Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.

Cyber Wiki Topic 05

Threats, Malware & Adversaries

Threat actors, attack patterns, malicious software, social engineering, and adversary behavior.

Topic Directory

833 entries

All wiki topics
ATT&CK sub-technique profile · Advanced

/etc/passwd and /etc/shadow (T1003.008)

/etc/passwd and /etc/shadow (T1003.008) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK Software Analysis · Intermediate

AADInternals (S0677)

A defensive guide to the Enterprise ATT&CK software record S0677, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a PowerShell framework used to administer, enumerate, and test Azure Active Directory environments.

ATT&CK Software Analysis · Intermediate

ACAD/Medre.A (S1000)

A defensive guide to the Enterprise ATT&CK software record S1000, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a worm that collects AutoCAD drawings and can expose operational or engineering information.

ATT&CK Group Analysis · Intermediate

ALLANITE (G1000)

A defensive guide to the Enterprise ATT&CK activity-cluster record G1000, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected Russian espionage cluster reported against electric utilities in the United States and United Kingdom.

ATT&CK Group Analysis · Intermediate

APT-C-23 (G1028)

A defensive guide to the Enterprise ATT&CK activity-cluster record G1028, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a cluster active since at least 2014 with a Middle East focus and reported development of Android and iOS spyware.

ATT&CK Group Analysis · Intermediate

APT39 (G0087)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0087, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing Iranian Ministry of Intelligence and Security-linked espionage activity reported across travel, hospitality, academia, and telecommunications.

ATT&CK Group Analysis · Intermediate

APT41 (G0096)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0096, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a China-sponsored espionage cluster also reported conducting financially motivated operations across many sectors.

ATT&CK Group Analysis · Intermediate

APT42 (G1044)

A defensive guide to the Enterprise ATT&CK activity-cluster record G1044, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing an Iranian-sponsored espionage and surveillance cluster reported to use spearphishing, mobile malware, native features, and open-source tools.

ATT&CK Group Analysis · Intermediate

APT5 (G1023)

A defensive guide to the Enterprise ATT&CK activity-cluster record G1023, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a China-based espionage actor reported against telecommunications, aerospace, and defense organizations, including networking devices.

ATT&CK sub-technique profile · Advanced

ARP Cache Poisoning (T1557.002)

ARP Cache Poisoning (T1557.002) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.

Credential attack technique · Advanced

AS-REP Roasting

AS-REP roasting targets Active Directory accounts that do not require Kerberos preauthentication, allowing an attacker to request an authentication response containing password-derived material and attempt offline password guessing.

ATT&CK sub-technique profile · Advanced

AS-REP Roasting (T1558.004)

AS-REP Roasting (T1558.004) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK Software Analysis · Intermediate

ASPXSpy (S0073)

A defensive guide to the Enterprise ATT&CK software record S0073, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a web shell that can provide remote administration of a compromised web server.

ATT&CK Software Analysis · Intermediate

AbstractEmu (S1061)

A defensive guide to the Enterprise ATT&CK software record S1061, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing Android malware reported in applications that abused known exploits to obtain root permissions.

ATT&CK technique profile · Intermediate

Abuse Elevation Control Mechanism (T1548)

An adversary misuses an operating-system mechanism intended to govern privilege elevation so activity runs with higher permissions.

ATT&CK technique profile · Intermediate

Access Token Manipulation (T1134)

An adversary duplicates, creates, replaces, or impersonates Windows access tokens to act in another security context.

ATT&CK sub-technique profile · Advanced

Accessibility Features (T1546.008)

Accessibility Features (T1546.008) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK technique profile · Intermediate

Account Access Removal (T1531)

Account Access Removal (T1531) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Account Discovery (T1087)

An adversary enumerates local, domain, cloud, service, or application accounts and groups to identify useful identities and privileges.

ATT&CK technique profile · Intermediate

Account Manipulation (T1098)

Account Manipulation (T1098) is an Enterprise ATT&CK technique associated with Persistence, Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK Software Analysis · Intermediate

AcidPour (S1167)

A defensive guide to the Enterprise ATT&CK software record S1167, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing an x86 Linux wiping payload designed to affect multiple embedded, networking, IoT, and industrial device types.

ATT&CK technique profile · Intermediate

Acquire Access (T1650)

Acquire Access (T1650) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Acquire Infrastructure (T1583)

An operator obtains domains, servers, cloud resources, virtual private servers, certificates, or other infrastructure used to stage or conduct malicious activity.

ATT&CK technique profile · Intermediate

Active Scanning (T1595)

An operator actively probes addresses, domains, services, applications, or network ranges to learn what is reachable and how it may be exposed.

ATT&CK sub-technique profile · Advanced

Active Setup (T1547.014)

Active Setup (T1547.014) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Add-ins (T1137.006)

Add-ins (T1137.006) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

Additional Cloud Credentials (T1098.001)

Additional Cloud Credentials (T1098.001) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Additional Cloud Roles (T1098.003)

Additional Cloud Roles (T1098.003) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Additional Container Cluster Roles (T1098.006)

Additional Container Cluster Roles (T1098.006) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Additional Email Delegate Permissions (T1098.002)

Additional Email Delegate Permissions (T1098.002) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Additional Local or Domain Groups (T1098.007)

Additional Local or Domain Groups (T1098.007) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

Threat and attack concept · Intermediate

Advanced Persistent Threats

Advanced Persistent Threats is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

ATT&CK technique profile · Intermediate

Adversary-in-the-Middle (T1557)

Adversary-in-the-Middle (T1557) is an Enterprise ATT&CK technique associated with Credential Access, Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK Software Analysis · Intermediate

Agent Tesla (S0331)

A defensive guide to the Enterprise ATT&CK software record S0331, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a .NET-based information-stealing and monitoring malware family.

ATT&CK Software Analysis · Intermediate

Agent.btz (S0092)

A defensive guide to the Enterprise ATT&CK software record S0092, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a worm known for spreading through removable media.

ATT&CK Group Analysis · Intermediate

Agrius (G1030)

A defensive guide to the Enterprise ATT&CK activity-cluster record G1030, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing an Iranian activity cluster reported in ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.

ATT&CK Software Analysis · Intermediate

AhRat (S1095)

A defensive guide to the Enterprise ATT&CK software record S1095, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing an Android remote-access trojan derived from the AhMyth codebase.

ATT&CK Group Analysis · Intermediate

Ajax Security Team (G0130)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0130, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing an Iran-linked cluster active since at least 2010 that shifted from website defacement toward malware-based espionage.

ATT&CK Software Analysis · Intermediate

Akira (S1129)

A defensive guide to the Enterprise ATT&CK software record S1129, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing ransomware associated with Akira operations and reported in Windows and ESXi variants.

ATT&CK Software Analysis · Intermediate

Amadey (S1025)

A defensive guide to the Enterprise ATT&CK software record S1025, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a Trojan bot used to establish access and retrieve additional payloads.

Analytic communication practice · Advanced

Analytic Confidence and Uncertainty

Analytic confidence communicates how strongly evidence, source quality, consistency, and remaining gaps support an intelligence judgment.

ATT&CK Software Analysis · Intermediate

Anchor (S0504)

A defensive guide to the Enterprise ATT&CK software record S0504, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a backdoor family reported in operations that also used TrickBot.

ATT&CK Group Analysis · Intermediate

Andariel (G0138)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0138, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a North Korean state-sponsored cluster associated with destructive and financially motivated activity, with acknowledged overlap in public naming.

ATT&CK Software Analysis · Intermediate

Anubis (S0422)

A defensive guide to the Enterprise ATT&CK software record S0422, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing Android malware that evolved into a banking-trojan capability.

ATT&CK Group Analysis · Intermediate

Aoqin Dragon (G1007)

A defensive guide to the Enterprise ATT&CK activity-cluster record G1007, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected China-based espionage cluster reported against government, education, and telecommunications organizations in Southeast Asia and nearby regions.

ATT&CK Software Analysis · Intermediate

Apostle (S1133)

A defensive guide to the Enterprise ATT&CK software record S1133, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing malware reported with destructive wiper and ransomware behavior.

ATT&CK sub-technique profile · Advanced

AppCert DLLs (T1546.009)

AppCert DLLs (T1546.009) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK sub-technique profile · Advanced

AppDomainManager (T1574.014)

AppDomainManager (T1574.014) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

AppInit DLLs (T1546.010)

AppInit DLLs (T1546.010) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK Group Analysis · Intermediate

AppleJeus (G1049)

A defensive guide to the Enterprise ATT&CK activity-cluster record G1049, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a DPRK-linked revenue-generating cluster reported against the cryptocurrency sector and associated with the 3CX supply-chain campaign.

ATT&CK Software Analysis · Intermediate

AppleJeus (S0584)

A defensive guide to the Enterprise ATT&CK software record S0584, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a family of downloaders delivered through trojanized cryptocurrency applications.

ATT&CK sub-technique profile · Advanced

AppleScript (T1059.002)

AppleScript (T1059.002) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Application Access Token (T1550.001)

Application Access Token (T1550.001) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.

ATT&CK sub-technique profile · Advanced

Application Exhaustion Flood (T1499.003)

Application Exhaustion Flood (T1499.003) is an Enterprise ATT&CK sub-technique under Endpoint Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK technique profile · Intermediate

Application Layer Protocol (T1071)

An adversary uses common application protocols such as web, DNS, mail, or file transfer to carry command-and-control traffic.

ATT&CK sub-technique profile · Advanced

Application Shimming (T1546.011)

Application Shimming (T1546.011) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK technique profile · Intermediate

Application Window Discovery (T1010)

Application Window Discovery (T1010) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Application or System Exploitation (T1499.004)

Application or System Exploitation (T1499.004) is an Enterprise ATT&CK sub-technique under Endpoint Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK Group Analysis · Intermediate

Aquatic Panda (G0143)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0143, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected China-based cluster with intelligence-collection and industrial-espionage missions against telecommunications, technology, and government entities.

ATT&CK technique profile · Intermediate

Archive Collected Data (T1560)

Archive Collected Data (T1560) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Archive via Custom Method (T1560.003)

Archive via Custom Method (T1560.003) is an Enterprise ATT&CK sub-technique under Archive Collected Data. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK sub-technique profile · Advanced

Archive via Library (T1560.002)

Archive via Library (T1560.002) is an Enterprise ATT&CK sub-technique under Archive Collected Data. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK sub-technique profile · Advanced

Archive via Utility (T1560.001)

Archive via Utility (T1560.001) is an Enterprise ATT&CK sub-technique under Archive Collected Data. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK Software Analysis · Intermediate

Arp (S0099)

A defensive guide to the Enterprise ATT&CK software record S0099, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing an operating-system utility used to display or modify the Address Resolution Protocol cache.

ATT&CK sub-technique profile · Advanced

Artificial Intelligence (T1588.007)

Artificial Intelligence (T1588.007) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK Software Analysis · Intermediate

AshTag (S9031)

A defensive guide to the Enterprise ATT&CK software record S9031, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a modular .NET backdoor tracked in public threat reporting.

ATT&CK Software Analysis · Intermediate

Astaroth (S0373)

A defensive guide to the Enterprise ATT&CK software record S0373, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a Trojan and information-stealing malware family.

ATT&CK sub-technique profile · Advanced

Asymmetric Cryptography (T1573.002)

Asymmetric Cryptography (T1573.002) is an Enterprise ATT&CK sub-technique under Encrypted Channel. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK Software Analysis · Intermediate

AsyncRAT (S1087)

A defensive guide to the Enterprise ATT&CK software record S1087, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing an open-source remote administration tool that has also been used in malicious campaigns.

ATT&CK sub-technique profile · Advanced

Asynchronous Procedure Call (T1055.004)

Asynchronous Procedure Call (T1055.004) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

At (T1053.002)

At (T1053.002) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.

ATT&CK technique profile · Intermediate

Audio Capture (T1123)

Audio Capture (T1123) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Audio-Visual Content (T1683.002)

Audio-Visual Content (T1683.002) is an Enterprise ATT&CK sub-technique under Generate Content. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Authentication Package (T1547.002)

Authentication Package (T1547.002) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

AutoHotKey & AutoIT (T1059.010)

AutoHotKey & AutoIT (T1059.010) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK technique profile · Intermediate

Automated Collection (T1119)

Automated Collection (T1119) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Automated Exfiltration (T1020)

Automated Exfiltration (T1020) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK Software Analysis · Intermediate

AvosLocker (S1053)

A defensive guide to the Enterprise ATT&CK software record S1053, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing ransomware offered through a ransomware-as-a-service model.

ATT&CK Group Analysis · Intermediate

Axiom (G0001)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0001, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected Chinese espionage cluster reported against aerospace, defense, government, manufacturing, and media sectors.

ATT&CK Software Analysis · Intermediate

Azorult (S0344)

A defensive guide to the Enterprise ATT&CK software record S0344, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a commercial information-stealing Trojan.

ATT&CK technique profile · Intermediate

BITS Jobs (T1197)

BITS Jobs (T1197) is an Enterprise ATT&CK technique associated with Stealth, Persistence, Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK Software Analysis · Intermediate

BITSAdmin (S0190)

A defensive guide to the Enterprise ATT&CK software record S0190, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a legitimate Windows command-line utility for managing Background Intelligent Transfer Service jobs.

ATT&CK Group Analysis · Intermediate

BITTER (G1002)

A defensive guide to the Enterprise ATT&CK activity-cluster record G1002, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected South Asian espionage cluster reported against government, energy, and engineering organizations.

