Threat-Informed Defense
Find active technique and sub-technique profiles by ATT&CK ID, behavior name, tactic, or platform.
Data Obfuscation (T1001) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Junk Data (T1001.001) is an Enterprise ATT&CK sub-technique under Data Obfuscation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Steganography (T1001.002) is an Enterprise ATT&CK sub-technique under Data Obfuscation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Protocol or Service Impersonation (T1001.003) is an Enterprise ATT&CK sub-technique under Data Obfuscation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →An adversary reads operating-system memory, databases, caches, registry material, or directory replication data to obtain credential artifacts.
Open profile →Windows Credential Guard uses virtualization-based security to isolate selected domain credentials from the normal operating system so that compromise of the host is less likely to expose reusable NTLM hashes and Kerberos ticket-granting tickets.
Open profile →The Local Security Authority Subsystem Service enforces local security policy, validates certain logons, creates access tokens, and handles credential material; protecting LSASS is central to limiting credential theft from Windows endpoints.
Open profile →LSASS Memory (T1003.001) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Security Account Manager (T1003.002) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →NTDS (T1003.003) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →LSA Secrets (T1003.004) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Cached Domain Credentials (T1003.005) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →DCSync is an abuse of Active Directory replication rights in which an attacker makes a system act like a domain controller and requests password-derived credential data through normal directory replication protocols.
Open profile →DCSync (T1003.006) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Proc Filesystem (T1003.007) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →/etc/passwd and /etc/shadow (T1003.008) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →An adversary searches for and reads files, databases, application data, or other information stored on a compromised local system.
Open profile →Direct Volume Access (T1006) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →System Service Discovery (T1007) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Fallback Channels (T1008) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Application Window Discovery (T1010) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Exfiltration Over Other Network Medium (T1011) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Exfiltration Over Bluetooth (T1011.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Other Network Medium. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Open profile →Query Registry (T1012) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Rootkit (T1014) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An adversary queries addresses, interfaces, routes, DNS settings, proxies, adapters, and other network configuration to understand connectivity.
Open profile →Internet Connection Discovery (T1016.001) is an Enterprise ATT&CK sub-technique under System Network Configuration Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Open profile →Wi-Fi Discovery (T1016.002) is an Enterprise ATT&CK sub-technique under System Network Configuration Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Open profile →Remote System Discovery (T1018) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Automated Exfiltration (T1020) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Traffic Duplication (T1020.001) is an Enterprise ATT&CK sub-technique under Automated Exfiltration. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Open profile →Lateral movement is the use of credentials, remote services, trust relationships, and administrative tools to move from one system or account to another.
Open profile →An adversary uses authenticated remote services such as RDP, SMB, WinRM, SSH, VNC, or management protocols to access another system.
Open profile →Remote Desktop Protocol (T1021.001) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Open profile →Remote Desktop security protects Windows interactive administrative sessions by controlling who can connect, how endpoints authenticate, where credentials are exposed, which channels are redirected, and how activity is monitored and contained.
Open profile →SMB/Windows Admin Shares (T1021.002) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Open profile →Distributed Component Object Model (T1021.003) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Open profile →SSH (T1021.004) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Open profile →VNC (T1021.005) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Open profile →Windows Remote Management (T1021.006) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Open profile →Cloud Services (T1021.007) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Open profile →Direct Cloud VM Connections (T1021.008) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Open profile →Data from Removable Media (T1025) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An adversary encodes, encrypts, packs, fragments, or otherwise transforms files and information to make discovery or analysis more difficult.
Open profile →YARA is a pattern-matching language used to classify files, memory, and other byte or text content by combining strings, metadata, modules, and Boolean conditions into reusable detection rules.
Open profile →Binary Padding (T1027.001) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Software Packing (T1027.002) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Steganography (T1027.003) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Compile After Delivery (T1027.004) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Indicator Removal from Tools (T1027.005) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →HTML Smuggling (T1027.006) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Dynamic API Resolution (T1027.007) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Stripped Payloads (T1027.008) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Embedded Payloads (T1027.009) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Command Obfuscation (T1027.010) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Fileless Storage (T1027.011) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →LNK Icon Smuggling (T1027.012) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Encrypted/Encoded File (T1027.013) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Polymorphic Code (T1027.014) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Compression (T1027.015) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Junk Code Insertion (T1027.016) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →SVG Smuggling (T1027.017) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Invisible Unicode (T1027.018) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Scheduled Transfer (T1029) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Data Transfer Size Limits (T1030) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →System Owner/User Discovery (T1033) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An adversary makes an artifact, process, account, service, or task appear legitimate by using misleading names, locations, metadata, or presentation.
Open profile →Invalid Code Signature (T1036.001) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Right-to-Left Override (T1036.002) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Rename Legitimate Utilities (T1036.003) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Masquerade Task or Service (T1036.004) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Match Legitimate Resource Name or Location (T1036.005) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Space after Filename (T1036.006) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Double File Extension (T1036.007) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Masquerade File Type (T1036.008) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Break Process Trees (T1036.009) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Masquerade Account Name (T1036.010) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Overwrite Process Arguments (T1036.011) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Browser Fingerprint (T1036.012) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Boot or Logon Initialization Scripts (T1037) is an Enterprise ATT&CK technique associated with Persistence, Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Logon Script (Windows) (T1037.001) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Login Hook (T1037.002) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Network Logon Script (T1037.003) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →RC Scripts (T1037.004) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Startup Items (T1037.005) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Data from Network Shared Drive (T1039) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Network Sniffing (T1040) is an Enterprise ATT&CK technique associated with Credential Access, Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Data exfiltration detection looks for unauthorized movement of information through network, cloud, endpoint, application, and removable-media paths.
Open profile →An adversary sends collected data through the same command-and-control channel used to manage compromised systems.
Open profile →Network Service Discovery (T1046) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An adversary uses Windows Management Instrumentation to query, execute, configure, or remotely manage Windows systems.
