediation, and monitoring change.
Read the entry →Vulnerability remediation validation confirms that the weakness is actually removed or reduced, the correct asset was changed, and the fix did not create unacceptable side effects.
Read the entry →Vulnerability remediation verification confirms that an approved patch, configuration change, mitigation, compensating control, or removal actually reduced the intended exposure without creating a new failure.
Read the entry →Vulnerability scanning uses automated checks to identify known weaknesses, missing updates, unsafe configurations, exposed services, and other conditions that may require review.
Read the entry →Use authenticated and appropriately scoped assessment to identify known vulnerabilities, missing updates, weak configurations, and exposed services. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.
Read the entry →Vulnerability Scanning (T1595.002) is an Enterprise ATT&CK sub-technique under Active Scanning. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →WHOIS (T1596.002) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →A defensive guide to the Enterprise ATT&CK campaign record C0037, including chronology, evidence, behavior mapping, and resilience lessons. The official record summarizes public reporting describing 2023 Pikabot distribution activity linked to Black Basta ransomware deployment through malicious email attachments.
Read the entry →Weaken Encryption (T1600) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Web application attack classes include injection, broken access control, authentication failures, insecure design, misconfiguration, component risk, request forgery, and unsafe handling of data and sessions.
Read the entry →Web application penetration testing evaluates how an application handles identity, authorization, input, sessions, business rules, APIs, dependencies, and trust boundaries under realistic misuse.
Read the entry →Web Cookies (T1606.001) is an Enterprise ATT&CK sub-technique under Forge Web Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Web Portal Capture (T1056.003) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
Read the entry →Web Protocols (T1071.001) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Read the entry →Web Service (T1102) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Web Services (T1583.006) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Web Services (T1584.006) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →Web Session Cookie (T1550.004) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Read the entry →Web Shell (T1505.003) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →WebSocket security protects long-lived, bidirectional connections that begin with an HTTP upgrade and then carry application-defined messages outside the normal request-response pattern.
Read the entry →Webhook authentication and replay protection verify that an event came from an authorized sender, was not altered, is timely, and has not already been processed.
Read the entry →Wi-Fi Discovery (T1016.002) is an Enterprise ATT&CK sub-technique under System Network Configuration Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Read the entry →Wi-Fi Networks (T1669) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →Windows authentication is the collection of local and domain mechanisms Windows uses to verify identities, establish logon sessions, obtain network credentials, and authorize access to operating-system and enterprise resources.
Read the entry →Windows Command Shell (T1059.003) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →Windows Credential Guard uses virtualization-based security to isolate selected domain credentials from the normal operating system so that compromise of the host is less likely to expose reusable NTLM hashes and Kerberos ticket-granting tickets.
Read the entry →Windows Credential Manager (T1555.004) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Read the entry →Windows Defender Firewall is a stateful host firewall that applies profile-aware inbound and outbound rules to programs, services, ports, protocols, interfaces, users, and network conditions.
Read the entry →Windows Event Logs is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Read the entry →Windows Host Firewall (T1686.003) is an Enterprise ATT&CK sub-technique under Disable or Modify System Firewall. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →Windows Local Administrator Password Solution automatically generates, rotates, stores, and controls retrieval of unique local administrator passwords so a compromised password on one device cannot be reused across an entire fleet.
Read the entry →An adversary uses Windows Management Instrumentation to query, execute, configure, or remotely manage Windows systems.
Read the entry →Windows Management Instrumentation Event Subscription (T1546.003) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Read the entry →Windows Permissions (T1222.001) is an Enterprise ATT&CK sub-technique under File and Directory Permissions Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Read the entry →The Windows Registry is a hierarchical configuration database whose keys and values influence operating-system, service, application, security, persistence, and user behavior; protecting it requires permission control, change monitoring, and recovery discipline.
Read the entry →Windows Remote Management (T1021.006) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Read the entry →Windows Service (T1543.003) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Winlogon Helper DLL (T1547.004) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →Wireless Authentication and Encryption is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Read the entry →Wireless security protects radio-based network access through strong authentication, encryption, secure configuration, monitoring, and controlled coverage.
Read the entry →Wordlist Scanning (T1595.003) is an Enterprise ATT&CK sub-technique under Active Scanning. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Read the entry →Work-in-progress limits constrain how many items can occupy defined workflow states so teams finish work, expose bottlenecks, and reduce delay.
Read the entry →Written Content (T1683.001) is an Enterprise ATT&CK sub-technique under Generate Content. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Read the entry →XDG Autostart Entries (T1547.013) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Read the entry →XML External Entity risk arises when an XML parser resolves attacker-controlled external entities or related document features, potentially reading local resources, making server-side requests, disclosing data, or consuming excessive resources.
Read the entry →XPC Services (T1559.003) is an Enterprise ATT&CK sub-technique under Inter-Process Communication. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Read the entry →XSL Script Processing (T1220) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Read the entry →YARA is a pattern-matching language used to classify files, memory, and other byte or text content by combining strings, metadata, modules, and Boolean conditions into reusable detection rules.
Read the entry →Zero Trust is an architectural approach that evaluates access requests using identity, device, resource, context, and risk while limiting implicit trust and lateral movement.
Read the entry →A defensive guide to the Enterprise ATT&CK activity-cluster record G0018, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a China-based activity cluster reported against organizations involved in financial, economic, and trade policy, often using publicly available remote-access tools.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S0110, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a task-scheduling utility available on several operating systems.
Read the entry →A defensive guide to the Enterprise ATT&CK software record S1176, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a Windows utility that displays or changes file and directory attributes.
Read the entry →systemd service hardening uses unit-level sandboxing, identity, filesystem, capability, namespace, and resource controls to reduce what a Linux service can do if it fails or is compromised.
Read the entry →vSphere Installation Bundles (T1505.006) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Read the entry →Try a broader term, an ATT&CK ID without punctuation, or clear the entry-type filter.