ATT&CK Software Analysis · Intermediate

Backdoor.Oldrea (S0093)

A defensive guide to the Enterprise ATT&CK software record S0093, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a modular backdoor reported in operations against energy and industrial-control environments.

ATT&CK Group Analysis · Intermediate

BackdoorDiplomacy (G0135)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0135, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing an espionage cluster active since at least 2017 and reported against foreign ministries and telecommunications companies.

ATT&CK sub-technique profile · Advanced

Backup Software Discovery (T1518.002)

Backup Software Discovery (T1518.002) is an Enterprise ATT&CK sub-technique under Software Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.

ATT&CK Software Analysis · Intermediate

Bad Rabbit (S0606)

A defensive guide to the Enterprise ATT&CK software record S0606, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing self-propagating ransomware used in disruptive incidents.

ATT&CK sub-technique profile · Advanced

Bandwidth Hijacking (T1496.002)

Bandwidth Hijacking (T1496.002) is an Enterprise ATT&CK sub-technique under Resource Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK Software Analysis · Intermediate

BeaverTail (S1246)

A defensive guide to the Enterprise ATT&CK software record S1246, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing JavaScript and C++ malware reported in credential theft and downloader activity.

ATT&CK sub-technique profile · Advanced

Bidirectional Communication (T1102.002)

Bidirectional Communication (T1102.002) is an Enterprise ATT&CK sub-technique under Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

Binary Padding (T1027.001)

Binary Padding (T1027.001) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Bind Mounts (T1564.013)

Bind Mounts (T1564.013) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK Software Analysis · Intermediate

Black Basta (S1070)

A defensive guide to the Enterprise ATT&CK software record S1070, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing ransomware associated with ransomware-as-a-service operations and Windows or ESXi targets.

ATT&CK Group Analysis · Intermediate

BlackByte (G1043)

A defensive guide to the Enterprise ATT&CK activity-cluster record G1043, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a ransomware activity cluster operating since at least 2021 and associated with multiple BlackByte ransomware versions.

ATT&CK Software Analysis · Intermediate

BloodHound (S0521)

A defensive guide to the Enterprise ATT&CK software record S0521, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a tool that maps Active Directory relationships and attack paths for administration, assessment, or adversary use.

ATT&CK technique profile · Intermediate

Boot or Logon Autostart Execution (T1547)

An adversary changes startup or sign-in mechanisms so code runs automatically during system boot or user logon.

ATT&CK technique profile · Intermediate

Boot or Logon Initialization Scripts (T1037)

Boot or Logon Initialization Scripts (T1037) is an Enterprise ATT&CK technique associated with Persistence, Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Bootkit (T1542.003)

Bootkit (T1542.003) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.

Threat and attack concept · Intermediate

Bootkits

Bootkits describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

ATT&CK sub-technique profile · Advanced

Botnet (T1583.005)

Botnet (T1583.005) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Botnet (T1584.005)

Botnet (T1584.005) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Break Process Trees (T1036.009)

Break Process Trees (T1036.009) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Browser Extensions (T1176.001)

Browser Extensions (T1176.001) is an Enterprise ATT&CK sub-technique under Software Extensions. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

Browser Fingerprint (T1036.012)

Browser Fingerprint (T1036.012) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Browser Information Discovery (T1217)

Browser Information Discovery (T1217) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Browser Session Hijacking (T1185)

Browser Session Hijacking (T1185) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Brute Force (T1110)

An adversary repeatedly attempts passwords, keys, or authentication combinations, including guessing, spraying, cracking, and credential stuffing.

ATT&CK Software Analysis · Intermediate

Brute Ratel C4 (S1063)

A defensive guide to the Enterprise ATT&CK software record S1063, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a commercial adversary-simulation platform that has also been abused in real intrusions.

ATT&CK technique profile · Intermediate

Build Image on Host (T1612)

Build Image on Host (T1612) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Business Relationships (T1591.002)

Business Relationships (T1591.002) is an Enterprise ATT&CK sub-technique under Gather Victim Org Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Bypass User Account Control (T1548.002)

Bypass User Account Control (T1548.002) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

CDNs (T1596.004)

CDNs (T1596.004) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

CMSTP (T1218.003)

CMSTP (T1218.003) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

COR_PROFILER (T1574.012)

COR_PROFILER (T1574.012) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Cached Domain Credentials (T1003.005)

Cached Domain Credentials (T1003.005) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK Software Analysis · Intermediate

CaddyWiper (S0693)

A defensive guide to the Enterprise ATT&CK software record S0693, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a destructive data-wiping payload reported in attacks against Ukrainian organizations.

ATT&CK sub-technique profile · Advanced

Ccache Files (T1558.005)

Ccache Files (T1558.005) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

Infrastructure analysis technique · Advanced

Certificate Transparency Analysis

Certificate transparency analysis examines publicly logged certificate issuance to discover domains, subdomains, infrastructure relationships, and changes over time.

ATT&CK sub-technique profile · Advanced

Change Default File Association (T1546.001)

Change Default File Association (T1546.001) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK sub-technique profile · Advanced

Chat Messages (T1552.008)

Chat Messages (T1552.008) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Clear Command History (T1070.003)

Clear Command History (T1070.003) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Clear Linux or Mac System Logs (T1685.006)

Clear Linux or Mac System Logs (T1685.006) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

Clear Mailbox Data (T1070.008)

Clear Mailbox Data (T1070.008) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Clear Network Connection History and Configurations (T1070.007)

Clear Network Connection History and Configurations (T1070.007) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Clear Persistence (T1070.009)

Clear Persistence (T1070.009) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Clear Windows Event Logs (T1685.005)

Clear Windows Event Logs (T1685.005) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

ClickOnce (T1127.002)

ClickOnce (T1127.002) is an Enterprise ATT&CK sub-technique under Trusted Developer Utilities Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Client Configurations (T1592.004)

Client Configurations (T1592.004) is an Enterprise ATT&CK sub-technique under Gather Victim Host Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK technique profile · Intermediate

Clipboard Data (T1115)

An adversary reads clipboard contents to collect copied credentials, commands, documents, or other data exchanged through the user interface.

ATT&CK sub-technique profile · Advanced

Cloud API (T1059.009)

Cloud API (T1059.009) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Cloud Account (T1087.004)

Cloud Account (T1087.004) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.

ATT&CK sub-technique profile · Advanced

Cloud Account (T1136.003)

Cloud Account (T1136.003) is an Enterprise ATT&CK sub-technique under Create Account. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

Cloud Accounts (T1078.004)

Cloud Accounts (T1078.004) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.

ATT&CK sub-technique profile · Advanced

Cloud Accounts (T1585.003)

Cloud Accounts (T1585.003) is an Enterprise ATT&CK sub-technique under Establish Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Cloud Accounts (T1586.003)

Cloud Accounts (T1586.003) is an Enterprise ATT&CK sub-technique under Compromise Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK technique profile · Intermediate

Cloud Administration Command (T1651)

Cloud Administration Command (T1651) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Cloud Application Integration (T1671)

Cloud Application Integration (T1671) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Cloud Firewall (T1686.001)

Cloud Firewall (T1686.001) is an Enterprise ATT&CK sub-technique under Disable or Modify System Firewall. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

Cloud Groups (T1069.003)

Cloud Groups (T1069.003) is an Enterprise ATT&CK sub-technique under Permission Groups Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.

ATT&CK technique profile · Intermediate

Cloud Infrastructure Discovery (T1580)

Cloud Infrastructure Discovery (T1580) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Cloud Instance Metadata API (T1552.005)

Cloud Instance Metadata API (T1552.005) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Cloud Secrets Management Stores (T1555.006)

Cloud Secrets Management Stores (T1555.006) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK technique profile · Intermediate

Cloud Service Dashboard (T1538)

Cloud Service Dashboard (T1538) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Cloud Service Discovery (T1526)

Cloud Service Discovery (T1526) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Cloud Service Hijacking (T1496.004)

Cloud Service Hijacking (T1496.004) is an Enterprise ATT&CK sub-technique under Resource Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK sub-technique profile · Advanced

Cloud Services (T1021.007)

Cloud Services (T1021.007) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.

ATT&CK technique profile · Intermediate

Cloud Storage Object Discovery (T1619)

Cloud Storage Object Discovery (T1619) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Code Repositories (T1213.003)

Code Repositories (T1213.003) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK sub-technique profile · Advanced

Code Repositories (T1593.003)

Code Repositories (T1593.003) is an Enterprise ATT&CK sub-technique under Search Open Websites/Domains. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Code Signing (T1553.002)

Code Signing (T1553.002) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

Code Signing Certificates (T1587.002)

Code Signing Certificates (T1587.002) is an Enterprise ATT&CK sub-technique under Develop Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Code Signing Certificates (T1588.003)

Code Signing Certificates (T1588.003) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Code Signing Policy Modification (T1553.006)

Code Signing Policy Modification (T1553.006) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

Analytic risk · Advanced

Cognitive Bias in Intelligence Analysis

Cognitive bias can distort how analysts search for, interpret, remember, and communicate evidence about adversaries and campaigns.

ATT&CK tactic learning hub · Intermediate

Collection — MITRE ATT&CK® Tactic TA0009

Adversaries gather, stage, capture, or aggregate information of interest before using or removing it.

ATT&CK sub-technique profile · Advanced

Command Obfuscation (T1027.010)

Command Obfuscation (T1027.010) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

Threat and attack concept · Intermediate

Command and Control Channels

Command and Control Channels is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

ATT&CK tactic learning hub · Intermediate

Command and Control — MITRE ATT&CK® Tactic TA0011

Adversaries communicate with compromised resources to issue instructions, receive results, transfer tools, or maintain operational control.

ATT&CK technique profile · Intermediate

Command and Scripting Interpreter (T1059)

An adversary uses a shell, command interpreter, scripting language, or administrative console to execute instructions and automate activity.

ATT&CK technique profile · Intermediate

Communication Through Removable Media (T1092)

Communication Through Removable Media (T1092) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Compile After Delivery (T1027.004)

Compile After Delivery (T1027.004) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Compiled HTML File (T1218.001)

Compiled HTML File (T1218.001) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Component Firmware (T1542.002)

Component Firmware (T1542.002) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.

ATT&CK sub-technique profile · Advanced

Component Object Model (T1559.001)

Component Object Model (T1559.001) is an Enterprise ATT&CK sub-technique under Inter-Process Communication. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Component Object Model Hijacking (T1546.015)

Component Object Model Hijacking (T1546.015) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK sub-technique profile · Advanced

Compression (T1027.015)

Compression (T1027.015) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Compromise Accounts (T1586)

Compromise Accounts (T1586) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Compromise Hardware Supply Chain (T1195.003)

Compromise Hardware Supply Chain (T1195.003) is an Enterprise ATT&CK sub-technique under Supply Chain Compromise. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.

ATT&CK technique profile · Intermediate

Compromise Host Software Binary (T1554)

Compromise Host Software Binary (T1554) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Compromise Infrastructure (T1584)

Compromise Infrastructure (T1584) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Compromise Software Dependencies and Development Tools (T1195.001)

Compromise Software Dependencies and Development Tools (T1195.001) is an Enterprise ATT&CK sub-technique under Supply Chain Compromise. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.

ATT&CK sub-technique profile · Advanced

Compromise Software Supply Chain (T1195.002)

Compromise Software Supply Chain (T1195.002) is an Enterprise ATT&CK sub-technique under Supply Chain Compromise. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.

ATT&CK sub-technique profile · Advanced

Compute Hijacking (T1496.001)

Compute Hijacking (T1496.001) is an Enterprise ATT&CK sub-technique under Resource Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK sub-technique profile · Advanced

Conditional Access Policies (T1556.009)

Conditional Access Policies (T1556.009) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.

ATT&CK sub-technique profile · Advanced

Confluence (T1213.001)

Confluence (T1213.001) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK sub-technique profile · Advanced

Container API (T1552.007)

Container API (T1552.007) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK technique profile · Intermediate

Container Administration Command (T1609)

Container Administration Command (T1609) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Container CLI/API (T1059.013)

Container CLI/API (T1059.013) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Container Orchestration Job (T1053.007)

Container Orchestration Job (T1053.007) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Container Service (T1543.005)

Container Service (T1543.005) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK technique profile · Intermediate

Container and Resource Discovery (T1613)

Container and Resource Discovery (T1613) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Content Injection (T1659)

Content Injection (T1659) is an Enterprise ATT&CK technique associated with Initial Access, Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Control Panel (T1218.002)

Control Panel (T1218.002) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Create Account (T1136)

An adversary creates a local, domain, cloud, service, or application account that can be used for continued access.

ATT&CK sub-technique profile · Advanced

Create Cloud Instance (T1578.002)

Create Cloud Instance (T1578.002) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

Create Process with Token (T1134.002)

Create Process with Token (T1134.002) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Create Snapshot (T1578.001)

Create Snapshot (T1578.001) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK technique profile · Intermediate

Create or Modify System Process (T1543)

Create or Modify System Process (T1543) is an Enterprise ATT&CK technique associated with Persistence, Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Credential API Hooking (T1056.004)

Credential API Hooking (T1056.004) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.

Adversary behavior · Intermediate

Credential Access

Credential access includes techniques used to obtain passwords, hashes, tokens, keys, tickets, cookies, or other material that can authenticate an identity.

ATT&CK tactic learning hub · Intermediate

Credential Access — MITRE ATT&CK® Tactic TA0006

Adversaries obtain passwords, hashes, tokens, tickets, keys, cookies, or other secrets that can be used to authenticate or impersonate an identity.