Open profile →Exfiltration Over Alternative Protocol (T1048) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Exfiltration Over Symmetric Encrypted Non-C2 Protocol (T1048.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Alternative Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Open profile →Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (T1048.002) is an Enterprise ATT&CK sub-technique under Exfiltration Over Alternative Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Open profile →Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003) is an Enterprise ATT&CK sub-technique under Exfiltration Over Alternative Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Open profile →System Network Connections Discovery (T1049) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Exfiltration Over Physical Medium (T1052) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Exfiltration over USB (T1052.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Physical Medium. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Open profile →An adversary creates or modifies a scheduled task, cron job, cloud schedule, or similar mechanism to run code at a chosen time or event.
Open profile →At (T1053.002) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.
Open profile →Cron (T1053.003) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.
Open profile →Scheduled Task (T1053.005) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.
Open profile →Systemd Timers (T1053.006) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.
Open profile →Container Orchestration Job (T1053.007) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.
Open profile →Process Injection (T1055) is an Enterprise ATT&CK technique associated with Stealth, Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Dynamic-link Library Injection (T1055.001) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →Portable Executable Injection (T1055.002) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →Thread Execution Hijacking (T1055.003) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →Asynchronous Procedure Call (T1055.004) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →Thread Local Storage (T1055.005) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →Ptrace System Calls (T1055.008) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →Proc Memory (T1055.009) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →Extra Window Memory Injection (T1055.011) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →Process Hollowing (T1055.012) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →Process Doppelgänging (T1055.013) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →VDSO Hijacking (T1055.014) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →ListPlanting (T1055.015) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →Input Capture (T1056) is an Enterprise ATT&CK technique associated with Collection, Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Keylogging (T1056.001) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
Open profile →GUI Input Capture (T1056.002) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
Open profile →Web Portal Capture (T1056.003) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
Open profile →Credential API Hooking (T1056.004) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.
Open profile →An adversary lists running processes, services, containers, or workloads to identify security tools, applications, users, and possible targets.
Open profile →Application allowlisting permits only approved executables, scripts, libraries, installers, or other code to run under defined rules.
Open profile →Detection as code manages analytic rules, queries, parsers, tests, documentation, and deployment through version-controlled engineering practices so detection changes are reviewable, reproducible, testable, and safely promoted.
Open profile →An adversary uses a shell, command interpreter, scripting language, or administrative console to execute instructions and automate activity.
Open profile →Sigma Rules is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Open profile →Sysmon is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Open profile →Threat hunting is a structured search for adversary behavior or hidden compromise that has not been fully identified by existing alerts.
Open profile →PowerShell (T1059.001) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →PowerShell Security and Logging is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Open profile →AppleScript (T1059.002) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Windows Command Shell (T1059.003) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Unix Shell (T1059.004) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Visual Basic (T1059.005) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Python (T1059.006) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →JavaScript (T1059.007) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Network Device CLI (T1059.008) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Cloud API (T1059.009) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →AutoHotKey & AutoIT (T1059.010) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Lua (T1059.011) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Hypervisor CLI (T1059.012) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Container CLI/API (T1059.013) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →An adversary exploits a software or configuration weakness to cross a local or workload privilege boundary.
Open profile →Permission Groups Discovery (T1069) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Local Groups (T1069.001) is an Enterprise ATT&CK sub-technique under Permission Groups Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Open profile →Domain Groups (T1069.002) is an Enterprise ATT&CK sub-technique under Permission Groups Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Open profile →Cloud Groups (T1069.003) is an Enterprise ATT&CK sub-technique under Permission Groups Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Open profile →Log source onboarding is the controlled process of bringing a new event source into security monitoring with validated collection, parsing, timestamps, identifiers, access controls, retention, health checks, and documented analytic value.
Open profile →An adversary deletes or alters logs, files, timestamps, command history, accounts, or other evidence to reduce the visible record of activity.
Open profile →Windows Event Logs is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Open profile →Clear Command History (T1070.003) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →File Deletion (T1070.004) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Network Share Connection Removal (T1070.005) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Timestomp (T1070.006) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Clear Network Connection History and Configurations (T1070.007) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Clear Mailbox Data (T1070.008) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Clear Persistence (T1070.009) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Relocate Malware (T1070.010) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Command and Control Channels is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Open profile →Command and control detection identifies the channels, timing patterns, protocol misuse, infrastructure, and host behavior used to direct compromised systems.
Open profile →An adversary uses common application protocols such as web, DNS, mail, or file transfer to carry command-and-control traffic.
Open profile →Network traffic analysis examines packet, flow, DNS, proxy, TLS, routing, and session metadata to understand communication patterns, identify suspicious behavior, and reconstruct activity across network trust boundaries.
Open profile →Packet Capture and PCAP Analysis is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Open profile →Web Protocols (T1071.001) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →File Transfer Protocols (T1071.002) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Mail Protocols (T1071.003) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →DNS (T1071.004) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Publish/Subscribe Protocols (T1071.005) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Software Deployment Tools (T1072) is an Enterprise ATT&CK technique associated with Execution, Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Data Staging and Exfiltration describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Open profile →Data Staged (T1074) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Local Data Staging (T1074.001) is an Enterprise ATT&CK sub-technique under Data Staged. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →Remote Data Staging (T1074.002) is an Enterprise ATT&CK sub-technique under Data Staged. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →Valid Accounts (T1078) is an Enterprise ATT&CK technique associated with Stealth, Persistence, Privilege Escalation, Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Default Accounts (T1078.001) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.
Open profile →Domain Accounts (T1078.002) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.
Open profile →Local Accounts (T1078.003) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.
Open profile →Cloud Accounts (T1078.004) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.
Open profile →Taint Shared Content (T1080) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An adversary queries operating-system, architecture, hardware, version, patch, hostname, or instance information to guide later actions.
Open profile →File and Directory Discovery (T1083) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An adversary enumerates local, domain, cloud, service, or application accounts and groups to identify useful identities and privileges.
