Cyber Wiki Learning Path

MITRE ATT&CK® for Windows

Focus ATT&CK study on Windows behavior, defensive context, telemetry, investigation, and architecture.

Recommended Sequence

89 connected entries

AS-REP Roasting

AS-REP roasting targets Active Directory accounts that do not require Kerberos preauthentication, allowing an attacker to request an authentication response containing password-derived material and attempt offline password guessing.

ATT&CK technique profile · Intermediate

Abuse Elevation Control Mechanism (T1548)

An adversary misuses an operating-system mechanism intended to govern privilege elevation so activity runs with higher permissions.

ATT&CK technique profile · Intermediate

Access Token Manipulation (T1134)

An adversary duplicates, creates, replaces, or impersonates Windows access tokens to act in another security context.

ATT&CK technique profile · Intermediate

Account Discovery (T1087)

An adversary enumerates local, domain, cloud, service, or application accounts and groups to identify useful identities and privileges.

Identity architecture concept · Intermediate

Active Directory Domains, Trees, Forests, and Trusts

Active Directory organizes identities and resources into domains; related domains form trees, one or more trees form a forest, and trusts define which security principals may be recognized across boundaries.

Systems security concept · Intermediate

Active Directory Fundamentals

Active Directory Fundamentals concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.

Execution control · Intermediate

Application Allowlisting

Application allowlisting permits only approved executables, scripts, libraries, installers, or other code to run under defined rules.

ATT&CK technique profile · Intermediate

Application Layer Protocol (T1071)

An adversary uses common application protocols such as web, DNS, mail, or file transfer to carry command-and-control traffic.

Resilience practice · Beginner

Backup and Recovery Strategies

Backup and recovery strategies preserve usable copies of data and system state so services can be restored after failure, error, corruption, or attack.

ATT&CK technique profile · Intermediate

Boot or Logon Autostart Execution (T1547)

An adversary changes startup or sign-in mechanisms so code runs automatically during system boot or user logon.

ATT&CK technique profile · Intermediate

Brute Force (T1110)

An adversary repeatedly attempts passwords, keys, or authentication combinations, including guessing, spraying, cracking, and credential stuffing.

ATT&CK technique profile · Intermediate

Clipboard Data (T1115)

An adversary reads clipboard contents to collect copied credentials, commands, documents, or other data exchanged through the user interface.

Cloud detection practice · Advanced

Cloud Storage Exfiltration Detection

Cloud storage exfiltration detection looks for unusual reads, downloads, copies, sharing changes, presigned access, cross-account movement, and data-transfer patterns.

Threat and attack concept · Intermediate

Command and Control Channels

Command and Control Channels is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

Detection practice · Intermediate

Command and Control Detection

Command and control detection identifies the channels, timing patterns, protocol misuse, infrastructure, and host behavior used to direct compromised systems.

ATT&CK technique profile · Intermediate

Command and Scripting Interpreter (T1059)

An adversary uses a shell, command interpreter, scripting language, or administrative console to execute instructions and automate activity.

ATT&CK technique profile · Intermediate

Create Account (T1136)

An adversary creates a local, domain, cloud, service, or application account that can be used for continued access.

Threat and attack concept · Intermediate

Credential Stuffing

Credential Stuffing is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

ATT&CK technique profile · Intermediate

Credentials from Password Stores (T1555)

An adversary extracts credentials, keys, cookies, or tokens from browsers, password managers, operating-system stores, or application repositories.

Active Directory credential-access technique · Advanced

DCSync

DCSync is an abuse of Active Directory replication rights in which an attacker makes a system act like a domain controller and requests password-derived credential data through normal directory replication protocols.

ATT&CK technique profile · Intermediate

Data Encrypted for Impact (T1486)

An adversary encrypts files, databases, virtual machines, or other information to disrupt availability and pressure the victim.

Detection practice · Intermediate

Data Exfiltration Detection

Data exfiltration detection looks for unauthorized movement of information through network, cloud, endpoint, application, and removable-media paths.