Threat and attack concept · Intermediate

Credential Stuffing

Credential Stuffing is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

ATT&CK sub-technique profile · Advanced

Credential Stuffing (T1110.004)

Credential Stuffing (T1110.004) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Credentials (T1589.001)

Credentials (T1589.001) is an Enterprise ATT&CK sub-technique under Gather Victim Identity Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Credentials In Files (T1552.001)

Credentials In Files (T1552.001) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK technique profile · Intermediate

Credentials from Password Stores (T1555)

An adversary extracts credentials, keys, cookies, or tokens from browsers, password managers, operating-system stores, or application repositories.

ATT&CK sub-technique profile · Advanced

Credentials from Web Browsers (T1555.003)

Credentials from Web Browsers (T1555.003) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Credentials in Registry (T1552.002)

Credentials in Registry (T1552.002) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Cron (T1053.003)

Cron (T1053.003) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Customer Relationship Management Software (T1213.004)

Customer Relationship Management Software (T1213.004) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

Adversary analysis practice · Advanced

Cyber Campaign Analysis

Campaign analysis groups related activity across time, targets, infrastructure, malware, techniques, and objectives to understand an adversary operation as a coherent whole.

Attack-modeling technique · Intermediate

Cyber Kill Chain Analysis

Cyber Kill Chain analysis organizes adversary activity into stages so defenders can identify opportunities to disrupt an operation before its objective is achieved.

Analytic judgment · Advanced

Cyber Threat Attribution

Cyber threat attribution assesses who is responsible for activity at a stated level of confidence using technical, behavioral, contextual, and sometimes nontechnical evidence.

Collaboration practice · Intermediate

Cyber Threat Information Sharing

Cyber threat information sharing exchanges relevant observations, indicators, techniques, judgments, and defensive guidance under agreed trust and handling rules.

Analytical practice · Intermediate

Cyber Threat Intelligence

Cyber threat intelligence is analyzed information about adversaries, capabilities, infrastructure, intent, and activity that supports a specific decision.

ATT&CK Group Analysis · Intermediate

CyberAv3ngers (G1027)

A defensive guide to the Enterprise ATT&CK activity-cluster record G1027, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected Iranian IRGC-affiliated cluster reported in PLC and HMI targeting and device-interface defacement.

Active Directory credential-access technique · Advanced

DCSync

DCSync is an abuse of Active Directory replication rights in which an attacker makes a system act like a domain controller and requests password-derived credential data through normal directory replication protocols.

ATT&CK sub-technique profile · Advanced

DCSync (T1003.006)

DCSync (T1003.006) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

DHCP Spoofing (T1557.003)

DHCP Spoofing (T1557.003) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.

ATT&CK sub-technique profile · Advanced

DLL (T1574.001)

DLL (T1574.001) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

DNS (T1071.004)

DNS (T1071.004) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

DNS (T1590.002)

DNS (T1590.002) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

DNS Calculation (T1568.003)

DNS Calculation (T1568.003) is an Enterprise ATT&CK sub-technique under Dynamic Resolution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

DNS Server (T1583.002)

DNS Server (T1583.002) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

DNS Server (T1584.002)

DNS Server (T1584.002) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

DNS/Passive DNS (T1596.001)

DNS/Passive DNS (T1596.001) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK Group Analysis · Intermediate

Daggerfly (G1034)

A defensive guide to the Enterprise ATT&CK activity-cluster record G1034, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a PRC-linked advanced persistent threat cluster reported against individuals, governments, NGOs, and telecommunications companies.

ATT&CK Group Analysis · Intermediate

Dark Caracal (G0070)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0070, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing an activity cluster attributed in public reporting to the Lebanese General Directorate of General Security and active since at least 2012.

ATT&CK Group Analysis · Intermediate

DarkHydrus (G0079)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0079, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a cluster reported against government agencies and educational institutions in the Middle East using open-source tools and custom payloads.

ATT&CK Group Analysis · Intermediate

DarkVishnya (G0105)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0105, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a financially motivated cluster reported against financial institutions in Eastern Europe.

ATT&CK Group Analysis · Intermediate

Darkhotel (G0012)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0012, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected South Korean cluster reported in East Asian espionage operations involving hotel networks, spearphishing, and file-sharing networks.

ATT&CK technique profile · Intermediate

Data Destruction (T1485)

Data Destruction (T1485) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Data Encoding (T1132)

Data Encoding (T1132) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Data Encrypted for Impact (T1486)

An adversary encrypts files, databases, virtual machines, or other information to disrupt availability and pressure the victim.

ATT&CK technique profile · Intermediate

Data Manipulation (T1565)

Data Manipulation (T1565) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Data Obfuscation (T1001)

Data Obfuscation (T1001) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Data Staged (T1074)

Data Staged (T1074) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

Threat and attack concept · Intermediate

Data Staging and Exfiltration

Data Staging and Exfiltration describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

ATT&CK technique profile · Intermediate

Data Transfer Size Limits (T1030)

Data Transfer Size Limits (T1030) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Data from Cloud Storage (T1530)

Data from Cloud Storage (T1530) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Data from Configuration Repository (T1602)

Data from Configuration Repository (T1602) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Data from Information Repositories (T1213)

Data from Information Repositories (T1213) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Data from Local System (T1005)

An adversary searches for and reads files, databases, application data, or other information stored on a compromised local system.

ATT&CK technique profile · Intermediate

Data from Network Shared Drive (T1039)

Data from Network Shared Drive (T1039) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Data from Removable Media (T1025)

Data from Removable Media (T1025) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Databases (T1213.006)

Databases (T1213.006) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK sub-technique profile · Advanced

Dead Drop Resolver (T1102.001)

Dead Drop Resolver (T1102.001) is an Enterprise ATT&CK sub-technique under Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK technique profile · Intermediate

Debugger Evasion (T1622)

Debugger Evasion (T1622) is an Enterprise ATT&CK technique associated with Stealth, Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK Group Analysis · Intermediate

Deep Panda (G0009)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0009, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected Chinese cluster reported against government, defense, financial, healthcare, and telecommunications targets, with overlap ambiguity in public reporting.

ATT&CK technique profile · Intermediate

Defacement (T1491)

Defacement (T1491) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Default Accounts (T1078.001)

Default Accounts (T1078.001) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.

ATT&CK tactic learning hub · Intermediate

Defense Impairment — MITRE ATT&CK® Tactic TA0112

Adversaries weaken, disable, reconfigure, or bypass security controls so later activity is less likely to be blocked or observed.

ATT&CK technique profile · Intermediate

Delay Execution (T1678)

Delay Execution (T1678) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Delete Cloud Instance (T1578.003)

Delete Cloud Instance (T1578.003) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK technique profile · Intermediate

Deobfuscate/Decode Files or Information (T1140)

Deobfuscate/Decode Files or Information (T1140) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Deploy Container (T1610)

Deploy Container (T1610) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Determine Physical Locations (T1591.001)

Determine Physical Locations (T1591.001) is an Enterprise ATT&CK sub-technique under Gather Victim Org Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK technique profile · Intermediate

Develop Capabilities (T1587)

An operator creates malware, exploits, certificates, tools, or other capabilities tailored to the intended operation.

ATT&CK technique profile · Intermediate

Device Driver Discovery (T1652)

Device Driver Discovery (T1652) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Device Registration (T1098.005)

Device Registration (T1098.005) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

Intrusion-analysis model · Advanced

Diamond Model of Intrusion Analysis

The Diamond Model examines relationships among adversary, capability, infrastructure, and victim while adding context such as time, direction, and confidence.

ATT&CK sub-technique profile · Advanced

Digital Certificates (T1587.003)

Digital Certificates (T1587.003) is an Enterprise ATT&CK sub-technique under Develop Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Digital Certificates (T1588.004)

Digital Certificates (T1588.004) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Digital Certificates (T1596.003)

Digital Certificates (T1596.003) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Direct Cloud VM Connections (T1021.008)

Direct Cloud VM Connections (T1021.008) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.

ATT&CK sub-technique profile · Advanced

Direct Network Flood (T1498.001)

Direct Network Flood (T1498.001) is an Enterprise ATT&CK sub-technique under Network Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK technique profile · Intermediate

Direct Volume Access (T1006)

Direct Volume Access (T1006) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Disable Crypto Hardware (T1600.002)

Disable Crypto Hardware (T1600.002) is an Enterprise ATT&CK sub-technique under Weaken Encryption. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

Disable or Modify Cloud Log (T1685.002)

Disable or Modify Cloud Log (T1685.002) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

Disable or Modify Linux Audit System Log (T1685.004)

Disable or Modify Linux Audit System Log (T1685.004) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK legacy profile · Intermediate

Disable or Modify System Firewall (Legacy T1562.004)

Disable or Modify System Firewall (T1562.004) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.

ATT&CK technique profile · Intermediate

Disable or Modify System Firewall (T1686)

Disable or Modify System Firewall (T1686) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK legacy profile · Intermediate

Disable or Modify Tools (Legacy T1562.001)

Disable or Modify Tools (T1562.001) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.

ATT&CK technique profile · Intermediate

Disable or Modify Tools (T1685)

Disable or Modify Tools (T1685) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Disable or Modify Windows Event Log (T1685.001)

Disable or Modify Windows Event Log (T1685.001) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK tactic learning hub · Intermediate

Discovery — MITRE ATT&CK® Tactic TA0007

Adversaries query systems, networks, identities, applications, policies, and cloud resources to understand the environment and select follow-on actions.

ATT&CK sub-technique profile · Advanced

Disk Content Wipe (T1561.001)

Disk Content Wipe (T1561.001) is an Enterprise ATT&CK sub-technique under Disk Wipe. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK sub-technique profile · Advanced

Disk Structure Wipe (T1561.002)

Disk Structure Wipe (T1561.002) is an Enterprise ATT&CK sub-technique under Disk Wipe. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK technique profile · Intermediate

Disk Wipe (T1561)

Disk Wipe (T1561) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Distributed Component Object Model (T1021.003)

Distributed Component Object Model (T1021.003) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.

ATT&CK sub-technique profile · Advanced

Domain Account (T1087.002)

Domain Account (T1087.002) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.

ATT&CK sub-technique profile · Advanced

Domain Account (T1136.002)

Domain Account (T1136.002) is an Enterprise ATT&CK sub-technique under Create Account. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

Domain Accounts (T1078.002)

Domain Accounts (T1078.002) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.

ATT&CK sub-technique profile · Advanced

Domain Controller Authentication (T1556.001)

Domain Controller Authentication (T1556.001) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.

ATT&CK sub-technique profile · Advanced

Domain Fronting (T1090.004)

Domain Fronting (T1090.004) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

Domain Generation Algorithms (T1568.002)

Domain Generation Algorithms (T1568.002) is an Enterprise ATT&CK sub-technique under Dynamic Resolution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

Domain Groups (T1069.002)

Domain Groups (T1069.002) is an Enterprise ATT&CK sub-technique under Permission Groups Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.

ATT&CK sub-technique profile · Advanced

Domain Properties (T1590.001)

Domain Properties (T1590.001) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

Infrastructure analysis technique · Intermediate

Domain Registration Intelligence

Domain registration intelligence uses registrar, registrant, nameserver, timing, and related metadata to support infrastructure analysis and campaign research.

ATT&CK technique profile · Intermediate

Domain Trust Discovery (T1482)

Domain Trust Discovery (T1482) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Domain or Tenant Policy Modification (T1484)

An adversary changes domain, federation, identity-provider, tenant, or cloud policy to weaken controls, grant access, or alter trusted behavior.

ATT&CK sub-technique profile · Advanced

Domains (T1583.001)

Domains (T1583.001) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Domains (T1584.001)

Domains (T1584.001) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Double File Extension (T1036.007)

Double File Extension (T1036.007) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Downgrade Attack (T1689)

Downgrade Attack (T1689) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Downgrade System Image (T1601.002)

Downgrade System Image (T1601.002) is an Enterprise ATT&CK sub-technique under Modify System Image. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK Group Analysis · Intermediate

Dragonfly (G0035)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0035, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a cyber-espionage cluster attributed to Russia’s FSB Center 16 and reported against industrial-control and critical-infrastructure sectors.

ATT&CK technique profile · Intermediate

Drive-by Compromise (T1189)

A user is exposed to malicious web content that exploits a browser or convinces the user to retrieve and run harmful content, creating an entry path through normal browsing.

ATT&CK sub-technique profile · Advanced

Drive-by Target (T1608.004)

Drive-by Target (T1608.004) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Dylib Hijacking (T1574.004)

Dylib Hijacking (T1574.004) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Dynamic API Resolution (T1027.007)

Dynamic API Resolution (T1027.007) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Dynamic Data Exchange (T1559.002)

Dynamic Data Exchange (T1559.002) is an Enterprise ATT&CK sub-technique under Inter-Process Communication. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Dynamic Linker Hijacking (T1574.006)

Dynamic Linker Hijacking (T1574.006) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK technique profile · Intermediate

Dynamic Resolution (T1568)

Dynamic Resolution (T1568) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Dynamic-link Library Injection (T1055.001)

Dynamic-link Library Injection (T1055.001) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK technique profile · Intermediate

ESXi Administration Command (T1675)

ESXi Administration Command (T1675) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Electron Applications (T1218.015)

Electron Applications (T1218.015) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Elevated Execution with Prompt (T1548.004)

Elevated Execution with Prompt (T1548.004) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Email Account (T1087.003)

Email Account (T1087.003) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.