Open profile →Local Account (T1087.001) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Open profile →Active Directory Fundamentals concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
Open profile →Domain Account (T1087.002) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Open profile →Email Account (T1087.003) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Open profile →Cloud Account (T1087.004) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Open profile →Proxy (T1090) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Internal Proxy (T1090.001) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →External Proxy (T1090.002) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Multi-hop Proxy (T1090.003) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Domain Fronting (T1090.004) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Replication Through Removable Media (T1091) is an Enterprise ATT&CK technique associated with Lateral Movement, Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Communication Through Removable Media (T1092) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Non-Application Layer Protocol (T1095) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Account Manipulation (T1098) is an Enterprise ATT&CK technique associated with Persistence, Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Additional Cloud Credentials (T1098.001) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Additional Email Delegate Permissions (T1098.002) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Additional Cloud Roles (T1098.003) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →SSH Authorized Keys (T1098.004) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Device Registration (T1098.005) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Additional Container Cluster Roles (T1098.006) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Additional Local or Domain Groups (T1098.007) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Web Service (T1102) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Dead Drop Resolver (T1102.001) is an Enterprise ATT&CK sub-technique under Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Bidirectional Communication (T1102.002) is an Enterprise ATT&CK sub-technique under Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →One-Way Communication (T1102.003) is an Enterprise ATT&CK sub-technique under Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Multi-Stage Channels (T1104) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An adversary transfers tools or files from an external location into a compromised environment, often through an existing command channel.
Open profile →An adversary calls operating-system or runtime application programming interfaces directly to perform actions that might otherwise require ordinary utilities.
Open profile →An adversary repeatedly attempts passwords, keys, or authentication combinations, including guessing, spraying, cracking, and credential stuffing.
Open profile →Password Attacks describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Open profile →Password Guessing (T1110.001) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Password Cracking (T1110.002) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Password Spraying (T1110.003) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Password Spraying describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Open profile →Credential Stuffing is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.
Open profile →Credential Stuffing (T1110.004) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Multi-Factor Authentication Interception (T1111) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Modify Registry (T1112) is an Enterprise ATT&CK technique associated with Defense Impairment, Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An adversary captures screenshots or display content to collect information visible in applications, sessions, and user workflows.
Open profile →Email Collection (T1114) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Local Email Collection (T1114.001) is an Enterprise ATT&CK sub-technique under Email Collection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →Remote Email Collection (T1114.002) is an Enterprise ATT&CK sub-technique under Email Collection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →Email Forwarding Rule (T1114.003) is an Enterprise ATT&CK sub-technique under Email Collection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →An adversary reads clipboard contents to collect copied credentials, commands, documents, or other data exchanged through the user interface.
Open profile →Automated Collection (T1119) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Peripheral Device Discovery (T1120) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Audio Capture (T1123) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →System Time Discovery (T1124) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Video Capture (T1125) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Trusted Developer Utilities Proxy Execution (T1127) is an Enterprise ATT&CK technique associated with Stealth, Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →MSBuild (T1127.001) is an Enterprise ATT&CK sub-technique under Trusted Developer Utilities Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →ClickOnce (T1127.002) is an Enterprise ATT&CK sub-technique under Trusted Developer Utilities Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →JamPlus (T1127.003) is an Enterprise ATT&CK sub-technique under Trusted Developer Utilities Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →Shared Modules (T1129) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Data Encoding (T1132) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Standard Encoding (T1132.001) is an Enterprise ATT&CK sub-technique under Data Encoding. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Non-Standard Encoding (T1132.002) is an Enterprise ATT&CK sub-technique under Data Encoding. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →An adversary uses externally reachable VPN, remote desktop, SSH, virtual application, management, or other remote-access services to enter or return to an environment.
Open profile →An adversary duplicates, creates, replaces, or impersonates Windows access tokens to act in another security context.
Open profile →Token Impersonation/Theft (T1134.001) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →Create Process with Token (T1134.002) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →Make and Impersonate Token (T1134.003) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →Parent PID Spoofing (T1134.004) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →SID-History Injection (T1134.005) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.
Open profile →Network Share Discovery (T1135) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An adversary creates a local, domain, cloud, service, or application account that can be used for continued access.
Open profile →Local Account (T1136.001) is an Enterprise ATT&CK sub-technique under Create Account. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →Domain Account (T1136.002) is an Enterprise ATT&CK sub-technique under Create Account. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →Cloud Account (T1136.003) is an Enterprise ATT&CK sub-technique under Create Account. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →Office Application Startup (T1137) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Office Template Macros (T1137.001) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →Office Test (T1137.002) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →Outlook Forms (T1137.003) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →Outlook Home Page (T1137.004) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →Outlook Rules (T1137.005) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →Add-ins (T1137.006) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →Deobfuscate/Decode Files or Information (T1140) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Software Extensions (T1176) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Browser Extensions (T1176.001) is an Enterprise ATT&CK sub-technique under Software Extensions. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →IDE Extensions (T1176.002) is an Enterprise ATT&CK sub-technique under Software Extensions. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →Browser Session Hijacking (T1185) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Forced Authentication (T1187) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →A user is exposed to malicious web content that exploits a browser or convinces the user to retrieve and run harmful content, creating an entry path through normal browsing.
Open profile →File Upload Security is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Open profile →An adversary exploits a weakness in an internet-accessible application, service, appliance, management interface, or workload to gain access.
Open profile →Server-Side Request Forgery is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Open profile →Web application attack classes include injection, broken access control, authentication failures, insecure design, misconfiguration, component risk, request forgery, and unsafe handling of data and sessions.
Open profile →Supply Chain Compromise (T1195) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Supply Chain Compromise is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Open profile →Compromise Software Dependencies and Development Tools (T1195.001) is an Enterprise ATT&CK sub-technique under Supply Chain Compromise. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
Open profile →Compromise Software Supply Chain (T1195.002) is an Enterprise ATT&CK sub-technique under Supply Chain Compromise. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
Open profile →Compromise Hardware Supply Chain (T1195.003) is an Enterprise ATT&CK sub-technique under Supply Chain Compromise. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
Open profile →BITS Jobs (T1197) is an Enterprise ATT&CK technique associated with Stealth, Persistence, Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Active Directory organizes identities and resources into domains; related domains form trees, one or more trees form a forest, and trusts define which security principals may be recognized across boundaries.
Open profile →An adversary abuses a supplier, partner, managed service, federation, software, or other trusted relationship to reach the target environment.