Threat and attack concept · Intermediate

Data Staging and Exfiltration

Data Staging and Exfiltration describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

ATT&CK technique profile · Intermediate

Data from Local System (T1005)

An adversary searches for and reads files, databases, application data, or other information stored on a compromised local system.

Detection engineering practice · Advanced

Detection as Code

Detection as code manages analytic rules, queries, parsers, tests, documentation, and deployment through version-controlled engineering practices so detection changes are reviewable, reproducible, testable, and safely promoted.

ATT&CK legacy profile · Intermediate

Disable or Modify System Firewall (Legacy T1562.004)

Disable or Modify System Firewall (T1562.004) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.

ATT&CK legacy profile · Intermediate

Disable or Modify Tools (Legacy T1562.001)

Disable or Modify Tools (T1562.001) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.

ATT&CK technique profile · Intermediate

Domain or Tenant Policy Modification (T1484)

An adversary changes domain, federation, identity-provider, tenant, or cloud policy to weaken controls, grant access, or alter trusted behavior.

ATT&CK technique profile · Intermediate

Drive-by Compromise (T1189)

A user is exposed to malicious web content that exploits a browser or convinces the user to retrieve and run harmful content, creating an entry path through normal browsing.

ATT&CK technique profile · Intermediate

Encrypted Channel (T1573)

An adversary protects command traffic with encryption or an encrypted protocol to conceal content and complicate inspection.

ATT&CK technique profile · Intermediate

Exfiltration Over C2 Channel (T1041)

An adversary sends collected data through the same command-and-control channel used to manage compromised systems.

ATT&CK technique profile · Intermediate

Exfiltration Over Web Service (T1567)

An adversary uploads information through a web service, cloud-storage provider, code-sharing service, or other internet platform that may resemble normal use.

ATT&CK technique profile · Intermediate

Exploit Public-Facing Application (T1190)

An adversary exploits a weakness in an internet-accessible application, service, appliance, management interface, or workload to gain access.

ATT&CK technique profile · Intermediate

Exploitation for Privilege Escalation (T1068)

An adversary exploits a software or configuration weakness to cross a local or workload privilege boundary.

ATT&CK technique profile · Intermediate

Exploitation of Remote Services (T1210)

An adversary exploits a weakness in an internal remote service to gain access to another system without relying solely on valid credentials.

ATT&CK technique profile · Intermediate

External Remote Services (T1133)

An adversary uses externally reachable VPN, remote desktop, SSH, virtual application, management, or other remote-access services to enter or return to an environment.

Application security concept · Intermediate

File Upload Security

File Upload Security is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.

ATT&CK technique profile · Intermediate

Hide Artifacts (T1564)

An adversary conceals files, directories, processes, windows, accounts, services, or cloud resources from ordinary inspection.

Network security · Intermediate

Host Firewall Policy

Host firewall policy limits inbound, outbound, and forwarded traffic at the workload boundary using explicit service intent, stateful rules, controlled administration, and verified persistence.

ATT&CK legacy profile · Intermediate

Impair Defenses (Legacy T1562)

Impair Defenses (T1562) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.

Recovery assurance practice · Advanced

Incident Recovery Validation

Incident recovery validation confirms that services are restored, attacker access is removed, controls are effective, data is trustworthy, and monitoring can detect recurrence.

ATT&CK technique profile · Intermediate

Indicator Removal (T1070)

An adversary deletes or alters logs, files, timestamps, command history, accounts, or other evidence to reduce the visible record of activity.

ATT&CK technique profile · Intermediate

Ingress Tool Transfer (T1105)

An adversary transfers tools or files from an external location into a compromised environment, often through an existing command channel.

ATT&CK technique profile · Intermediate

Inhibit System Recovery (T1490)

An adversary deletes, disables, corrupts, or reconfigures backups, snapshots, recovery partitions, services, or boot options to make restoration harder.