ATT&CK sub-technique profile · Advanced

Email Accounts (T1585.002)

Email Accounts (T1585.002) is an Enterprise ATT&CK sub-technique under Establish Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Email Accounts (T1586.002)

Email Accounts (T1586.002) is an Enterprise ATT&CK sub-technique under Compromise Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Email Addresses (T1589.002)

Email Addresses (T1589.002) is an Enterprise ATT&CK sub-technique under Gather Victim Identity Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK technique profile · Intermediate

Email Bombing (T1667)

Email Bombing (T1667) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Email Collection (T1114)

Email Collection (T1114) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Email Forwarding Rule (T1114.003)

Email Forwarding Rule (T1114.003) is an Enterprise ATT&CK sub-technique under Email Collection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK sub-technique profile · Advanced

Email Hiding Rules (T1564.008)

Email Hiding Rules (T1564.008) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Email Spoofing (T1684.002)

Email Spoofing (T1684.002) is an Enterprise ATT&CK sub-technique under Social Engineering. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Embedded Payloads (T1027.009)

Embedded Payloads (T1027.009) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Emond (T1546.014)

Emond (T1546.014) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK sub-technique profile · Advanced

Employee Names (T1589.003)

Employee Names (T1589.003) is an Enterprise ATT&CK sub-technique under Gather Victim Identity Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK technique profile · Intermediate

Encrypted Channel (T1573)

An adversary protects command traffic with encryption or an encrypted protocol to conceal content and complicate inspection.

ATT&CK sub-technique profile · Advanced

Encrypted/Encoded File (T1027.013)

Encrypted/Encoded File (T1027.013) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Endpoint Denial of Service (T1499)

Endpoint Denial of Service (T1499) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Environmental Keying (T1480.001)

Environmental Keying (T1480.001) is an Enterprise ATT&CK sub-technique under Execution Guardrails. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Escape to Host (T1611)

Escape to Host (T1611) is an Enterprise ATT&CK technique associated with Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Establish Accounts (T1585)

Establish Accounts (T1585) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Event Triggered Execution (T1546)

Event Triggered Execution (T1546) is an Enterprise ATT&CK technique associated with Privilege Escalation, Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Evil Twin (T1557.004)

Evil Twin (T1557.004) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.

ATT&CK technique profile · Intermediate

Exclusive Control (T1668)

Exclusive Control (T1668) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Executable Installer File Permissions Weakness (T1574.005)

Executable Installer File Permissions Weakness (T1574.005) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK technique profile · Intermediate

Execution Guardrails (T1480)

Execution Guardrails (T1480) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK tactic learning hub · Intermediate

Execution — MITRE ATT&CK® Tactic TA0002

Adversaries run commands, scripts, code, interpreters, APIs, or user-driven content to carry out malicious actions in an environment.

ATT&CK technique profile · Intermediate

Exfiltration Over Alternative Protocol (T1048)

Exfiltration Over Alternative Protocol (T1048) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (T1048.002)

Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (T1048.002) is an Enterprise ATT&CK sub-technique under Exfiltration Over Alternative Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK sub-technique profile · Advanced

Exfiltration Over Bluetooth (T1011.001)

Exfiltration Over Bluetooth (T1011.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Other Network Medium. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK technique profile · Intermediate

Exfiltration Over C2 Channel (T1041)

An adversary sends collected data through the same command-and-control channel used to manage compromised systems.

ATT&CK technique profile · Intermediate

Exfiltration Over Other Network Medium (T1011)

Exfiltration Over Other Network Medium (T1011) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Exfiltration Over Physical Medium (T1052)

Exfiltration Over Physical Medium (T1052) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Exfiltration Over Symmetric Encrypted Non-C2 Protocol (T1048.001)

Exfiltration Over Symmetric Encrypted Non-C2 Protocol (T1048.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Alternative Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK sub-technique profile · Advanced

Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003)

Exfiltration Over Unencrypted Non-C2 Protocol (T1048.003) is an Enterprise ATT&CK sub-technique under Exfiltration Over Alternative Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK technique profile · Intermediate

Exfiltration Over Web Service (T1567)

An adversary uploads information through a web service, cloud-storage provider, code-sharing service, or other internet platform that may resemble normal use.

ATT&CK sub-technique profile · Advanced

Exfiltration Over Webhook (T1567.004)

Exfiltration Over Webhook (T1567.004) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK sub-technique profile · Advanced

Exfiltration over USB (T1052.001)

Exfiltration over USB (T1052.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Physical Medium. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK sub-technique profile · Advanced

Exfiltration to Cloud Storage (T1567.002)

Exfiltration to Cloud Storage (T1567.002) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK sub-technique profile · Advanced

Exfiltration to Code Repository (T1567.001)

Exfiltration to Code Repository (T1567.001) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK sub-technique profile · Advanced

Exfiltration to Text Storage Sites (T1567.003)

Exfiltration to Text Storage Sites (T1567.003) is an Enterprise ATT&CK sub-technique under Exfiltration Over Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK tactic learning hub · Intermediate

Exfiltration — MITRE ATT&CK® Tactic TA0010

Adversaries transfer collected information outside an authorized boundary through command channels, web services, cloud storage, physical media, or alternate paths.

ATT&CK technique profile · Intermediate

Exploit Public-Facing Application (T1190)

An adversary exploits a weakness in an internet-accessible application, service, appliance, management interface, or workload to gain access.

ATT&CK technique profile · Intermediate

Exploitation for Client Execution (T1203)

Exploitation for Client Execution (T1203) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Exploitation for Credential Access (T1212)

Exploitation for Credential Access (T1212) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Exploitation for Defense Impairment (T1687)

Exploitation for Defense Impairment (T1687) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Exploitation for Privilege Escalation (T1068)

An adversary exploits a software or configuration weakness to cross a local or workload privilege boundary.

ATT&CK technique profile · Intermediate

Exploitation for Stealth (T1211)

Exploitation for Stealth (T1211) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Exploitation of Remote Services (T1210)

An adversary exploits a weakness in an internal remote service to gain access to another system without relying solely on valid credentials.

ATT&CK sub-technique profile · Advanced

Exploits (T1587.004)

Exploits (T1587.004) is an Enterprise ATT&CK sub-technique under Develop Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Exploits (T1588.005)

Exploits (T1588.005) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Extended Attributes (T1564.014)

Extended Attributes (T1564.014) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

External Defacement (T1491.002)

External Defacement (T1491.002) is an Enterprise ATT&CK sub-technique under Defacement. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK sub-technique profile · Advanced

External Proxy (T1090.002)

External Proxy (T1090.002) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK technique profile · Intermediate

External Remote Services (T1133)

An adversary uses externally reachable VPN, remote desktop, SSH, virtual application, management, or other remote-access services to enter or return to an environment.

ATT&CK sub-technique profile · Advanced

Extra Window Memory Injection (T1055.011)

Extra Window Memory Injection (T1055.011) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK technique profile · Intermediate

Fallback Channels (T1008)

Fallback Channels (T1008) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Fast Flux DNS (T1568.001)

Fast Flux DNS (T1568.001) is an Enterprise ATT&CK sub-technique under Dynamic Resolution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

File Deletion (T1070.004)

File Deletion (T1070.004) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

File Transfer Protocols (T1071.002)

File Transfer Protocols (T1071.002) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK technique profile · Intermediate

File and Directory Discovery (T1083)

File and Directory Discovery (T1083) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

File and Directory Permissions Modification (T1222)

File and Directory Permissions Modification (T1222) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

File/Path Exclusions (T1564.012)

File/Path Exclusions (T1564.012) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

Threat and attack concept · Intermediate

Fileless Malware

Fileless Malware describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

ATT&CK sub-technique profile · Advanced

Fileless Storage (T1027.011)

Fileless Storage (T1027.011) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Financial Theft (T1657)

Financial Theft (T1657) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Firmware (T1592.003)

Firmware (T1592.003) is an Enterprise ATT&CK sub-technique under Gather Victim Host Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK technique profile · Intermediate

Firmware Corruption (T1495)

Firmware Corruption (T1495) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Forced Authentication (T1187)

Forced Authentication (T1187) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Forge Web Credentials (T1606)

Forge Web Credentials (T1606) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK Group Analysis · Intermediate

Fox Kitten (G0117)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0117, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected Iranian-nexus cluster reported across multiple sectors and regions.

ATT&CK Group Analysis · Intermediate

GALLIUM (G0093)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0093, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a likely China-based cyber-espionage cluster reported against telecommunications, finance, and government organizations.

ATT&CK sub-technique profile · Advanced

GUI Input Capture (T1056.002)

GUI Input Capture (T1056.002) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.

ATT&CK Group Analysis · Intermediate

Gamaredon Group (G0047)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0047, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a suspected Russian and FSB-linked cluster reported in persistent operations focused on Ukraine.

ATT&CK sub-technique profile · Advanced

Gatekeeper Bypass (T1553.001)

Gatekeeper Bypass (T1553.001) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK technique profile · Intermediate

Gather Victim Host Information (T1592)

Gather Victim Host Information (T1592) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Gather Victim Identity Information (T1589)

An operator collects names, usernames, email addresses, roles, relationships, or other identity details that can support targeting, credential attacks, and believable pretexts.

ATT&CK technique profile · Intermediate

Gather Victim Network Information (T1590)

Gather Victim Network Information (T1590) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Gather Victim Org Information (T1591)

Gather Victim Org Information (T1591) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Generate Content (T1683)

Generate Content (T1683) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Golden Ticket (T1558.001)

Golden Ticket (T1558.001) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK technique profile · Intermediate

Group Policy Discovery (T1615)

Group Policy Discovery (T1615) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Group Policy Modification (T1484.001)

Group Policy Modification (T1484.001) is an Enterprise ATT&CK sub-technique under Domain or Tenant Policy Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Group Policy Preferences (T1552.006)

Group Policy Preferences (T1552.006) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK Group Analysis · Intermediate

HAFNIUM (G0125)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0125, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a likely China state-sponsored cluster reported against a broad range of United States sectors.

ATT&CK sub-technique profile · Advanced

HTML Smuggling (T1027.006)

HTML Smuggling (T1027.006) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Hardware (T1592.001)

Hardware (T1592.001) is an Enterprise ATT&CK sub-technique under Gather Victim Host Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK technique profile · Intermediate

Hardware Additions (T1200)

Hardware Additions (T1200) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Hidden File System (T1564.005)

Hidden File System (T1564.005) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Hidden Files and Directories (T1564.001)

Hidden Files and Directories (T1564.001) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Hidden Users (T1564.002)

Hidden Users (T1564.002) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Hidden Window (T1564.003)

Hidden Window (T1564.003) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Hide Artifacts (T1564)

An adversary conceals files, directories, processes, windows, accounts, services, or cloud resources from ordinary inspection.

ATT&CK technique profile · Intermediate

Hide Infrastructure (T1665)

Hide Infrastructure (T1665) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Hijack Execution Flow (T1574)

Hijack Execution Flow (T1574) is an Enterprise ATT&CK technique associated with Stealth, Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Hybrid Identity (T1556.007)

Hybrid Identity (T1556.007) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.

ATT&CK sub-technique profile · Advanced

Hypervisor CLI (T1059.012)

Hypervisor CLI (T1059.012) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

IDE Extensions (T1176.002)

IDE Extensions (T1176.002) is an Enterprise ATT&CK sub-technique under Software Extensions. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

IDE Tunneling (T1219.001)

IDE Tunneling (T1219.001) is an Enterprise ATT&CK sub-technique under Remote Access Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

IIS Components (T1505.004)

IIS Components (T1505.004) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

IP Addresses (T1590.005)

IP Addresses (T1590.005) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Identify Business Tempo (T1591.003)

Identify Business Tempo (T1591.003) is an Enterprise ATT&CK sub-technique under Gather Victim Org Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Identify Roles (T1591.004)

Identify Roles (T1591.004) is an Enterprise ATT&CK sub-technique under Gather Victim Org Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Ignore Process Interrupts (T1564.011)

Ignore Process Interrupts (T1564.011) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Image File Execution Options Injection (T1546.012)

Image File Execution Options Injection (T1546.012) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK tactic learning hub · Intermediate

Impact — MITRE ATT&CK® Tactic TA0040

Adversaries disrupt availability, destroy or manipulate information, impair recovery, consume resources, or otherwise affect mission and business operations.

ATT&CK legacy profile · Intermediate

Impair Defenses (Legacy T1562)

Impair Defenses (T1562) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.

ATT&CK sub-technique profile · Advanced

Impersonation (T1684.001)

Impersonation (T1684.001) is an Enterprise ATT&CK sub-technique under Social Engineering. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Implant Internal Image (T1525)

Implant Internal Image (T1525) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Indicator Removal (T1070)

An adversary deletes or alters logs, files, timestamps, command history, accounts, or other evidence to reduce the visible record of activity.

ATT&CK sub-technique profile · Advanced

Indicator Removal from Tools (T1027.005)

Indicator Removal from Tools (T1027.005) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

Detection concept · Intermediate

Indicators of Compromise and Attack

Indicators of compromise describe evidence associated with a suspected intrusion, while indicators of attack emphasize behavior that may reveal an attack in progress.

ATT&CK technique profile · Intermediate

Indirect Command Execution (T1202)

Indirect Command Execution (T1202) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Ingress Tool Transfer (T1105)

An adversary transfers tools or files from an external location into a compromised environment, often through an existing command channel.

ATT&CK technique profile · Intermediate

Inhibit System Recovery (T1490)

An adversary deletes, disables, corrupts, or reconfigures backups, snapshots, recovery partitions, services, or boot options to make restoration harder.

Threat behavior · Intermediate

Initial Access Techniques

Initial access techniques are the phishing, exploitation, credential, supply-chain, and trusted-relationship methods adversaries use to obtain a first foothold.

