Cyber Wiki Learning Path

MITRE ATT&CK® for macOS

Focus ATT&CK study on macOS behavior, defensive context, telemetry, investigation, and architecture.

Recommended Sequence

67 connected entries

Abuse Elevation Control Mechanism (T1548)

An adversary misuses an operating-system mechanism intended to govern privilege elevation so activity runs with higher permissions.

ATT&CK technique profile · Intermediate

Account Discovery (T1087)

An adversary enumerates local, domain, cloud, service, or application accounts and groups to identify useful identities and privileges.

Execution control · Intermediate

Application Allowlisting

Application allowlisting permits only approved executables, scripts, libraries, installers, or other code to run under defined rules.

ATT&CK technique profile · Intermediate

Application Layer Protocol (T1071)

An adversary uses common application protocols such as web, DNS, mail, or file transfer to carry command-and-control traffic.

Resilience practice · Beginner

Backup and Recovery Strategies

Backup and recovery strategies preserve usable copies of data and system state so services can be restored after failure, error, corruption, or attack.

ATT&CK technique profile · Intermediate

Boot or Logon Autostart Execution (T1547)

An adversary changes startup or sign-in mechanisms so code runs automatically during system boot or user logon.

ATT&CK technique profile · Intermediate

Brute Force (T1110)

An adversary repeatedly attempts passwords, keys, or authentication combinations, including guessing, spraying, cracking, and credential stuffing.

ATT&CK technique profile · Intermediate

Clipboard Data (T1115)

An adversary reads clipboard contents to collect copied credentials, commands, documents, or other data exchanged through the user interface.

Cloud detection practice · Advanced

Cloud Storage Exfiltration Detection

Cloud storage exfiltration detection looks for unusual reads, downloads, copies, sharing changes, presigned access, cross-account movement, and data-transfer patterns.

Threat and attack concept · Intermediate

Command and Control Channels

Command and Control Channels is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

Detection practice · Intermediate

Command and Control Detection

Command and control detection identifies the channels, timing patterns, protocol misuse, infrastructure, and host behavior used to direct compromised systems.

ATT&CK technique profile · Intermediate

Command and Scripting Interpreter (T1059)

An adversary uses a shell, command interpreter, scripting language, or administrative console to execute instructions and automate activity.

ATT&CK technique profile · Intermediate

Create Account (T1136)

An adversary creates a local, domain, cloud, service, or application account that can be used for continued access.

Threat and attack concept · Intermediate

Credential Stuffing

Credential Stuffing is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

ATT&CK technique profile · Intermediate

Credentials from Password Stores (T1555)

An adversary extracts credentials, keys, cookies, or tokens from browsers, password managers, operating-system stores, or application repositories.

ATT&CK technique profile · Intermediate

Data Encrypted for Impact (T1486)

An adversary encrypts files, databases, virtual machines, or other information to disrupt availability and pressure the victim.

Detection practice · Intermediate

Data Exfiltration Detection

Data exfiltration detection looks for unauthorized movement of information through network, cloud, endpoint, application, and removable-media paths.

Threat and attack concept · Intermediate

Data Staging and Exfiltration describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

ATT&CK technique profile · Intermediate

Data from Local System (T1005)

An adversary searches for and reads files, databases, application data, or other information stored on a compromised local system.

Detection engineering practice · Advanced

Detection as Code

Detection as code manages analytic rules, queries, parsers, tests, documentation, and deployment through version-controlled engineering practices so detection changes are reviewable, reproducible, testable, and safely promoted.

ATT&CK legacy profile · Intermediate

Disable or Modify System Firewall (Legacy T1562.004)

Disable or Modify System Firewall (T1562.004) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.

ATT&CK legacy profile · Intermediate

Disable or Modify Tools (Legacy T1562.001)

Disable or Modify Tools (T1562.001) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.