Credential attack technique · Advanced

Kerberoasting

Kerberoasting is an attack technique in which an authenticated domain user requests Kerberos service tickets for service principal names and attempts to crack the ticket material offline to recover weak service-account passwords.

Authentication protocol concept · Advanced

Kerberos in Active Directory

Kerberos in Active Directory is a ticket-based authentication system in which domain controllers acting as key distribution centers issue time-limited tickets that let users and services prove identity without repeatedly transmitting passwords.

Windows credential-protection concept · Advanced

LSASS and Credential Protection

The Local Security Authority Subsystem Service enforces local security policy, validates certain logons, creates access tokens, and handles credential material; protecting LSASS is central to limiting credential theft from Windows endpoints.

Adversary behavior · Intermediate

Lateral Movement

Lateral movement is the use of credentials, remote services, trust relationships, and administrative tools to move from one system or account to another.

ATT&CK technique profile · Intermediate

Lateral Tool Transfer (T1570)

An adversary copies tools or files between systems inside the target environment to support continued movement and execution.

Security operations process · Intermediate

Log Source Onboarding

Log source onboarding is the controlled process of bringing a new event source into security monitoring with validated collection, parsing, timestamps, identifiers, access controls, retention, health checks, and documented analytic value.

Framework learning hub · All levels

MITRE ATT&CK® Educational Learning Center

A structured, versioned learning center that connects Enterprise ATT&CK adversary behavior to architecture, telemetry, detection, mitigation, investigation, recovery, and Bare Metal Cyber coursework.

Framework scope · Intermediate

MITRE ATT&CK® Platforms and Technology Scope

How ATT&CK platform metadata helps analysts distinguish Windows, Linux, macOS, cloud, identity, SaaS, containers, network devices, ESXi, and pre-compromise activity.

ATT&CK technique profile · Intermediate

Masquerading (T1036)

An adversary makes an artifact, process, account, service, or task appear legitimate by using misleading names, locations, metadata, or presentation.

ATT&CK technique profile · Intermediate

Native API (T1106)

An adversary calls operating-system or runtime application programming interfaces directly to perform actions that might otherwise require ordinary utilities.

Network monitoring concept · Advanced

Network Traffic Analysis

Network traffic analysis examines packet, flow, DNS, proxy, TLS, routing, and session metadata to understand communication patterns, identify suspicious behavior, and reconstruct activity across network trust boundaries.

ATT&CK technique profile · Intermediate

OS Credential Dumping (T1003)

An adversary reads operating-system memory, databases, caches, registry material, or directory replication data to obtain credential artifacts.

ATT&CK technique profile · Intermediate

Obfuscated Files or Information (T1027)

An adversary encodes, encrypts, packs, fragments, or otherwise transforms files and information to make discovery or analysis more difficult.

Threat and attack concept · Intermediate

On-Path Attacks

On-Path Attacks describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

Security operations practice · Intermediate

Packet Capture and PCAP Analysis

Packet Capture and PCAP Analysis is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.

Credential replay technique · Advanced

Pass-the-Hash

Pass-the-Hash is a credential replay technique in which an attacker uses a captured NTLM password hash to authenticate without learning or typing the original plaintext password.

Threat and attack concept · Intermediate

Password Attacks

Password Attacks describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

Threat and attack concept · Intermediate

Password Spraying

Password Spraying describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

Attack technique · Beginner

Phishing

Phishing uses deceptive messages, sites, calls, or prompts to persuade a person to reveal information, approve access, send money, or run malicious content.

Security operations practice · Intermediate

PowerShell Security and Logging

PowerShell Security and Logging is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.

ATT&CK technique profile · Intermediate

Process Discovery (T1057)

An adversary lists running processes, services, containers, or workloads to identify security tools, applications, users, and possible targets.

Attack pattern · Beginner

Ransomware

Ransomware operations disrupt access to systems or data and may combine encryption with theft, extortion, public pressure, and attacks on recovery systems.