ATT&CK tactic learning hub · Intermediate

Initial Access — MITRE ATT&CK® Tactic TA0001

Adversaries obtain the first foothold through people, internet-facing services, remote access, trusted relationships, removable media, or other entry paths.

ATT&CK technique profile · Intermediate

Input Capture (T1056)

Input Capture (T1056) is an Enterprise ATT&CK technique associated with Collection, Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Input Injection (T1674)

Input Injection (T1674) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Install Digital Certificate (T1608.003)

Install Digital Certificate (T1608.003) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Install Root Certificate (T1553.004)

Install Root Certificate (T1553.004) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

InstallUtil (T1218.004)

InstallUtil (T1218.004) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Installer Packages (T1546.016)

Installer Packages (T1546.016) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

Intelligence planning practice · Advanced

Intelligence Collection Management

Intelligence collection management identifies needed information, selects appropriate sources, assigns collection tasks, and tracks whether gaps are being resolved.

ATT&CK technique profile · Intermediate

Inter-Process Communication (T1559)

Inter-Process Communication (T1559) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Internal Defacement (T1491.001)

Internal Defacement (T1491.001) is an Enterprise ATT&CK sub-technique under Defacement. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK sub-technique profile · Advanced

Internal Proxy (T1090.001)

Internal Proxy (T1090.001) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK technique profile · Intermediate

Internal Spearphishing (T1534)

Internal Spearphishing (T1534) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Internet Connection Discovery (T1016.001)

Internet Connection Discovery (T1016.001) is an Enterprise ATT&CK sub-technique under System Network Configuration Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.

ATT&CK sub-technique profile · Advanced

Invalid Code Signature (T1036.001)

Invalid Code Signature (T1036.001) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Invisible Unicode (T1027.018)

Invisible Unicode (T1027.018) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

JamPlus (T1127.003)

JamPlus (T1127.003) is an Enterprise ATT&CK sub-technique under Trusted Developer Utilities Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

JavaScript (T1059.007)

JavaScript (T1059.007) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Junk Code Insertion (T1027.016)

Junk Code Insertion (T1027.016) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Junk Data (T1001.001)

Junk Data (T1001.001) is an Enterprise ATT&CK sub-technique under Data Obfuscation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

Credential attack technique · Advanced

Kerberoasting

Kerberoasting is an attack technique in which an authenticated domain user requests Kerberos service tickets for service principal names and attempts to crack the ticket material offline to recover weak service-account passwords.

ATT&CK sub-technique profile · Advanced

Kerberoasting (T1558.003)

Kerberoasting (T1558.003) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Kernel Modules and Extensions (T1547.006)

Kernel Modules and Extensions (T1547.006) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

KernelCallbackTable (T1574.013)

KernelCallbackTable (T1574.013) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Keychain (T1555.001)

Keychain (T1555.001) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Keylogging (T1056.001)

Keylogging (T1056.001) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.

ATT&CK sub-technique profile · Advanced

LC_LOAD_DYLIB Addition (T1546.006)

LC_LOAD_DYLIB Addition (T1546.006) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK sub-technique profile · Advanced

LNK Icon Smuggling (T1027.012)

LNK Icon Smuggling (T1027.012) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

LSA Secrets (T1003.004)

LSA Secrets (T1003.004) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

LSASS Driver (T1547.008)

LSASS Driver (T1547.008) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

LSASS Memory (T1003.001)

LSASS Memory (T1003.001) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

Adversary behavior · Intermediate

Lateral Movement

Lateral movement is the use of credentials, remote services, trust relationships, and administrative tools to move from one system or account to another.

ATT&CK tactic learning hub · Intermediate

Lateral Movement — MITRE ATT&CK® Tactic TA0008

Adversaries move from one account, system, workload, or trust zone to another using remote services, credentials, exploits, or transferred tools.

ATT&CK technique profile · Intermediate

Lateral Tool Transfer (T1570)

An adversary copies tools or files between systems inside the target environment to support continued movement and execution.

ATT&CK sub-technique profile · Advanced

Launch Agent (T1543.001)

Launch Agent (T1543.001) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Launch Daemon (T1543.004)

Launch Daemon (T1543.004) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Launchctl (T1569.001)

Launchctl (T1569.001) is an Enterprise ATT&CK sub-technique under System Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Lifecycle-Triggered Deletion (T1485.001)

Lifecycle-Triggered Deletion (T1485.001) is an Enterprise ATT&CK sub-technique under Data Destruction. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK sub-technique profile · Advanced

Link Target (T1608.005)

Link Target (T1608.005) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Linux and Mac Permissions (T1222.002)

Linux and Mac Permissions (T1222.002) is an Enterprise ATT&CK sub-technique under File and Directory Permissions Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

ListPlanting (T1055.015)

ListPlanting (T1055.015) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

Adversary technique · Intermediate

Living Off the Land

Living off the land describes adversary use of legitimate system tools, interpreters, services, and administration features to blend malicious actions into ordinary operations.

Threat and attack concept · Intermediate

Living-off-the-Land Techniques

Living-off-the-Land Techniques is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

ATT&CK sub-technique profile · Advanced

Local Account (T1087.001)

Local Account (T1087.001) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.

ATT&CK sub-technique profile · Advanced

Local Account (T1136.001)

Local Account (T1136.001) is an Enterprise ATT&CK sub-technique under Create Account. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

Local Accounts (T1078.003)

Local Accounts (T1078.003) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.

ATT&CK sub-technique profile · Advanced

Local Data Staging (T1074.001)

Local Data Staging (T1074.001) is an Enterprise ATT&CK sub-technique under Data Staged. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK sub-technique profile · Advanced

Local Email Collection (T1114.001)

Local Email Collection (T1114.001) is an Enterprise ATT&CK sub-technique under Email Collection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK sub-technique profile · Advanced

Local Groups (T1069.001)

Local Groups (T1069.001) is an Enterprise ATT&CK sub-technique under Permission Groups Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.

ATT&CK technique profile · Intermediate

Local Storage Discovery (T1680)

Local Storage Discovery (T1680) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Log Enumeration (T1654)

Log Enumeration (T1654) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Login Hook (T1037.002)

Login Hook (T1037.002) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Login Items (T1547.015)

Login Items (T1547.015) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Logon Script (Windows) (T1037.001)

Logon Script (Windows) (T1037.001) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Lua (T1059.011)

Lua (T1059.011) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

Operational technology threat intelligence · Intermediate

MITRE ATT&CK for ICS

MITRE ATT&CK for ICS organizes observed adversary tactics and techniques that affect industrial control systems and can support threat modeling, detection, testing, and response.

Threat intelligence method · Intermediate

MITRE ATT&CK® Groups, Software, Campaigns, and Procedure Examples

How ATT&CK connects named groups, malware, tools, campaigns, and evidence-backed procedure examples to techniques without treating labels as permanent truth.

ATT&CK sub-technique profile · Advanced

MMC (T1218.014)

MMC (T1218.014) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

MSBuild (T1127.001)

MSBuild (T1127.001) is an Enterprise ATT&CK sub-technique under Trusted Developer Utilities Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Mail Protocols (T1071.003)

Mail Protocols (T1071.003) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

Make and Impersonate Token (T1134.003)

Make and Impersonate Token (T1134.003) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Malicious Copy and Paste (T1204.004)

Malicious Copy and Paste (T1204.004) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Malicious File (T1204.002)

Malicious File (T1204.002) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Malicious Image (T1204.003)

Malicious Image (T1204.003) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Malicious Library (T1204.005)

Malicious Library (T1204.005) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Malicious Link (T1204.001)

Malicious Link (T1204.001) is an Enterprise ATT&CK sub-technique under User Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Malvertising (T1583.008)

Malvertising (T1583.008) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Malware (T1587.001)

Malware (T1587.001) is an Enterprise ATT&CK sub-technique under Develop Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Malware (T1588.001)

Malware (T1588.001) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

Threat intelligence discipline · Advanced

Malware Intelligence

Malware intelligence converts static features, runtime behavior, configuration, infrastructure, and family relationships into information defenders can use.

Threat concept · Beginner

Malware Types and Behavior

Malware is software or code used to disrupt, spy, steal, persist, evade, manipulate, or provide unauthorized control.

ATT&CK sub-technique profile · Advanced

Mark-of-the-Web Bypass (T1553.005)

Mark-of-the-Web Bypass (T1553.005) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

Masquerade Account Name (T1036.010)

Masquerade Account Name (T1036.010) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Masquerade File Type (T1036.008)

Masquerade File Type (T1036.008) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Masquerade Task or Service (T1036.004)

Masquerade Task or Service (T1036.004) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Masquerading (T1036)

An adversary makes an artifact, process, account, service, or task appear legitimate by using misleading names, locations, metadata, or presentation.

ATT&CK sub-technique profile · Advanced

Match Legitimate Resource Name or Location (T1036.005)

Match Legitimate Resource Name or Location (T1036.005) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Mavinject (T1218.013)

Mavinject (T1218.013) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Messaging Applications (T1213.005)

Messaging Applications (T1213.005) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK technique profile · Intermediate

Modify Authentication Process (T1556)

Modify Authentication Process (T1556) is an Enterprise ATT&CK technique associated with Defense Impairment, Persistence, Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Modify Cloud Compute Configurations (T1578.005)

Modify Cloud Compute Configurations (T1578.005) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK technique profile · Intermediate

Modify Cloud Compute Infrastructure (T1578)

Modify Cloud Compute Infrastructure (T1578) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Modify Cloud Resource Hierarchy (T1666)

Modify Cloud Resource Hierarchy (T1666) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Modify Registry (T1112)

Modify Registry (T1112) is an Enterprise ATT&CK technique associated with Defense Impairment, Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Modify System Image (T1601)

Modify System Image (T1601) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Modify or Spoof Tool UI (T1685.003)

Modify or Spoof Tool UI (T1685.003) is an Enterprise ATT&CK sub-technique under Disable or Modify Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

Mshta (T1218.005)

Mshta (T1218.005) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Msiexec (T1218.007)

Msiexec (T1218.007) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Multi-Factor Authentication (T1556.006)

Multi-Factor Authentication (T1556.006) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.

ATT&CK technique profile · Intermediate

Multi-Factor Authentication Interception (T1111)

Multi-Factor Authentication Interception (T1111) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Multi-Factor Authentication Request Generation (T1621)

Multi-Factor Authentication Request Generation (T1621) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Multi-Stage Channels (T1104)

Multi-Stage Channels (T1104) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Multi-hop Proxy (T1090.003)

Multi-hop Proxy (T1090.003) is an Enterprise ATT&CK sub-technique under Proxy. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

Mutual Exclusion (T1480.002)

Mutual Exclusion (T1480.002) is an Enterprise ATT&CK sub-technique under Execution Guardrails. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

NTDS (T1003.003)

NTDS (T1003.003) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

NTFS File Attributes (T1564.004)

NTFS File Attributes (T1564.004) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Name Resolution Poisoning and SMB Relay (T1557.001)

Name Resolution Poisoning and SMB Relay (T1557.001) is an Enterprise ATT&CK sub-technique under Adversary-in-the-Middle. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access, Collection context.

ATT&CK technique profile · Intermediate

Native API (T1106)

An adversary calls operating-system or runtime application programming interfaces directly to perform actions that might otherwise require ordinary utilities.

ATT&CK sub-technique profile · Advanced

Netsh Helper DLL (T1546.007)

Netsh Helper DLL (T1546.007) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK sub-technique profile · Advanced

Network Address Translation Traversal (T1599.001)

Network Address Translation Traversal (T1599.001) is an Enterprise ATT&CK sub-technique under Network Boundary Bridging. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK technique profile · Intermediate

Network Boundary Bridging (T1599)

Network Boundary Bridging (T1599) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Network Denial of Service (T1498)

Network Denial of Service (T1498) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Network Device Authentication (T1556.004)

Network Device Authentication (T1556.004) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.

ATT&CK sub-technique profile · Advanced

Network Device CLI (T1059.008)

Network Device CLI (T1059.008) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Network Device Configuration Dump (T1602.002)

Network Device Configuration Dump (T1602.002) is an Enterprise ATT&CK sub-technique under Data from Configuration Repository. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK sub-technique profile · Advanced

Network Device Firewall (T1686.002)

Network Device Firewall (T1686.002) is an Enterprise ATT&CK sub-technique under Disable or Modify System Firewall. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

Network Devices (T1584.008)

Network Devices (T1584.008) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Network Logon Script (T1037.003)

Network Logon Script (T1037.003) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Network Provider DLL (T1556.008)

Network Provider DLL (T1556.008) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.

ATT&CK sub-technique profile · Advanced

Network Security Appliances (T1590.006)

Network Security Appliances (T1590.006) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK technique profile · Intermediate

Network Service Discovery (T1046)

Network Service Discovery (T1046) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Network Share Connection Removal (T1070.005)

Network Share Connection Removal (T1070.005) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Network Share Discovery (T1135)

Network Share Discovery (T1135) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Network Sniffing (T1040)

Network Sniffing (T1040) is an Enterprise ATT&CK technique associated with Credential Access, Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Network Topology (T1590.004)

Network Topology (T1590.004) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Network Trust Dependencies (T1590.003)

Network Trust Dependencies (T1590.003) is an Enterprise ATT&CK sub-technique under Gather Victim Network Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK technique profile · Intermediate

Non-Application Layer Protocol (T1095)

Non-Application Layer Protocol (T1095) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Non-Standard Encoding (T1132.002)

Non-Standard Encoding (T1132.002) is an Enterprise ATT&CK sub-technique under Data Encoding. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK technique profile · Intermediate

Non-Standard Port (T1571)

Non-Standard Port (T1571) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

OS Credential Dumping (T1003)

An adversary reads operating-system memory, databases, caches, registry material, or directory replication data to obtain credential artifacts.