Open profile →Third-party risk management identifies, evaluates, treats, monitors, and responds to cyber risk introduced by vendors, cloud services, software, partners, and other external dependencies.
Open profile →Hardware Additions (T1200) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Password Policy Discovery (T1201) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Indirect Command Execution (T1202) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Exploitation for Client Execution (T1203) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An adversary depends on a user to open, launch, approve, install, or otherwise trigger malicious content or code.
Open profile →Malicious Link (T1204.001) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Malicious File (T1204.002) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Malicious Image (T1204.003) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Malicious Copy and Paste (T1204.004) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Malicious Library (T1204.005) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Traffic Signaling (T1205) is an Enterprise ATT&CK technique associated with Stealth, Persistence, Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Port Knocking (T1205.001) is an Enterprise ATT&CK sub-technique under Traffic Signaling. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Command and Control context.
Open profile →Socket Filters (T1205.002) is an Enterprise ATT&CK sub-technique under Traffic Signaling. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Command and Control context.
Open profile →Rogue Domain Controller (T1207) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An adversary exploits a weakness in an internal remote service to gain access to another system without relying solely on valid credentials.
Open profile →Exploitation for Stealth (T1211) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Exploitation for Credential Access (T1212) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Data from Information Repositories (T1213) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Confluence (T1213.001) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →Sharepoint (T1213.002) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →Code Repositories (T1213.003) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →Customer Relationship Management Software (T1213.004) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →Messaging Applications (T1213.005) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →Databases (T1213.006) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →System Script Proxy Execution (T1216) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →PubPrn (T1216.001) is an Enterprise ATT&CK sub-technique under System Script Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →SyncAppvPublishingServer (T1216.002) is an Enterprise ATT&CK sub-technique under System Script Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Browser Information Discovery (T1217) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →System Binary Proxy Execution (T1218) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Compiled HTML File (T1218.001) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Control Panel (T1218.002) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →CMSTP (T1218.003) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →InstallUtil (T1218.004) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Mshta (T1218.005) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Msiexec (T1218.007) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Odbcconf (T1218.008) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Regsvcs/Regasm (T1218.009) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Regsvr32 (T1218.010) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Rundll32 (T1218.011) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Verclsid (T1218.012) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Mavinject (T1218.013) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →MMC (T1218.014) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Electron Applications (T1218.015) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Remote Access Tools (T1219) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →IDE Tunneling (T1219.001) is an Enterprise ATT&CK sub-technique under Remote Access Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Remote Desktop Software (T1219.002) is an Enterprise ATT&CK sub-technique under Remote Access Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Remote Access Hardware (T1219.003) is an Enterprise ATT&CK sub-technique under Remote Access Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →XSL Script Processing (T1220) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Template Injection (T1221) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →File and Directory Permissions Modification (T1222) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Windows Permissions (T1222.001) is an Enterprise ATT&CK sub-technique under File and Directory Permissions Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Linux and Mac Permissions (T1222.002) is an Enterprise ATT&CK sub-technique under File and Directory Permissions Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Execution Guardrails (T1480) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Environmental Keying (T1480.001) is an Enterprise ATT&CK sub-technique under Execution Guardrails. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Mutual Exclusion (T1480.002) is an Enterprise ATT&CK sub-technique under Execution Guardrails. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Domain Trust Discovery (T1482) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An adversary changes domain, federation, identity-provider, tenant, or cloud policy to weaken controls, grant access, or alter trusted behavior.
Open profile →Group Policy Modification (T1484.001) is an Enterprise ATT&CK sub-technique under Domain or Tenant Policy Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Privilege Escalation context.
Open profile →Trust Modification (T1484.002) is an Enterprise ATT&CK sub-technique under Domain or Tenant Policy Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Privilege Escalation context.
Open profile →Data Destruction (T1485) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Lifecycle-Triggered Deletion (T1485.001) is an Enterprise ATT&CK sub-technique under Data Destruction. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →An adversary encrypts files, databases, virtual machines, or other information to disrupt availability and pressure the victim.
Open profile →Ransomware operations disrupt access to systems or data and may combine encryption with theft, extortion, public pressure, and attacks on recovery systems.
Open profile →Service Stop (T1489) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Backup and recovery strategies preserve usable copies of data and system state so services can be restored after failure, error, corruption, or attack.
Open profile →An adversary deletes, disables, corrupts, or reconfigures backups, snapshots, recovery partitions, services, or boot options to make restoration harder.
Open profile →Recovery testing and restore assurance verify that protected data, systems, dependencies, procedures, and personnel can meet defined recovery needs.
Open profile →Incident recovery validation confirms that services are restored, attacker access is removed, controls are effective, data is trustworthy, and monitoring can detect recurrence.
Open profile →Defacement (T1491) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Internal Defacement (T1491.001) is an Enterprise ATT&CK sub-technique under Defacement. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →External Defacement (T1491.002) is an Enterprise ATT&CK sub-technique under Defacement. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →Firmware Corruption (T1495) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Resource Hijacking (T1496) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Compute Hijacking (T1496.001) is an Enterprise ATT&CK sub-technique under Resource Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →Bandwidth Hijacking (T1496.002) is an Enterprise ATT&CK sub-technique under Resource Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →SMS Pumping (T1496.003) is an Enterprise ATT&CK sub-technique under Resource Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →Cloud Service Hijacking (T1496.004) is an Enterprise ATT&CK sub-technique under Resource Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →Virtualization/Sandbox Evasion (T1497) is an Enterprise ATT&CK technique associated with Stealth, Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →System Checks (T1497.001) is an Enterprise ATT&CK sub-technique under Virtualization/Sandbox Evasion. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Discovery context.
Open profile →User Activity Based Checks (T1497.002) is an Enterprise ATT&CK sub-technique under Virtualization/Sandbox Evasion. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Discovery context.
Open profile →Time Based Checks (T1497.003) is an Enterprise ATT&CK sub-technique under Virtualization/Sandbox Evasion. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Discovery context.