ATT&CK technique profile · Intermediate

Drive-by Compromise (T1189)

A user is exposed to malicious web content that exploits a browser or convinces the user to retrieve and run harmful content, creating an entry path through normal browsing.

ATT&CK technique profile · Intermediate

Encrypted Channel (T1573)

An adversary protects command traffic with encryption or an encrypted protocol to conceal content and complicate inspection.

ATT&CK technique profile · Intermediate

Exfiltration Over C2 Channel (T1041)

An adversary sends collected data through the same command-and-control channel used to manage compromised systems.

ATT&CK technique profile · Intermediate

Exfiltration Over Web Service (T1567)

An adversary uploads information through a web service, cloud-storage provider, code-sharing service, or other internet platform that may resemble normal use.

ATT&CK technique profile · Intermediate

Exploitation for Privilege Escalation (T1068)

An adversary exploits a software or configuration weakness to cross a local or workload privilege boundary.

ATT&CK technique profile · Intermediate

External Remote Services (T1133)

An adversary uses externally reachable VPN, remote desktop, SSH, virtual application, management, or other remote-access services to enter or return to an environment.

ATT&CK technique profile · Intermediate

Hide Artifacts (T1564)

An adversary conceals files, directories, processes, windows, accounts, services, or cloud resources from ordinary inspection.

Network security · Intermediate

Host Firewall Policy

Host firewall policy limits inbound, outbound, and forwarded traffic at the workload boundary using explicit service intent, stateful rules, controlled administration, and verified persistence.

ATT&CK legacy profile · Intermediate

Impair Defenses (Legacy T1562)

Impair Defenses (T1562) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.

Recovery assurance practice · Advanced

Incident Recovery Validation

Incident recovery validation confirms that services are restored, attacker access is removed, controls are effective, data is trustworthy, and monitoring can detect recurrence.

ATT&CK technique profile · Intermediate

Indicator Removal (T1070)

An adversary deletes or alters logs, files, timestamps, command history, accounts, or other evidence to reduce the visible record of activity.

ATT&CK technique profile · Intermediate

Ingress Tool Transfer (T1105)

An adversary transfers tools or files from an external location into a compromised environment, often through an existing command channel.

ATT&CK technique profile · Intermediate

Inhibit System Recovery (T1490)

An adversary deletes, disables, corrupts, or reconfigures backups, snapshots, recovery partitions, services, or boot options to make restoration harder.

Adversary behavior · Intermediate

Lateral Movement

Lateral movement is the use of credentials, remote services, trust relationships, and administrative tools to move from one system or account to another.

ATT&CK technique profile · Intermediate

Lateral Tool Transfer (T1570)

An adversary copies tools or files between systems inside the target environment to support continued movement and execution.

Security operations process · Intermediate

Log Source Onboarding

Log source onboarding is the controlled process of bringing a new event source into security monitoring with validated collection, parsing, timestamps, identifiers, access controls, retention, health checks, and documented analytic value.

Framework learning hub · All levels

MITRE ATT&CK® Educational Learning Center

A structured, versioned learning center that connects Enterprise ATT&CK adversary behavior to architecture, telemetry, detection, mitigation, investigation, recovery, and Bare Metal Cyber coursework.

Framework scope · Intermediate

MITRE ATT&CK® Platforms and Technology Scope

How ATT&CK platform metadata helps analysts distinguish Windows, Linux, macOS, cloud, identity, SaaS, containers, network devices, ESXi, and pre-compromise activity.

ATT&CK technique profile · Intermediate

Masquerading (T1036)

An adversary makes an artifact, process, account, service, or task appear legitimate by using misleading names, locations, metadata, or presentation.

ATT&CK technique profile · Intermediate

Native API (T1106)

An adversary calls operating-system or runtime application programming interfaces directly to perform actions that might otherwise require ordinary utilities.

Network monitoring concept · Advanced

Network Traffic Analysis

Network traffic analysis examines packet, flow, DNS, proxy, TLS, routing, and session metadata to understand communication patterns, identify suspicious behavior, and reconstruct activity across network trust boundaries.