ATT&CK sub-technique profile · Advanced

OS Exhaustion Flood (T1499.001)

OS Exhaustion Flood (T1499.001) is an Enterprise ATT&CK sub-technique under Endpoint Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK technique profile · Intermediate

Obfuscated Files or Information (T1027)

An adversary encodes, encrypts, packs, fragments, or otherwise transforms files and information to make discovery or analysis more difficult.

ATT&CK technique profile · Intermediate

Obtain Capabilities (T1588)

An operator purchases, steals, downloads, or otherwise acquires exploits, malware, credentials, information, or tools rather than developing them independently.

ATT&CK sub-technique profile · Advanced

Odbcconf (T1218.008)

Odbcconf (T1218.008) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Office Application Startup (T1137)

Office Application Startup (T1137) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Office Template Macros (T1137.001)

Office Template Macros (T1137.001) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

Office Test (T1137.002)

Office Test (T1137.002) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

Threat and attack concept · Intermediate

On-Path Attacks

On-Path Attacks describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

ATT&CK sub-technique profile · Advanced

One-Way Communication (T1102.003)

One-Way Communication (T1102.003) is an Enterprise ATT&CK sub-technique under Web Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

Outlook Forms (T1137.003)

Outlook Forms (T1137.003) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

Outlook Home Page (T1137.004)

Outlook Home Page (T1137.004) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

Outlook Rules (T1137.005)

Outlook Rules (T1137.005) is an Enterprise ATT&CK sub-technique under Office Application Startup. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

Overwrite Process Arguments (T1036.011)

Overwrite Process Arguments (T1036.011) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Parent PID Spoofing (T1134.004)

Parent PID Spoofing (T1134.004) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Pass the Hash (T1550.002)

Pass the Hash (T1550.002) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.

ATT&CK sub-technique profile · Advanced

Pass the Ticket (T1550.003)

Pass the Ticket (T1550.003) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.

Credential replay technique · Advanced

Pass-the-Hash

Pass-the-Hash is a credential replay technique in which an attacker uses a captured NTLM password hash to authenticate without learning or typing the original plaintext password.

Infrastructure analysis technique · Advanced

Passive DNS Analysis

Passive DNS analysis uses historical domain-to-address observations to examine infrastructure changes, relationships, reuse, and timing without directly querying adversary systems.

Threat and attack concept · Intermediate

Password Attacks

Password Attacks describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

ATT&CK sub-technique profile · Advanced

Password Cracking (T1110.002)

Password Cracking (T1110.002) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Password Filter DLL (T1556.002)

Password Filter DLL (T1556.002) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.

ATT&CK sub-technique profile · Advanced

Password Guessing (T1110.001)

Password Guessing (T1110.001) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Password Managers (T1555.005)

Password Managers (T1555.005) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK technique profile · Intermediate

Password Policy Discovery (T1201)

Password Policy Discovery (T1201) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

Threat and attack concept · Intermediate

Password Spraying

Password Spraying describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

ATT&CK sub-technique profile · Advanced

Password Spraying (T1110.003)

Password Spraying (T1110.003) is an Enterprise ATT&CK sub-technique under Brute Force. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Patch System Image (T1601.001)

Patch System Image (T1601.001) is an Enterprise ATT&CK sub-technique under Modify System Image. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

Path Interception by PATH Environment Variable (T1574.007)

Path Interception by PATH Environment Variable (T1574.007) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Path Interception by Search Order Hijacking (T1574.008)

Path Interception by Search Order Hijacking (T1574.008) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Path Interception by Unquoted Path (T1574.009)

Path Interception by Unquoted Path (T1574.009) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK technique profile · Intermediate

Peripheral Device Discovery (T1120)

Peripheral Device Discovery (T1120) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Permission Groups Discovery (T1069)

Permission Groups Discovery (T1069) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK tactic learning hub · Intermediate

Persistence — MITRE ATT&CK® Tactic TA0003

Adversaries preserve access through accounts, services, scheduled mechanisms, startup locations, application components, cloud resources, or configuration changes.

Attack technique · Beginner

Phishing

Phishing uses deceptive messages, sites, calls, or prompts to persuade a person to reveal information, approve access, send money, or run malicious content.

ATT&CK technique profile · Intermediate

Phishing (T1566)

Phishing (T1566) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Phishing for Information (T1598)

Phishing for Information (T1598) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Plist File Modification (T1647)

Plist File Modification (T1647) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Pluggable Authentication Modules (T1556.003)

Pluggable Authentication Modules (T1556.003) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.

ATT&CK technique profile · Intermediate

Poisoned Pipeline Execution (T1677)

Poisoned Pipeline Execution (T1677) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Polymorphic Code (T1027.014)

Polymorphic Code (T1027.014) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Port Knocking (T1205.001)

Port Knocking (T1205.001) is an Enterprise ATT&CK sub-technique under Traffic Signaling. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Command and Control context.

ATT&CK sub-technique profile · Advanced

Port Monitors (T1547.010)

Port Monitors (T1547.010) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Portable Executable Injection (T1055.002)

Portable Executable Injection (T1055.002) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK technique profile · Intermediate

Power Settings (T1653)

Power Settings (T1653) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

PowerShell (T1059.001)

PowerShell (T1059.001) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

PowerShell Profile (T1546.013)

PowerShell Profile (T1546.013) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK technique profile · Intermediate

Pre-OS Boot (T1542)

Pre-OS Boot (T1542) is an Enterprise ATT&CK technique associated with Stealth, Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Prevent Command History Logging (T1690)

Prevent Command History Logging (T1690) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Print Processors (T1547.012)

Print Processors (T1547.012) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Private Keys (T1552.004)

Private Keys (T1552.004) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK tactic learning hub · Intermediate

Privilege Escalation — MITRE ATT&CK® Tactic TA0004

Adversaries gain permissions beyond their current access by exploiting weaknesses, abusing tokens, changing controls, or misusing elevation mechanisms.

ATT&CK sub-technique profile · Advanced

Proc Filesystem (T1003.007)

Proc Filesystem (T1003.007) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Proc Memory (T1055.009)

Proc Memory (T1055.009) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Process Argument Spoofing (T1564.010)

Process Argument Spoofing (T1564.010) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Process Discovery (T1057)

An adversary lists running processes, services, containers, or workloads to identify security tools, applications, users, and possible targets.

ATT&CK sub-technique profile · Advanced

Process Doppelgänging (T1055.013)

Process Doppelgänging (T1055.013) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Process Hollowing (T1055.012)

Process Hollowing (T1055.012) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK technique profile · Intermediate

Process Injection (T1055)

Process Injection (T1055) is an Enterprise ATT&CK technique associated with Stealth, Privilege Escalation. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Protocol Tunneling (T1572)

Protocol Tunneling (T1572) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Protocol or Service Impersonation (T1001.003)

Protocol or Service Impersonation (T1001.003) is an Enterprise ATT&CK sub-technique under Data Obfuscation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK technique profile · Intermediate

Proxy (T1090)

Proxy (T1090) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Ptrace System Calls (T1055.008)

Ptrace System Calls (T1055.008) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

PubPrn (T1216.001)

PubPrn (T1216.001) is an Enterprise ATT&CK sub-technique under System Script Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Publish/Subscribe Protocols (T1071.005)

Publish/Subscribe Protocols (T1071.005) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

Purchase Technical Data (T1597.002)

Purchase Technical Data (T1597.002) is an Enterprise ATT&CK sub-technique under Search Closed Sources. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

Threat intelligence model · Intermediate

Pyramid of Pain

The Pyramid of Pain ranks indicators by how costly they are for an adversary to change, encouraging defenders to move from fragile hashes and addresses toward behavior and tradecraft.

ATT&CK sub-technique profile · Advanced

Python (T1059.006)

Python (T1059.006) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Python Startup Hooks (T1546.018)

Python Startup Hooks (T1546.018) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK technique profile · Intermediate

Query Public AI Services (T1682)

Query Public AI Services (T1682) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Query Registry (T1012)

Query Registry (T1012) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

RC Scripts (T1037.004)

RC Scripts (T1037.004) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

RDP Hijacking (T1563.002)

RDP Hijacking (T1563.002) is an Enterprise ATT&CK sub-technique under Remote Service Session Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.

ATT&CK sub-technique profile · Advanced

ROMMONkit (T1542.004)

ROMMONkit (T1542.004) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.

Attack pattern · Beginner

Ransomware

Ransomware operations disrupt access to systems or data and may combine encryption with theft, extortion, public pressure, and attacks on recovery systems.

ATT&CK sub-technique profile · Advanced

Re-opened Applications (T1547.007)

Re-opened Applications (T1547.007) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK tactic learning hub · Intermediate

Reconnaissance — MITRE ATT&CK® Tactic TA0043

Adversaries collect information about people, organizations, technology, and exposed services before or during an operation so they can choose targets and shape later actions.

ATT&CK sub-technique profile · Advanced

Reduce Key Space (T1600.001)

Reduce Key Space (T1600.001) is an Enterprise ATT&CK sub-technique under Weaken Encryption. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

Reflection Amplification (T1498.002)

Reflection Amplification (T1498.002) is an Enterprise ATT&CK sub-technique under Network Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK technique profile · Intermediate

Reflective Code Loading (T1620)

Reflective Code Loading (T1620) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Registry Run Keys / Startup Folder (T1547.001)

Registry Run Keys / Startup Folder (T1547.001) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Regsvcs/Regasm (T1218.009)

Regsvcs/Regasm (T1218.009) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Regsvr32 (T1218.010)

Regsvr32 (T1218.010) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Relocate Malware (T1070.010)

Relocate Malware (T1070.010) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Remote Access Hardware (T1219.003)

Remote Access Hardware (T1219.003) is an Enterprise ATT&CK sub-technique under Remote Access Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK technique profile · Intermediate

Remote Access Tools (T1219)

Remote Access Tools (T1219) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Remote Data Staging (T1074.002)

Remote Data Staging (T1074.002) is an Enterprise ATT&CK sub-technique under Data Staged. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK sub-technique profile · Advanced

Remote Desktop Protocol (T1021.001)

Remote Desktop Protocol (T1021.001) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.

ATT&CK sub-technique profile · Advanced

Remote Desktop Software (T1219.002)

Remote Desktop Software (T1219.002) is an Enterprise ATT&CK sub-technique under Remote Access Tools. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

Remote Email Collection (T1114.002)

Remote Email Collection (T1114.002) is an Enterprise ATT&CK sub-technique under Email Collection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK technique profile · Intermediate

Remote Service Session Hijacking (T1563)

Remote Service Session Hijacking (T1563) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Remote Services (T1021)

An adversary uses authenticated remote services such as RDP, SMB, WinRM, SSH, VNC, or management protocols to access another system.

ATT&CK technique profile · Intermediate

Remote System Discovery (T1018)

Remote System Discovery (T1018) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Rename Legitimate Utilities (T1036.003)

Rename Legitimate Utilities (T1036.003) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

Threat and attack concept · Intermediate

Replay Attacks

Replay Attacks describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

ATT&CK technique profile · Intermediate

Replication Through Removable Media (T1091)

Replication Through Removable Media (T1091) is an Enterprise ATT&CK technique associated with Lateral Movement, Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK tactic learning hub · Intermediate

Resource Development — MITRE ATT&CK® Tactic TA0042

Adversaries establish infrastructure, accounts, capabilities, and operational resources that support access, command and control, evasion, or influence.

ATT&CK sub-technique profile · Advanced

Resource Forking (T1564.009)

Resource Forking (T1564.009) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Resource Hijacking (T1496)

Resource Hijacking (T1496) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Reversible Encryption (T1556.005)

Reversible Encryption (T1556.005) is an Enterprise ATT&CK sub-technique under Modify Authentication Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Persistence, Credential Access context.

ATT&CK sub-technique profile · Advanced

Revert Cloud Instance (T1578.004)

Revert Cloud Instance (T1578.004) is an Enterprise ATT&CK sub-technique under Modify Cloud Compute Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

Right-to-Left Override (T1036.002)

Right-to-Left Override (T1036.002) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Rogue Domain Controller (T1207)

Rogue Domain Controller (T1207) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Rootkit (T1014)

Rootkit (T1014) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

Threat and attack concept · Intermediate

Rootkits

Rootkits describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.

ATT&CK sub-technique profile · Advanced

Run Virtual Instance (T1564.006)

Run Virtual Instance (T1564.006) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Rundll32 (T1218.011)

Rundll32 (T1218.011) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Runtime Data Manipulation (T1565.003)

Runtime Data Manipulation (T1565.003) is an Enterprise ATT&CK sub-technique under Data Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK sub-technique profile · Advanced

SAML Tokens (T1606.002)

SAML Tokens (T1606.002) is an Enterprise ATT&CK sub-technique under Forge Web Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

SEO Poisoning (T1608.006)

SEO Poisoning (T1608.006) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

SID-History Injection (T1134.005)

SID-History Injection (T1134.005) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

SIP and Trust Provider Hijacking (T1553.003)

SIP and Trust Provider Hijacking (T1553.003) is an Enterprise ATT&CK sub-technique under Subvert Trust Controls. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

SMB/Windows Admin Shares (T1021.002)

SMB/Windows Admin Shares (T1021.002) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.