Open profile →Network Denial of Service (T1498) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Direct Network Flood (T1498.001) is an Enterprise ATT&CK sub-technique under Network Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →Reflection Amplification (T1498.002) is an Enterprise ATT&CK sub-technique under Network Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →Endpoint Denial of Service (T1499) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →OS Exhaustion Flood (T1499.001) is an Enterprise ATT&CK sub-technique under Endpoint Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →Service Exhaustion Flood (T1499.002) is an Enterprise ATT&CK sub-technique under Endpoint Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →Application Exhaustion Flood (T1499.003) is an Enterprise ATT&CK sub-technique under Endpoint Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →Application or System Exploitation (T1499.004) is an Enterprise ATT&CK sub-technique under Endpoint Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →An adversary adds or modifies a component within server software—such as a web shell, plug-in, module, or management extension—to preserve access or execute code.
Open profile →SQL Stored Procedures (T1505.001) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →Transport Agent (T1505.002) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →Web Shell (T1505.003) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →IIS Components (T1505.004) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →Terminal Services DLL (T1505.005) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →vSphere Installation Bundles (T1505.006) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.
Open profile →Software Discovery (T1518) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Security Software Discovery (T1518.001) is an Enterprise ATT&CK sub-technique under Software Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Open profile →Backup Software Discovery (T1518.002) is an Enterprise ATT&CK sub-technique under Software Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Open profile →Implant Internal Image (T1525) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Cloud Service Discovery (T1526) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Steal Application Access Token (T1528) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →System Shutdown/Reboot (T1529) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Data from Cloud Storage (T1530) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Account Access Removal (T1531) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Internal Spearphishing (T1534) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Unused/Unsupported Cloud Regions (T1535) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Transfer Data to Cloud Account (T1537) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Cloud Service Dashboard (T1538) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Steal Web Session Cookie (T1539) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Pre-OS Boot (T1542) is an Enterprise ATT&CK technique associated with Stealth, Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →System Firmware (T1542.001) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.
Open profile →Component Firmware (T1542.002) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.
Open profile →Bootkit (T1542.003) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.
Open profile →ROMMONkit (T1542.004) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.
Open profile →TFTP Boot (T1542.005) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.
Open profile →Create or Modify System Process (T1543) is an Enterprise ATT&CK technique associated with Persistence, Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Launch Agent (T1543.001) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Systemd Service (T1543.002) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Windows Service (T1543.003) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Launch Daemon (T1543.004) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Container Service (T1543.005) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Event Triggered Execution (T1546) is an Enterprise ATT&CK technique associated with Privilege Escalation, Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Change Default File Association (T1546.001) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →Screensaver (T1546.002) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →Windows Management Instrumentation Event Subscription (T1546.003) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →Unix Shell Configuration Modification (T1546.004) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →Trap (T1546.005) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →LC_LOAD_DYLIB Addition (T1546.006) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →Netsh Helper DLL (T1546.007) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →Accessibility Features (T1546.008) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →AppCert DLLs (T1546.009) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →AppInit DLLs (T1546.010) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →Application Shimming (T1546.011) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →Image File Execution Options Injection (T1546.012) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →PowerShell Profile (T1546.013) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →Emond (T1546.014) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →Component Object Model Hijacking (T1546.015) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →Installer Packages (T1546.016) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →Udev Rules (T1546.017) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →Python Startup Hooks (T1546.018) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.
Open profile →An adversary changes startup or sign-in mechanisms so code runs automatically during system boot or user logon.
Open profile →Registry Run Keys / Startup Folder (T1547.001) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Authentication Package (T1547.002) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Time Providers (T1547.003) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Winlogon Helper DLL (T1547.004) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Security Support Provider (T1547.005) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Kernel Modules and Extensions (T1547.006) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Re-opened Applications (T1547.007) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →LSASS Driver (T1547.008) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Shortcut Modification (T1547.009) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Port Monitors (T1547.010) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Print Processors (T1547.012) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →XDG Autostart Entries (T1547.013) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Active Setup (T1547.014) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →Login Items (T1547.015) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.
Open profile →An adversary misuses an operating-system mechanism intended to govern privilege elevation so activity runs with higher permissions.
Open profile →Setuid and Setgid (T1548.001) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.
Open profile →Bypass User Account Control (T1548.002) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.
Open profile →Sudo and Sudo Caching (T1548.003) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.
Open profile →Elevated Execution with Prompt (T1548.004) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.
Open profile →Temporary Elevated Cloud Access (T1548.005) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.
Open profile →TCC Manipulation (T1548.006) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.
Open profile →Use Alternate Authentication Material (T1550) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Application Access Token (T1550.001) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Open profile →Pass the Hash (T1550.002) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Open profile →Pass-the-Hash is a credential replay technique in which an attacker uses a captured NTLM password hash to authenticate without learning or typing the original plaintext password.
Open profile →Pass the Ticket (T1550.003) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Open profile →Web Session Cookie (T1550.004) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Open profile →An adversary searches files, repositories, scripts, logs, environment variables, instance metadata, or configuration for exposed authentication material.
Open profile →Credentials In Files (T1552.001) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Credentials in Registry (T1552.002) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Shell History (T1552.003) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Private Keys (T1552.004) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Cloud Instance Metadata API (T1552.005) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Group Policy Preferences (T1552.006) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Container API (T1552.007) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Chat Messages (T1552.008) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Subvert Trust Controls (T1553) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Gatekeeper Bypass (T1553.001) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Code Signing (T1553.002) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →SIP and Trust Provider Hijacking (T1553.003) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Install Root Certificate (T1553.004) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Mark-of-the-Web Bypass (T1553.005) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Code Signing Policy Modification (T1553.006) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Compromise Host Software Binary (T1554) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An adversary extracts credentials, keys, cookies, or tokens from browsers, password managers, operating-system stores, or application repositories.
Open profile →Keychain (T1555.001) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Securityd Memory (T1555.002) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Credentials from Web Browsers (T1555.003) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Windows Credential Manager (T1555.004) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Password Managers (T1555.005) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Cloud Secrets Management Stores (T1555.006) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Modify Authentication Process (T1556) is an Enterprise ATT&CK technique associated with Defense Impairment, Persistence, Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Domain Controller Authentication (T1556.001) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Open profile →Password Filter DLL (T1556.002) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Open profile →Pluggable Authentication Modules (T1556.003) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Open profile →Network Device Authentication (T1556.004) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Open profile →Reversible Encryption (T1556.005) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Open profile →Multi-Factor Authentication (T1556.006) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Open profile →Hybrid Identity (T1556.007) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Open profile →Network Provider DLL (T1556.008) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Open profile →Conditional Access Policies (T1556.009) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.