ATT&CK technique profile · Intermediate

OS Credential Dumping (T1003)

An adversary reads operating-system memory, databases, caches, registry material, or directory replication data to obtain credential artifacts.

ATT&CK technique profile · Intermediate

Obfuscated Files or Information (T1027)

An adversary encodes, encrypts, packs, fragments, or otherwise transforms files and information to make discovery or analysis more difficult.

Threat and attack concept · Intermediate

On-Path Attacks

On-Path Attacks describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

Security operations practice · Intermediate

Packet Capture and PCAP Analysis

Packet Capture and PCAP Analysis is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.

Threat and attack concept · Intermediate

Password Attacks

Password Attacks describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

Threat and attack concept · Intermediate

Password Spraying

Password Spraying describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

Attack technique · Beginner

Phishing

Phishing uses deceptive messages, sites, calls, or prompts to persuade a person to reveal information, approve access, send money, or run malicious content.

ATT&CK technique profile · Intermediate

Process Discovery (T1057)

An adversary lists running processes, services, containers, or workloads to identify security tools, applications, users, and possible targets.

Attack pattern · Beginner

Ransomware

Ransomware operations disrupt access to systems or data and may combine encryption with theft, extortion, public pressure, and attacks on recovery systems.

Recovery assurance practice · Intermediate

Recovery Testing and Restore Assurance

Recovery testing and restore assurance verify that protected data, systems, dependencies, procedures, and personnel can meet defined recovery needs.

ATT&CK technique profile · Intermediate

Remote Services (T1021)

An adversary uses authenticated remote services such as RDP, SMB, WinRM, SSH, VNC, or management protocols to access another system.

ATT&CK technique profile · Intermediate

Scheduled Task/Job (T1053)

An adversary creates or modifies a scheduled task, cron job, cloud schedule, or similar mechanism to run code at a chosen time or event.

ATT&CK technique profile · Intermediate

Screen Capture (T1113)

An adversary captures screenshots or display content to collect information visible in applications, sessions, and user workflows.

Security operations practice · Intermediate

Sigma Rules

Sigma Rules is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.

Network security concept · Beginner

Stateful and Stateless Firewalls

Stateful and Stateless Firewalls is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

Security operations practice · Intermediate

Sysmon

Sysmon is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

ATT&CK technique profile · Intermediate

System Information Discovery (T1082)

An adversary queries operating-system, architecture, hardware, version, patch, hostname, or instance information to guide later actions.

ATT&CK technique profile · Intermediate

System Network Configuration Discovery (T1016)

An adversary queries addresses, interfaces, routes, DNS settings, proxies, adapters, and other network configuration to understand connectivity.

Proactive analysis · Advanced

Threat Hunting

Threat hunting is a structured search for adversary behavior or hidden compromise that has not been fully identified by existing alerts.

ATT&CK technique profile · Intermediate

Unsecured Credentials (T1552)

An adversary searches files, repositories, scripts, logs, environment variables, instance metadata, or configuration for exposed authentication material.

ATT&CK technique profile · Intermediate

User Execution (T1204)

An adversary depends on a user to open, launch, approve, install, or otherwise trigger malicious content or code.

Windows platform-security control · Advanced

Windows Credential Guard

Windows Credential Guard uses virtualization-based security to isolate selected domain credentials from the normal operating system so that compromise of the host is less likely to expose reusable NTLM hashes and Kerberos ticket-granting tickets.

Host firewall control · Intermediate

Windows Defender Firewall

Windows Defender Firewall is a stateful host firewall that applies profile-aware inbound and outbound rules to programs, services, ports, protocols, interfaces, users, and network conditions.

Malware detection concept · Advanced

YARA Rules

YARA is a pattern-matching language used to classify files, memory, and other byte or text content by combining strings, metadata, modules, and Boolean conditions into reusable detection rules.