ATT&CK sub-technique profile · Advanced

SMS Pumping (T1496.003)

SMS Pumping (T1496.003) is an Enterprise ATT&CK sub-technique under Resource Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK sub-technique profile · Advanced

SNMP (MIB Dump) (T1602.001)

SNMP (MIB Dump) (T1602.001) is an Enterprise ATT&CK sub-technique under Data from Configuration Repository. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK sub-technique profile · Advanced

SQL Stored Procedures (T1505.001)

SQL Stored Procedures (T1505.001) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

SSH (T1021.004)

SSH (T1021.004) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.

ATT&CK sub-technique profile · Advanced

SSH Authorized Keys (T1098.004)

SSH Authorized Keys (T1098.004) is an Enterprise ATT&CK sub-technique under Account Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

SSH Hijacking (T1563.001)

SSH Hijacking (T1563.001) is an Enterprise ATT&CK sub-technique under Remote Service Session Hijacking. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.

Threat intelligence standards · Advanced

STIX and TAXII

STIX provides a structured language for cyber threat and observable information, while TAXII provides application-layer services for exchanging that information.

ATT&CK sub-technique profile · Advanced

SVG Smuggling (T1027.017)

SVG Smuggling (T1027.017) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Safe Mode Boot (T1688)

Safe Mode Boot (T1688) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Scan Databases (T1596.005)

Scan Databases (T1596.005) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Scanning IP Blocks (T1595.001)

Scanning IP Blocks (T1595.001) is an Enterprise ATT&CK sub-technique under Active Scanning. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK Group Analysis · Intermediate

Scattered Spider (G1015)

A defensive guide to the Enterprise ATT&CK activity-cluster record G1015, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing an English-speaking cybercriminal cluster reported to rely heavily on social engineering, identity compromise, and cloud access.

ATT&CK sub-technique profile · Advanced

Scheduled Task (T1053.005)

Scheduled Task (T1053.005) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.

ATT&CK technique profile · Intermediate

Scheduled Task/Job (T1053)

An adversary creates or modifies a scheduled task, cron job, cloud schedule, or similar mechanism to run code at a chosen time or event.

ATT&CK technique profile · Intermediate

Scheduled Transfer (T1029)

Scheduled Transfer (T1029) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Screen Capture (T1113)

An adversary captures screenshots or display content to collect information visible in applications, sessions, and user workflows.

ATT&CK sub-technique profile · Advanced

Screensaver (T1546.002)

Screensaver (T1546.002) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK technique profile · Intermediate

Search Closed Sources (T1597)

Search Closed Sources (T1597) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Search Engines (T1593.002)

Search Engines (T1593.002) is an Enterprise ATT&CK sub-technique under Search Open Websites/Domains. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK technique profile · Intermediate

Search Open Technical Databases (T1596)

Search Open Technical Databases (T1596) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Search Open Websites/Domains (T1593)

An operator searches public websites, social platforms, code repositories, technical forums, and organizational domains for information useful to an operation.

ATT&CK technique profile · Intermediate

Search Threat Vendor Data (T1681)

Search Threat Vendor Data (T1681) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Search Victim-Owned Websites (T1594)

Search Victim-Owned Websites (T1594) is an Enterprise ATT&CK technique associated with Reconnaissance. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Security Account Manager (T1003.002)

Security Account Manager (T1003.002) is an Enterprise ATT&CK sub-technique under OS Credential Dumping. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Security Software Discovery (T1518.001)

Security Software Discovery (T1518.001) is an Enterprise ATT&CK sub-technique under Software Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.

ATT&CK sub-technique profile · Advanced

Security Support Provider (T1547.005)

Security Support Provider (T1547.005) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Securityd Memory (T1555.002)

Securityd Memory (T1555.002) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK technique profile · Intermediate

Selective Exclusion (T1679)

Selective Exclusion (T1679) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Server (T1583.004)

Server (T1583.004) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Server (T1584.004)

Server (T1584.004) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK technique profile · Intermediate

Server Software Component (T1505)

An adversary adds or modifies a component within server software—such as a web shell, plug-in, module, or management extension—to preserve access or execute code.

ATT&CK sub-technique profile · Advanced

Serverless (T1583.007)

Serverless (T1583.007) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Serverless (T1584.007)

Serverless (T1584.007) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK technique profile · Intermediate

Serverless Execution (T1648)

Serverless Execution (T1648) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Service Execution (T1569.002)

Service Execution (T1569.002) is an Enterprise ATT&CK sub-technique under System Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Service Exhaustion Flood (T1499.002)

Service Exhaustion Flood (T1499.002) is an Enterprise ATT&CK sub-technique under Endpoint Denial of Service. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK technique profile · Intermediate

Service Stop (T1489)

Service Stop (T1489) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Services File Permissions Weakness (T1574.010)

Services File Permissions Weakness (T1574.010) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

ATT&CK sub-technique profile · Advanced

Services Registry Permissions Weakness (T1574.011)

Services Registry Permissions Weakness (T1574.011) is an Enterprise ATT&CK sub-technique under Hijack Execution Flow. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Execution context.

Threat and attack concept · Intermediate

Session Hijacking

Session Hijacking is part of the process used to establish identity, make access decisions, control privileges, or maintain trusted sessions.

ATT&CK sub-technique profile · Advanced

Setuid and Setgid (T1548.001)

Setuid and Setgid (T1548.001) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.

ATT&CK technique profile · Intermediate

Shared Modules (T1129)

Shared Modules (T1129) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Sharepoint (T1213.002)

Sharepoint (T1213.002) is an Enterprise ATT&CK sub-technique under Data from Information Repositories. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection context.

ATT&CK sub-technique profile · Advanced

Shell History (T1552.003)

Shell History (T1552.003) is an Enterprise ATT&CK sub-technique under Unsecured Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Shortcut Modification (T1547.009)

Shortcut Modification (T1547.009) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Silver Ticket (T1558.002)

Silver Ticket (T1558.002) is an Enterprise ATT&CK sub-technique under Steal or Forge Kerberos Tickets. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

Attack technique · Beginner

Social Engineering

Social engineering manipulates trust, urgency, authority, fear, helpfulness, or curiosity to influence a person into taking an unsafe action.

ATT&CK technique profile · Intermediate

Social Engineering (T1684)

Social Engineering (T1684) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Social Media (T1593.001)

Social Media (T1593.001) is an Enterprise ATT&CK sub-technique under Search Open Websites/Domains. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Social Media Accounts (T1585.001)

Social Media Accounts (T1585.001) is an Enterprise ATT&CK sub-technique under Establish Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Social Media Accounts (T1586.001)

Social Media Accounts (T1586.001) is an Enterprise ATT&CK sub-technique under Compromise Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Socket Filters (T1205.002)

Socket Filters (T1205.002) is an Enterprise ATT&CK sub-technique under Traffic Signaling. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Command and Control context.

ATT&CK sub-technique profile · Advanced

Software (T1592.002)

Software (T1592.002) is an Enterprise ATT&CK sub-technique under Gather Victim Host Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK technique profile · Intermediate

Software Deployment Tools (T1072)

Software Deployment Tools (T1072) is an Enterprise ATT&CK technique associated with Execution, Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Software Discovery (T1518)

Software Discovery (T1518) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Software Extensions (T1176)

Software Extensions (T1176) is an Enterprise ATT&CK technique associated with Persistence. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Software Packing (T1027.002)

Software Packing (T1027.002) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Space after Filename (T1036.006)

Space after Filename (T1036.006) is an Enterprise ATT&CK sub-technique under Masquerading. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Spearphishing Attachment (T1566.001)

Spearphishing Attachment (T1566.001) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.

ATT&CK sub-technique profile · Advanced

Spearphishing Attachment (T1598.002)

Spearphishing Attachment (T1598.002) is an Enterprise ATT&CK sub-technique under Phishing for Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Spearphishing Link (T1566.002)

Spearphishing Link (T1566.002) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.

ATT&CK sub-technique profile · Advanced

Spearphishing Link (T1598.003)

Spearphishing Link (T1598.003) is an Enterprise ATT&CK sub-technique under Phishing for Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Spearphishing Service (T1598.001)

Spearphishing Service (T1598.001) is an Enterprise ATT&CK sub-technique under Phishing for Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Spearphishing Voice (T1566.004)

Spearphishing Voice (T1566.004) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.

ATT&CK sub-technique profile · Advanced

Spearphishing Voice (T1598.004)

Spearphishing Voice (T1598.004) is an Enterprise ATT&CK sub-technique under Phishing for Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Spearphishing via Service (T1566.003)

Spearphishing via Service (T1566.003) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.

ATT&CK technique profile · Intermediate

Stage Capabilities (T1608)

Stage Capabilities (T1608) is an Enterprise ATT&CK technique associated with Resource Development. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Standard Encoding (T1132.001)

Standard Encoding (T1132.001) is an Enterprise ATT&CK sub-technique under Data Encoding. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

Startup Items (T1037.005)

Startup Items (T1037.005) is an Enterprise ATT&CK sub-technique under Boot or Logon Initialization Scripts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK technique profile · Intermediate

Steal Application Access Token (T1528)

Steal Application Access Token (T1528) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Steal Web Session Cookie (T1539)

Steal Web Session Cookie (T1539) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Steal or Forge Authentication Certificates (T1649)

Steal or Forge Authentication Certificates (T1649) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Steal or Forge Kerberos Tickets (T1558)

Steal or Forge Kerberos Tickets (T1558) is an Enterprise ATT&CK technique associated with Credential Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK tactic learning hub · Intermediate

Stealth — MITRE ATT&CK® Tactic TA0005

Adversaries conceal their presence, blend with expected activity, alter indicators, disguise artifacts, or make analysis more difficult.

ATT&CK sub-technique profile · Advanced

Steganography (T1001.002)

Steganography (T1001.002) is an Enterprise ATT&CK sub-technique under Data Obfuscation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

Steganography (T1027.003)

Steganography (T1027.003) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Stored Data Manipulation (T1565.001)

Stored Data Manipulation (T1565.001) is an Enterprise ATT&CK sub-technique under Data Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

Intelligence classification · Intermediate

Strategic, Operational, and Tactical Threat Intelligence

Strategic, operational, and tactical intelligence serve different decision horizons, from leadership risk choices to campaign understanding and immediate defensive action.

ATT&CK sub-technique profile · Advanced

Stripped Payloads (T1027.008)

Stripped Payloads (T1027.008) is an Enterprise ATT&CK sub-technique under Obfuscated Files or Information. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

Analytic method · Advanced

Structured Analytic Techniques

Structured analytic techniques make assumptions, alternatives, evidence, and uncertainty visible so judgments can be challenged and repeated.

ATT&CK technique profile · Intermediate

Subvert Trust Controls (T1553)

Subvert Trust Controls (T1553) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Sudo and Sudo Caching (T1548.003)

Sudo and Sudo Caching (T1548.003) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.

Threat and attack concept · Intermediate

Supply Chain Compromise

Supply Chain Compromise is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.

ATT&CK technique profile · Intermediate

Supply Chain Compromise (T1195)

Supply Chain Compromise (T1195) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Symmetric Cryptography (T1573.001)

Symmetric Cryptography (T1573.001) is an Enterprise ATT&CK sub-technique under Encrypted Channel. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK sub-technique profile · Advanced

SyncAppvPublishingServer (T1216.002)

SyncAppvPublishingServer (T1216.002) is an Enterprise ATT&CK sub-technique under System Script Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

System Binary Proxy Execution (T1218)

System Binary Proxy Execution (T1218) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

System Checks (T1497.001)

System Checks (T1497.001) is an Enterprise ATT&CK sub-technique under Virtualization/Sandbox Evasion. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Discovery context.

ATT&CK sub-technique profile · Advanced

System Firmware (T1542.001)

System Firmware (T1542.001) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.

ATT&CK technique profile · Intermediate

System Information Discovery (T1082)

An adversary queries operating-system, architecture, hardware, version, patch, hostname, or instance information to guide later actions.

ATT&CK sub-technique profile · Advanced

System Language Discovery (T1614.001)

System Language Discovery (T1614.001) is an Enterprise ATT&CK sub-technique under System Location Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.

ATT&CK technique profile · Intermediate

System Location Discovery (T1614)

System Location Discovery (T1614) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

System Network Configuration Discovery (T1016)

An adversary queries addresses, interfaces, routes, DNS settings, proxies, adapters, and other network configuration to understand connectivity.

ATT&CK technique profile · Intermediate

System Network Connections Discovery (T1049)

System Network Connections Discovery (T1049) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

System Owner/User Discovery (T1033)

System Owner/User Discovery (T1033) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

System Script Proxy Execution (T1216)

System Script Proxy Execution (T1216) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

System Service Discovery (T1007)

System Service Discovery (T1007) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

System Services (T1569)

System Services (T1569) is an Enterprise ATT&CK technique associated with Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

System Shutdown/Reboot (T1529)

System Shutdown/Reboot (T1529) is an Enterprise ATT&CK technique associated with Impact. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

System Time Discovery (T1124)

System Time Discovery (T1124) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Systemctl (T1569.003)

Systemctl (T1569.003) is an Enterprise ATT&CK sub-technique under System Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Systemd Service (T1543.002)

Systemd Service (T1543.002) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Systemd Timers (T1053.006)

Systemd Timers (T1053.006) is an Enterprise ATT&CK sub-technique under Scheduled Task/Job. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution, Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

TCC Manipulation (T1548.006)

TCC Manipulation (T1548.006) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

TFTP Boot (T1542.005)

TFTP Boot (T1542.005) is an Enterprise ATT&CK sub-technique under Pre-OS Boot. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence context.