Open profile →Adversary-in-the-Middle (T1557) is an Enterprise ATT&CK technique associated with Credential Access, Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →On-Path Attacks describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Open profile →Name Resolution Poisoning and SMB Relay (T1557.001) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
Open profile →ARP Cache Poisoning (T1557.002) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
Open profile →DHCP Spoofing (T1557.003) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
Open profile →Evil Twin (T1557.004) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.
Open profile →Kerberos in Active Directory is a ticket-based authentication system in which domain controllers acting as key distribution centers issue time-limited tickets that let users and services prove identity without repeatedly transmitting passwords.
Open profile →Steal or Forge Kerberos Tickets (T1558) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Golden Ticket (T1558.001) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Silver Ticket (T1558.002) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Kerberoasting is an attack technique in which an authenticated domain user requests Kerberos service tickets for service principal names and attempts to crack the ticket material offline to recover weak service-account passwords.
Open profile →Kerberoasting (T1558.003) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →AS-REP roasting targets Active Directory accounts that do not require Kerberos preauthentication, allowing an attacker to request an authentication response containing password-derived material and attempt offline password guessing.
Open profile →AS-REP Roasting (T1558.004) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Ccache Files (T1558.005) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Inter-Process Communication (T1559) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Component Object Model (T1559.001) is an Enterprise ATT&CK sub-technique under Inter-Process Communication. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Dynamic Data Exchange (T1559.002) is an Enterprise ATT&CK sub-technique under Inter-Process Communication. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →XPC Services (T1559.003) is an Enterprise ATT&CK sub-technique under Inter-Process Communication. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Archive Collected Data (T1560) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Archive via Utility (T1560.001) is an Enterprise ATT&CK sub-technique under Archive Collected Data. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →Archive via Library (T1560.002) is an Enterprise ATT&CK sub-technique under Archive Collected Data. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →Archive via Custom Method (T1560.003) is an Enterprise ATT&CK sub-technique under Archive Collected Data. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →Disk Wipe (T1561) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Disk Content Wipe (T1561.001) is an Enterprise ATT&CK sub-technique under Disk Wipe. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →Disk Structure Wipe (T1561.002) is an Enterprise ATT&CK sub-technique under Disk Wipe. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →Impair Defenses (T1562) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
Open profile →Disable or Modify Tools (T1562.001) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
Open profile →Disable or Modify System Firewall (T1562.004) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
Open profile →Remote Service Session Hijacking (T1563) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →SSH Hijacking (T1563.001) is an Enterprise ATT&CK sub-technique under Remote Service Session Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Open profile →RDP Hijacking (T1563.002) is an Enterprise ATT&CK sub-technique under Remote Service Session Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.
Open profile →An adversary conceals files, directories, processes, windows, accounts, services, or cloud resources from ordinary inspection.
Open profile →Hidden Files and Directories (T1564.001) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Hidden Users (T1564.002) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Hidden Window (T1564.003) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →NTFS File Attributes (T1564.004) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Hidden File System (T1564.005) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Run Virtual Instance (T1564.006) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →VBA Stomping (T1564.007) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Email Hiding Rules (T1564.008) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Resource Forking (T1564.009) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Process Argument Spoofing (T1564.010) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Ignore Process Interrupts (T1564.011) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →File/Path Exclusions (T1564.012) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Bind Mounts (T1564.013) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Extended Attributes (T1564.014) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Data Manipulation (T1565) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Stored Data Manipulation (T1565.001) is an Enterprise ATT&CK sub-technique under Data Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →Transmitted Data Manipulation (T1565.002) is an Enterprise ATT&CK sub-technique under Data Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →Runtime Data Manipulation (T1565.003) is an Enterprise ATT&CK sub-technique under Data Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.
Open profile →Phishing (T1566) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Phishing uses deceptive messages, sites, calls, or prompts to persuade a person to reveal information, approve access, send money, or run malicious content.
Open profile →Spearphishing Attachment (T1566.001) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
Open profile →Spearphishing Link (T1566.002) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
Open profile →Spearphishing via Service (T1566.003) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
Open profile →Spearphishing Voice (T1566.004) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
Open profile →An adversary uploads information through a web service, cloud-storage provider, code-sharing service, or other internet platform that may resemble normal use.
Open profile →Exfiltration to Code Repository (T1567.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Open profile →Cloud storage exfiltration detection looks for unusual reads, downloads, copies, sharing changes, presigned access, cross-account movement, and data-transfer patterns.
Open profile →Exfiltration to Cloud Storage (T1567.002) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Open profile →Exfiltration to Text Storage Sites (T1567.003) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Open profile →Exfiltration Over Webhook (T1567.004) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.
Open profile →Dynamic Resolution (T1568) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Fast Flux DNS (T1568.001) is an Enterprise ATT&CK sub-technique under Dynamic Resolution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Domain Generation Algorithms (T1568.002) is an Enterprise ATT&CK sub-technique under Dynamic Resolution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →DNS Calculation (T1568.003) is an Enterprise ATT&CK sub-technique under Dynamic Resolution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →System Services (T1569) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Launchctl (T1569.001) is an Enterprise ATT&CK sub-technique under System Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Service Execution (T1569.002) is an Enterprise ATT&CK sub-technique under System Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →Systemctl (T1569.003) is an Enterprise ATT&CK sub-technique under System Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.
Open profile →An adversary copies tools or files between systems inside the target environment to support continued movement and execution.
Open profile →Non-Standard Port (T1571) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Protocol Tunneling (T1572) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An adversary protects command traffic with encryption or an encrypted protocol to conceal content and complicate inspection.
Open profile →Symmetric Cryptography (T1573.001) is an Enterprise ATT&CK sub-technique under Encrypted Channel. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Asymmetric Cryptography (T1573.002) is an Enterprise ATT&CK sub-technique under Encrypted Channel. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.