Recovery assurance practice · Intermediate

Recovery Testing and Restore Assurance

Recovery testing and restore assurance verify that protected data, systems, dependencies, procedures, and personnel can meet defined recovery needs.

Remote administration security concept · Advanced

Remote Desktop Security

Remote Desktop security protects Windows interactive administrative sessions by controlling who can connect, how endpoints authenticate, where credentials are exposed, which channels are redirected, and how activity is monitored and contained.

ATT&CK technique profile · Intermediate

Remote Services (T1021)

An adversary uses authenticated remote services such as RDP, SMB, WinRM, SSH, VNC, or management protocols to access another system.

ATT&CK technique profile · Intermediate

Scheduled Task/Job (T1053)

An adversary creates or modifies a scheduled task, cron job, cloud schedule, or similar mechanism to run code at a chosen time or event.

ATT&CK technique profile · Intermediate

Screen Capture (T1113)

An adversary captures screenshots or display content to collect information visible in applications, sessions, and user workflows.

ATT&CK technique profile · Intermediate

Server Software Component (T1505)

An adversary adds or modifies a component within server software—such as a web shell, plug-in, module, or management extension—to preserve access or execute code.

Application security concept · Intermediate

Server-Side Request Forgery

Server-Side Request Forgery is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.

Security operations practice · Intermediate

Sigma Rules

Sigma Rules is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.

Network security concept · Beginner

Stateful and Stateless Firewalls

Stateful and Stateless Firewalls is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

Security operations practice · Intermediate

Sysmon

Sysmon is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

ATT&CK technique profile · Intermediate

System Information Discovery (T1082)

An adversary queries operating-system, architecture, hardware, version, patch, hostname, or instance information to guide later actions.

ATT&CK technique profile · Intermediate

System Network Configuration Discovery (T1016)

An adversary queries addresses, interfaces, routes, DNS settings, proxies, adapters, and other network configuration to understand connectivity.

Risk program · Intermediate

Third-Party Cyber Risk Management

Third-party risk management identifies, evaluates, treats, monitors, and responds to cyber risk introduced by vendors, cloud services, software, partners, and other external dependencies.

Proactive analysis · Advanced

Threat Hunting

Threat hunting is a structured search for adversary behavior or hidden compromise that has not been fully identified by existing alerts.

ATT&CK technique profile · Intermediate

Trusted Relationship (T1199)

An adversary abuses a supplier, partner, managed service, federation, software, or other trusted relationship to reach the target environment.

ATT&CK technique profile · Intermediate

Unsecured Credentials (T1552)

An adversary searches files, repositories, scripts, logs, environment variables, instance metadata, or configuration for exposed authentication material.

ATT&CK technique profile · Intermediate

User Execution (T1204)

An adversary depends on a user to open, launch, approve, install, or otherwise trigger malicious content or code.

Application security concept · Intermediate

Web Application Attack Classes

Web application attack classes include injection, broken access control, authentication failures, insecure design, misconfiguration, component risk, request forgery, and unsafe handling of data and sessions.

Windows platform-security control · Advanced

Windows Credential Guard

Windows Credential Guard uses virtualization-based security to isolate selected domain credentials from the normal operating system so that compromise of the host is less likely to expose reusable NTLM hashes and Kerberos ticket-granting tickets.

Host firewall control · Intermediate

Windows Defender Firewall

Windows Defender Firewall is a stateful host firewall that applies profile-aware inbound and outbound rules to programs, services, ports, protocols, interfaces, users, and network conditions.

Security operations practice · Intermediate

Windows Event Logs

Windows Event Logs is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.

ATT&CK technique profile · Intermediate

Windows Management Instrumentation (T1047)

An adversary uses Windows Management Instrumentation to query, execute, configure, or remotely manage Windows systems.

Malware detection concept · Advanced

YARA Rules

YARA is a pattern-matching language used to classify files, memory, and other byte or text content by combining strings, metadata, modules, and Boolean conditions into reusable detection rules.