ATT&CK technique profile · Intermediate

Taint Shared Content (T1080)

Taint Shared Content (T1080) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Template Injection (T1221)

Template Injection (T1221) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Temporary Elevated Cloud Access (T1548.005)

Temporary Elevated Cloud Access (T1548.005) is an Enterprise ATT&CK sub-technique under Abuse Elevation Control Mechanism. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Terminal Services DLL (T1505.005)

Terminal Services DLL (T1505.005) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

Thread Execution Hijacking (T1055.003)

Thread Execution Hijacking (T1055.003) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Thread Local Storage (T1055.005)

Thread Local Storage (T1055.005) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

Threat analysis · Beginner

Threat Actors and Motivation

Threat actors differ in goals, resources, access, patience, risk tolerance, and preferred methods, which influences what they target and how they operate.

Data preparation practice · Intermediate

Threat Data Normalization

Threat data normalization converts inconsistent values, formats, timestamps, identifiers, and naming conventions into a common structure for analysis.

Adversary analysis practice · Advanced

Threat Infrastructure Analysis

Threat infrastructure analysis connects domains, addresses, certificates, hosting, services, accounts, and timing to understand how an adversary supports operations.

ATT&CK sub-technique profile · Advanced

Threat Intel Vendors (T1597.001)

Threat Intel Vendors (T1597.001) is an Enterprise ATT&CK sub-technique under Search Closed Sources. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

Intelligence process · Intermediate

Threat Intelligence Cycle

The threat intelligence cycle organizes direction, collection, processing, analysis, dissemination, and feedback into a repeatable decision-support process.

Analytic method · Advanced

Threat Intelligence Hypothesis Development

Hypothesis development turns observations into testable explanations that guide collection, analysis, hunting, and validation.

Analytic technique · Advanced

Threat Intelligence Link Analysis

Link analysis represents entities and relationships so analysts can examine clusters, central nodes, paths, shared attributes, and evidence gaps.

Intelligence technology concept · Advanced

Threat Intelligence Platforms

Threat intelligence platforms organize collection, normalization, enrichment, scoring, relationships, sharing, workflow, and dissemination for threat information used by multiple teams.

ATT&CK mitigation profile · Intermediate

Threat Intelligence Program (M1019)

Operate a requirements-driven threat intelligence capability that turns external and internal information into decisions, priorities, detections, and defensive changes. This original Bare Metal Cyber profile explains implementation, validation, evidence, failure modes, ownership, and responsible use with ATT&CK.

Intelligence communication practice · Intermediate

Threat Intelligence Reporting

Threat intelligence reporting presents judgments, evidence, confidence, implications, and recommended decisions in a format suited to the intended audience.

Intelligence planning practice · Intermediate

Threat Intelligence Requirements

Threat intelligence requirements translate stakeholder decisions and uncertainties into specific questions that collection and analysis can answer.

Collaboration model · Intermediate

Threat Intelligence Sharing Communities

Threat intelligence sharing communities create trusted relationships, common expectations, and repeatable mechanisms for exchanging information among participants.

Analytic quality practice · Intermediate

Threat Intelligence Source Evaluation

Source evaluation considers reliability, access, motivation, timeliness, technical visibility, corroboration, and known limitations before information is trusted.

ATT&CK sub-technique profile · Advanced

Time Based Checks (T1497.003)

Time Based Checks (T1497.003) is an Enterprise ATT&CK sub-technique under Virtualization/Sandbox Evasion. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Discovery context.

ATT&CK sub-technique profile · Advanced

Time Providers (T1547.003)

Time Providers (T1547.003) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Timestomp (T1070.006)

Timestomp (T1070.006) is an Enterprise ATT&CK sub-technique under Indicator Removal. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

Token Impersonation/Theft (T1134.001)

Token Impersonation/Theft (T1134.001) is an Enterprise ATT&CK sub-technique under Access Token Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Tool (T1588.002)

Tool (T1588.002) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Traffic Duplication (T1020.001)

Traffic Duplication (T1020.001) is an Enterprise ATT&CK sub-technique under Automated Exfiltration. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Exfiltration context.

ATT&CK technique profile · Intermediate

Traffic Signaling (T1205)

Traffic Signaling (T1205) is an Enterprise ATT&CK technique associated with Stealth, Persistence, Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Transfer Data to Cloud Account (T1537)

Transfer Data to Cloud Account (T1537) is an Enterprise ATT&CK technique associated with Exfiltration. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Transmitted Data Manipulation (T1565.002)

Transmitted Data Manipulation (T1565.002) is an Enterprise ATT&CK sub-technique under Data Manipulation. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Impact context.

ATT&CK sub-technique profile · Advanced

Transport Agent (T1505.002)

Transport Agent (T1505.002) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

Trap (T1546.005)

Trap (T1546.005) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK sub-technique profile · Advanced

Trust Modification (T1484.002)

Trust Modification (T1484.002) is an Enterprise ATT&CK sub-technique under Domain or Tenant Policy Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment, Privilege Escalation context.

ATT&CK technique profile · Intermediate

Trusted Developer Utilities Proxy Execution (T1127)

Trusted Developer Utilities Proxy Execution (T1127) is an Enterprise ATT&CK technique associated with Stealth, Execution. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Trusted Relationship (T1199)

An adversary abuses a supplier, partner, managed service, federation, software, or other trusted relationship to reach the target environment.

ATT&CK sub-technique profile · Advanced

Udev Rules (T1546.017)

Udev Rules (T1546.017) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK sub-technique profile · Advanced

Unix Shell (T1059.004)

Unix Shell (T1059.004) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Unix Shell Configuration Modification (T1546.004)

Unix Shell Configuration Modification (T1546.004) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK technique profile · Intermediate

Unsecured Credentials (T1552)

An adversary searches files, repositories, scripts, logs, environment variables, instance metadata, or configuration for exposed authentication material.

ATT&CK technique profile · Intermediate

Unused/Unsupported Cloud Regions (T1535)

Unused/Unsupported Cloud Regions (T1535) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Upload Malware (T1608.001)

Upload Malware (T1608.001) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Upload Tool (T1608.002)

Upload Tool (T1608.002) is an Enterprise ATT&CK sub-technique under Stage Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK technique profile · Intermediate

Use Alternate Authentication Material (T1550)

Use Alternate Authentication Material (T1550) is an Enterprise ATT&CK technique associated with Lateral Movement. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

User Activity Based Checks (T1497.002)

User Activity Based Checks (T1497.002) is an Enterprise ATT&CK sub-technique under Virtualization/Sandbox Evasion. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Discovery context.

ATT&CK technique profile · Intermediate

User Execution (T1204)

An adversary depends on a user to open, launch, approve, install, or otherwise trigger malicious content or code.

ATT&CK sub-technique profile · Advanced

VBA Stomping (T1564.007)

VBA Stomping (T1564.007) is an Enterprise ATT&CK sub-technique under Hide Artifacts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK sub-technique profile · Advanced

VDSO Hijacking (T1055.014)

VDSO Hijacking (T1055.014) is an Enterprise ATT&CK sub-technique under Process Injection. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

VNC (T1021.005)

VNC (T1021.005) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.

ATT&CK technique profile · Intermediate

Valid Accounts (T1078)

Valid Accounts (T1078) is an Enterprise ATT&CK technique associated with Stealth, Persistence, Privilege Escalation, Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Verclsid (T1218.012)

Verclsid (T1218.012) is an Enterprise ATT&CK sub-technique under System Binary Proxy Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth context.

ATT&CK technique profile · Intermediate

Video Capture (T1125)

Video Capture (T1125) is an Enterprise ATT&CK technique associated with Collection. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK technique profile · Intermediate

Virtual Machine Discovery (T1673)

Virtual Machine Discovery (T1673) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Virtual Private Server (T1583.003)

Virtual Private Server (T1583.003) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Virtual Private Server (T1584.003)

Virtual Private Server (T1584.003) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK technique profile · Intermediate

Virtualization/Sandbox Evasion (T1497)

Virtualization/Sandbox Evasion (T1497) is an Enterprise ATT&CK technique associated with Stealth, Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Visual Basic (T1059.005)

Visual Basic (T1059.005) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Vulnerabilities (T1588.006)

Vulnerabilities (T1588.006) is an Enterprise ATT&CK sub-technique under Obtain Capabilities. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Vulnerability Scanning (T1595.002)

Vulnerability Scanning (T1595.002) is an Enterprise ATT&CK sub-technique under Active Scanning. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

WHOIS (T1596.002)

WHOIS (T1596.002) is an Enterprise ATT&CK sub-technique under Search Open Technical Databases. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK technique profile · Intermediate

Weaken Encryption (T1600)

Weaken Encryption (T1600) is an Enterprise ATT&CK technique associated with Defense Impairment. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Web Cookies (T1606.001)

Web Cookies (T1606.001) is an Enterprise ATT&CK sub-technique under Forge Web Credentials. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Web Portal Capture (T1056.003)

Web Portal Capture (T1056.003) is an Enterprise ATT&CK sub-technique under Input Capture. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Collection, Credential Access context.

ATT&CK sub-technique profile · Advanced

Web Protocols (T1071.001)

Web Protocols (T1071.001) is an Enterprise ATT&CK sub-technique under Application Layer Protocol. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Command and Control context.

ATT&CK technique profile · Intermediate

Web Service (T1102)

Web Service (T1102) is an Enterprise ATT&CK technique associated with Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Web Services (T1583.006)

Web Services (T1583.006) is an Enterprise ATT&CK sub-technique under Acquire Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Web Services (T1584.006)

Web Services (T1584.006) is an Enterprise ATT&CK sub-technique under Compromise Infrastructure. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

Web Session Cookie (T1550.004)

Web Session Cookie (T1550.004) is an Enterprise ATT&CK sub-technique under Use Alternate Authentication Material. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.

ATT&CK sub-technique profile · Advanced

Web Shell (T1505.003)

Web Shell (T1505.003) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.

ATT&CK sub-technique profile · Advanced

Wi-Fi Discovery (T1016.002)

Wi-Fi Discovery (T1016.002) is an Enterprise ATT&CK sub-technique under System Network Configuration Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.

ATT&CK technique profile · Intermediate

Wi-Fi Networks (T1669)

Wi-Fi Networks (T1669) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK sub-technique profile · Advanced

Windows Command Shell (T1059.003)

Windows Command Shell (T1059.003) is an Enterprise ATT&CK sub-technique under Command and Scripting Interpreter. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK sub-technique profile · Advanced

Windows Credential Manager (T1555.004)

Windows Credential Manager (T1555.004) is an Enterprise ATT&CK sub-technique under Credentials from Password Stores. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Credential Access context.

ATT&CK sub-technique profile · Advanced

Windows Host Firewall (T1686.003)

Windows Host Firewall (T1686.003) is an Enterprise ATT&CK sub-technique under Disable or Modify System Firewall. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK technique profile · Intermediate

Windows Management Instrumentation (T1047)

An adversary uses Windows Management Instrumentation to query, execute, configure, or remotely manage Windows systems.

ATT&CK sub-technique profile · Advanced

Windows Management Instrumentation Event Subscription (T1546.003)

Windows Management Instrumentation Event Subscription (T1546.003) is an Enterprise ATT&CK sub-technique under Event Triggered Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Privilege Escalation, Persistence context.

ATT&CK sub-technique profile · Advanced

Windows Permissions (T1222.001)

Windows Permissions (T1222.001) is an Enterprise ATT&CK sub-technique under File and Directory Permissions Modification. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Defense Impairment context.

ATT&CK sub-technique profile · Advanced

Windows Remote Management (T1021.006)

Windows Remote Management (T1021.006) is an Enterprise ATT&CK sub-technique under Remote Services. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Lateral Movement context.

ATT&CK sub-technique profile · Advanced

Windows Service (T1543.003)

Windows Service (T1543.003) is an Enterprise ATT&CK sub-technique under Create or Modify System Process. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Winlogon Helper DLL (T1547.004)

Winlogon Helper DLL (T1547.004) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

Wordlist Scanning (T1595.003)

Wordlist Scanning (T1595.003) is an Enterprise ATT&CK sub-technique under Active Scanning. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Reconnaissance context.

ATT&CK sub-technique profile · Advanced

Written Content (T1683.001)

Written Content (T1683.001) is an Enterprise ATT&CK sub-technique under Generate Content. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Resource Development context.

ATT&CK sub-technique profile · Advanced

XDG Autostart Entries (T1547.013)

XDG Autostart Entries (T1547.013) is an Enterprise ATT&CK sub-technique under Boot or Logon Autostart Execution. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence, Privilege Escalation context.

ATT&CK sub-technique profile · Advanced

XPC Services (T1559.003)

XPC Services (T1559.003) is an Enterprise ATT&CK sub-technique under Inter-Process Communication. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Execution context.

ATT&CK technique profile · Intermediate

XSL Script Processing (T1220)

XSL Script Processing (T1220) is an Enterprise ATT&CK technique associated with Stealth. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.

ATT&CK Group Analysis · Intermediate

admin@338 (G0018)

A defensive guide to the Enterprise ATT&CK activity-cluster record G0018, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing a China-based activity cluster reported against organizations involved in financial, economic, and trade policy, often using publicly available remote-access tools.

ATT&CK Software Analysis · Intermediate

at (S0110)

A defensive guide to the Enterprise ATT&CK software record S0110, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a task-scheduling utility available on several operating systems.

ATT&CK Software Analysis · Intermediate

attrib (S1176)

A defensive guide to the Enterprise ATT&CK software record S1176, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing a Windows utility that displays or changes file and directory attributes.

ATT&CK sub-technique profile · Advanced

vSphere Installation Bundles (T1505.006)

vSphere Installation Bundles (T1505.006) is an Enterprise ATT&CK sub-technique under Server Software Component. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Persistence context.