Open profile →Hijack Execution Flow (T1574) is an Enterprise ATT&CK technique associated with Stealth, Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →DLL (T1574.001) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →Dylib Hijacking (T1574.004) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →Executable Installer File Permissions Weakness (T1574.005) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →Dynamic Linker Hijacking (T1574.006) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →Path Interception by PATH Environment Variable (T1574.007) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →Path Interception by Search Order Hijacking (T1574.008) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →Path Interception by Unquoted Path (T1574.009) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →Services File Permissions Weakness (T1574.010) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →Services Registry Permissions Weakness (T1574.011) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →COR_PROFILER (T1574.012) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →KernelCallbackTable (T1574.013) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →AppDomainManager (T1574.014) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.
Open profile →Modify Cloud Compute Infrastructure (T1578) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Create Snapshot (T1578.001) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Create Cloud Instance (T1578.002) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Delete Cloud Instance (T1578.003) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Revert Cloud Instance (T1578.004) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Modify Cloud Compute Configurations (T1578.005) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Cloud Infrastructure Discovery (T1580) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →An operator obtains domains, servers, cloud resources, virtual private servers, certificates, or other infrastructure used to stage or conduct malicious activity.
Open profile →Domains (T1583.001) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →DNS Server (T1583.002) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Virtual Private Server (T1583.003) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Server (T1583.004) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Botnet (T1583.005) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Web Services (T1583.006) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Serverless (T1583.007) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Malvertising (T1583.008) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Compromise Infrastructure (T1584) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Domains (T1584.001) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →DNS Server (T1584.002) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Virtual Private Server (T1584.003) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Server (T1584.004) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Botnet (T1584.005) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Web Services (T1584.006) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Serverless (T1584.007) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Network Devices (T1584.008) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Establish Accounts (T1585) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Social Media Accounts (T1585.001) is an Enterprise ATT&CK sub-technique under Establish Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Email Accounts (T1585.002) is an Enterprise ATT&CK sub-technique under Establish Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Cloud Accounts (T1585.003) is an Enterprise ATT&CK sub-technique under Establish Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Compromise Accounts (T1586) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Social Media Accounts (T1586.001) is an Enterprise ATT&CK sub-technique under Compromise Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Email Accounts (T1586.002) is an Enterprise ATT&CK sub-technique under Compromise Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Cloud Accounts (T1586.003) is an Enterprise ATT&CK sub-technique under Compromise Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →An operator creates malware, exploits, certificates, tools, or other capabilities tailored to the intended operation.
Open profile →Malware (T1587.001) is an Enterprise ATT&CK sub-technique under Develop Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Code Signing Certificates (T1587.002) is an Enterprise ATT&CK sub-technique under Develop Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Digital Certificates (T1587.003) is an Enterprise ATT&CK sub-technique under Develop Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Exploits (T1587.004) is an Enterprise ATT&CK sub-technique under Develop Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →An operator purchases, steals, downloads, or otherwise acquires exploits, malware, credentials, information, or tools rather than developing them independently.
Open profile →Malware (T1588.001) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Tool (T1588.002) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Code Signing Certificates (T1588.003) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Digital Certificates (T1588.004) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Exploits (T1588.005) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Vulnerabilities (T1588.006) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Artificial Intelligence (T1588.007) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →An operator collects names, usernames, email addresses, roles, relationships, or other identity details that can support targeting, credential attacks, and believable pretexts.
Open profile →Credentials (T1589.001) is an Enterprise ATT&CK sub-technique under Gather Victim Identity Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Email Addresses (T1589.002) is an Enterprise ATT&CK sub-technique under Gather Victim Identity Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Employee Names (T1589.003) is an Enterprise ATT&CK sub-technique under Gather Victim Identity Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Gather Victim Network Information (T1590) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Domain Properties (T1590.001) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →DNS (T1590.002) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Network Trust Dependencies (T1590.003) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Network Topology (T1590.004) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →IP Addresses (T1590.005) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Network Security Appliances (T1590.006) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Gather Victim Org Information (T1591) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Determine Physical Locations (T1591.001) is an Enterprise ATT&CK sub-technique under Gather Victim Org Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Business Relationships (T1591.002) is an Enterprise ATT&CK sub-technique under Gather Victim Org Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Identify Business Tempo (T1591.003) is an Enterprise ATT&CK sub-technique under Gather Victim Org Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Identify Roles (T1591.004) is an Enterprise ATT&CK sub-technique under Gather Victim Org Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Gather Victim Host Information (T1592) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Hardware (T1592.001) is an Enterprise ATT&CK sub-technique under Gather Victim Host Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Software (T1592.002) is an Enterprise ATT&CK sub-technique under Gather Victim Host Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Firmware (T1592.003) is an Enterprise ATT&CK sub-technique under Gather Victim Host Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Client Configurations (T1592.004) is an Enterprise ATT&CK sub-technique under Gather Victim Host Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →An operator searches public websites, social platforms, code repositories, technical forums, and organizational domains for information useful to an operation.
Open profile →Social Media (T1593.001) is an Enterprise ATT&CK sub-technique under Search Open Websites/Domains. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Search Engines (T1593.002) is an Enterprise ATT&CK sub-technique under Search Open Websites/Domains. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Code Repositories (T1593.003) is an Enterprise ATT&CK sub-technique under Search Open Websites/Domains. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Search Victim-Owned Websites (T1594) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Attack surface management identifies and tracks the systems, services, identities, data paths, and external dependencies that an attacker could reach or influence.
Open profile →An operator actively probes addresses, domains, services, applications, or network ranges to learn what is reachable and how it may be exposed.
Open profile →Scanning IP Blocks (T1595.001) is an Enterprise ATT&CK sub-technique under Active Scanning. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Vulnerability Scanning (T1595.002) is an Enterprise ATT&CK sub-technique under Active Scanning. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Vulnerability scanning uses automated checks to identify known weaknesses, missing updates, unsafe configurations, exposed services, and other conditions that may require review.
Open profile →Wordlist Scanning (T1595.003) is an Enterprise ATT&CK sub-technique under Active Scanning. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Search Open Technical Databases (T1596) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →DNS/Passive DNS (T1596.001) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →WHOIS (T1596.002) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Digital Certificates (T1596.003) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →CDNs (T1596.004) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Scan Databases (T1596.005) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Search Closed Sources (T1597) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Threat Intel Vendors (T1597.001) is an Enterprise ATT&CK sub-technique under Search Closed Sources. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Purchase Technical Data (T1597.002) is an Enterprise ATT&CK sub-technique under Search Closed Sources. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Phishing for Information (T1598) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Spearphishing Service (T1598.001) is an Enterprise ATT&CK sub-technique under Phishing for Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Spearphishing Attachment (T1598.002) is an Enterprise ATT&CK sub-technique under Phishing for Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Spearphishing Link (T1598.003) is an Enterprise ATT&CK sub-technique under Phishing for Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Spearphishing Voice (T1598.004) is an Enterprise ATT&CK sub-technique under Phishing for Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.
Open profile →Network Boundary Bridging (T1599) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Network Address Translation Traversal (T1599.001) is an Enterprise ATT&CK sub-technique under Network Boundary Bridging. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Weaken Encryption (T1600) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Reduce Key Space (T1600.001) is an Enterprise ATT&CK sub-technique under Weaken Encryption. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Disable Crypto Hardware (T1600.002) is an Enterprise ATT&CK sub-technique under Weaken Encryption. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Modify System Image (T1601) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Patch System Image (T1601.001) is an Enterprise ATT&CK sub-technique under Modify System Image. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Downgrade System Image (T1601.002) is an Enterprise ATT&CK sub-technique under Modify System Image. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Data from Configuration Repository (T1602) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →SNMP (MIB Dump) (T1602.001) is an Enterprise ATT&CK sub-technique under Data from Configuration Repository. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →Network Device Configuration Dump (T1602.002) is an Enterprise ATT&CK sub-technique under Data from Configuration Repository. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.
Open profile →Forge Web Credentials (T1606) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Web Cookies (T1606.001) is an Enterprise ATT&CK sub-technique under Forge Web Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →SAML Tokens (T1606.002) is an Enterprise ATT&CK sub-technique under Forge Web Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.
Open profile →Stage Capabilities (T1608) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Upload Malware (T1608.001) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Upload Tool (T1608.002) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Install Digital Certificate (T1608.003) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Drive-by Target (T1608.004) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Link Target (T1608.005) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →SEO Poisoning (T1608.006) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Container Administration Command (T1609) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Deploy Container (T1610) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Escape to Host (T1611) is an Enterprise ATT&CK technique associated with Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Build Image on Host (T1612) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Container and Resource Discovery (T1613) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →System Location Discovery (T1614) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →System Language Discovery (T1614.001) is an Enterprise ATT&CK sub-technique under System Location Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
Open profile →Group Policy Discovery (T1615) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Cloud Storage Object Discovery (T1619) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Reflective Code Loading (T1620) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Multi-Factor Authentication Request Generation (T1621) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Debugger Evasion (T1622) is an Enterprise ATT&CK technique associated with Stealth, Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Plist File Modification (T1647) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Serverless Execution (T1648) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Steal or Forge Authentication Certificates (T1649) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Acquire Access (T1650) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Cloud Administration Command (T1651) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Device Driver Discovery (T1652) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Power Settings (T1653) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Log Enumeration (T1654) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Financial Theft (T1657) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Content Injection (T1659) is an Enterprise ATT&CK technique associated with Initial Access, Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Hide Infrastructure (T1665) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Modify Cloud Resource Hierarchy (T1666) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Email Bombing (T1667) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Exclusive Control (T1668) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Wi-Fi Networks (T1669) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Cloud Application Integration (T1671) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Virtual Machine Discovery (T1673) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Input Injection (T1674) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →ESXi Administration Command (T1675) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Poisoned Pipeline Execution (T1677) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Delay Execution (T1678) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Selective Exclusion (T1679) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Local Storage Discovery (T1680) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Search Threat Vendor Data (T1681) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Query Public AI Services (T1682) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Generate Content (T1683) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Written Content (T1683.001) is an Enterprise ATT&CK sub-technique under Generate Content. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Audio-Visual Content (T1683.002) is an Enterprise ATT&CK sub-technique under Generate Content. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.
Open profile →Social Engineering (T1684) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Social engineering manipulates trust, urgency, authority, fear, helpfulness, or curiosity to influence a person into taking an unsafe action.
Open profile →Impersonation (T1684.001) is an Enterprise ATT&CK sub-technique under Social Engineering. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Email Spoofing (T1684.002) is an Enterprise ATT&CK sub-technique under Social Engineering. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.
Open profile →Disable or Modify Tools (T1685) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Disable or Modify Windows Event Log (T1685.001) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Disable or Modify Cloud Log (T1685.002) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Modify or Spoof Tool UI (T1685.003) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Disable or Modify Linux Audit System Log (T1685.004) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Clear Windows Event Logs (T1685.005) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Clear Linux or Mac System Logs (T1685.006) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Disable or Modify System Firewall (T1686) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Cloud Firewall (T1686.001) is an Enterprise ATT&CK sub-technique under Disable or Modify System Firewall. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Network Device Firewall (T1686.002) is an Enterprise ATT&CK sub-technique under Disable or Modify System Firewall. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Host firewall policy limits inbound, outbound, and forwarded traffic at the workload boundary using explicit service intent, stateful rules, controlled administration, and verified persistence.
Open profile →Windows Host Firewall (T1686.003) is an Enterprise ATT&CK sub-technique under Disable or Modify System Firewall. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.
Open profile →Stateful and Stateless Firewalls is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Open profile →Windows Defender Firewall is a stateful host firewall that applies profile-aware inbound and outbound rules to programs, services, ports, protocols, interfaces, users, and network conditions.
Open profile →Exploitation for Defense Impairment (T1687) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Safe Mode Boot (T1688) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Downgrade Attack (T1689) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Prevent Command History Logging (T1690) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
Open profile →Try a shorter term or clear the filters.
Bare Metal Cyber profiles add original educational and defensive context. Verify current object status, relationships, and underlying references on the official ATT&CK site before using a profile for operational or attribution decisions.
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
