Standoff 13 main stage

MITRE ATT&CK

Version: ATT&CK v17.1Cyber exercise: Standoff 13 main stage

The MITRE ATT&CK matrix describes tactics and techniques used by adversaries in cyberattacks. Applying and researching these methods helps in assessing vulnerabilities and developing strategies to protect information systems. When designing tasks for this cyberbattle, we included the ability to use 73% of the techniques from the matrix. However, experienced attackers can go beyond them and employ other methods, enabling defenders to enhance their skills by investigating a wider range of cyberattacks. Explore the table below to learn about the techniques covered on the platform, implemented by attackers, and identified by defenders. If you want to try out and analyze even more attack techniques, join the online cyberrange and practice 24/7/365.

Initial Access

T1078

Valid Accounts

4 sub-techniques

T1091

Replication Through Removable Media

T1133

External Remote Services

T1189

Drive-by Compromise

T1190

Exploit Public-Facing Application

T1195

Supply Chain Compromise

3 sub-techniques

T1199

Trusted Relationship

T1200

Hardware Additions

T1566

Phishing

4 sub-techniques

T1659

Content Injection

T1669

Wi-Fi Networks

Execution

T1047

Windows Management Instrumentation

T1053

Scheduled Task/Job

5 sub-techniques

T1059

Command and Scripting Interpreter

12 sub-techniques

T1072

Software Deployment Tools

T1106

Native API

T1129

Shared Modules

T1203

Exploitation for Client Execution

T1204

User Execution

4 sub-techniques

T1559

Inter-Process Communication

3 sub-techniques

T1569

System Services

3 sub-techniques

T1609

Container Administration Command

T1610

Deploy Container

T1648

Serverless Execution

T1651

Cloud Administration Command

T1674

Input Injection

T1675

ESXi Administration Command

Persistence

T1037

Boot or Logon Initialization Scripts

5 sub-techniques

T1053

Scheduled Task/Job

5 sub-techniques

T1078

Valid Accounts

4 sub-techniques

T1098

Account Manipulation

7 sub-techniques

T1112

Modify Registry

T1133

External Remote Services

T1136

Create Account

3 sub-techniques

T1137

Office Application Startup

6 sub-techniques

T1176

Software Extensions

2 sub-techniques

T1197

BITS Jobs

T1205

Traffic Signaling

2 sub-techniques

T1505

Server Software Component

6 sub-techniques

T1525

Implant Internal Image

T1542

Pre-OS Boot

5 sub-techniques

T1543

Create or Modify System Process

5 sub-techniques

T1546

Event Triggered Execution

17 sub-techniques

T1547

Boot or Logon Autostart Execution

14 sub-techniques

T1554

Compromise Host Software Binary

T1556

Modify Authentication Process

9 sub-techniques

T1574

Hijack Execution Flow

12 sub-techniques

T1653

Power Settings

T1668

Exclusive Control

T1671

Cloud Application Integration

Privilege Escalation

T1037

Boot or Logon Initialization Scripts

5 sub-techniques

T1053

Scheduled Task/Job

5 sub-techniques

T1055

Process Injection

12 sub-techniques

T1068

Exploitation for Privilege Escalation

T1078

Valid Accounts

4 sub-techniques

T1098

Account Manipulation

7 sub-techniques

T1134

Access Token Manipulation

5 sub-techniques

T1484

Domain or Tenant Policy Modification

2 sub-techniques

T1543

Create or Modify System Process

5 sub-techniques

T1546

Event Triggered Execution

17 sub-techniques

T1547

Boot or Logon Autostart Execution

14 sub-techniques

T1548

Abuse Elevation Control Mechanism

6 sub-techniques

T1574

Hijack Execution Flow

12 sub-techniques

T1611

Escape to Host

Defense Evasion

T1006

Direct Volume Access

T1014

Rootkit

T1027

Obfuscated Files or Information

17 sub-techniques

T1036

Masquerading

11 sub-techniques

T1055

Process Injection

12 sub-techniques

T1070

Indicator Removal

10 sub-techniques

T1078

Valid Accounts

4 sub-techniques

T1112

Modify Registry

T1127

Trusted Developer Utilities Proxy Execution

3 sub-techniques

T1134

Access Token Manipulation

5 sub-techniques

T1140

Deobfuscate/Decode Files or Information

T1197

BITS Jobs

T1202

Indirect Command Execution

T1205

Traffic Signaling

2 sub-techniques

T1207

Rogue Domain Controller

T1211

Exploitation for Defense Evasion

T1216

System Script Proxy Execution

2 sub-techniques

T1218

System Binary Proxy Execution

14 sub-techniques

T1220

XSL Script Processing

T1221

Template Injection

T1222

File and Directory Permissions Modification

2 sub-techniques

T1480

Execution Guardrails

2 sub-techniques

T1484

Domain or Tenant Policy Modification

2 sub-techniques

T1497

Virtualization/Sandbox Evasion

3 sub-techniques

T1535

Unused/Unsupported Cloud Regions

T1542

Pre-OS Boot

5 sub-techniques

T1548

Abuse Elevation Control Mechanism

6 sub-techniques

T1550

Use Alternate Authentication Material

4 sub-techniques

T1553

Subvert Trust Controls

6 sub-techniques

T1556

Modify Authentication Process

9 sub-techniques

T1562

Impair Defenses

11 sub-techniques

T1564

Hide Artifacts

14 sub-techniques

T1574

Hijack Execution Flow

12 sub-techniques

T1578

Modify Cloud Compute Infrastructure

5 sub-techniques

T1599

Network Boundary Bridging

1 sub-technique

T1600

Weaken Encryption

2 sub-techniques

T1601

Modify System Image

2 sub-techniques

T1610

Deploy Container

T1612

Build Image on Host

T1620

Reflective Code Loading

T1622

Debugger Evasion

T1647

Plist File Modification

T1656

Impersonation

T1666

Modify Cloud Resource Hierarchy

T1672

Email Spoofing

Credential Access

T1003

OS Credential Dumping

8 sub-techniques

T1040

Network Sniffing

T1056

Input Capture

4 sub-techniques

T1110

Brute Force

4 sub-techniques

T1111

Multi-Factor Authentication Interception

T1187

Forced Authentication

T1212

Exploitation for Credential Access

T1528

Steal Application Access Token

T1539

Steal Web Session Cookie

T1552

Unsecured Credentials

8 sub-techniques

T1555

Credentials from Password Stores

6 sub-techniques

T1556

Modify Authentication Process

9 sub-techniques

T1557

Adversary-in-the-Middle

4 sub-techniques

T1558

Steal or Forge Kerberos Tickets

5 sub-techniques

T1606

Forge Web Credentials

2 sub-techniques

T1621

Multi-Factor Authentication Request Generation

T1649

Steal or Forge Authentication Certificates

Discovery

T1007

System Service Discovery

T1010

Application Window Discovery

T1012

Query Registry

T1016

System Network Configuration Discovery

2 sub-techniques

T1018

Remote System Discovery

T1033

System Owner/User Discovery

T1040

Network Sniffing

T1046

Network Service Discovery

T1049

System Network Connections Discovery

T1057

Process Discovery

T1069

Permission Groups Discovery

3 sub-techniques

T1082

System Information Discovery

T1083

File and Directory Discovery

T1087

Account Discovery

4 sub-techniques

T1120

Peripheral Device Discovery

T1124

System Time Discovery

T1135

Network Share Discovery

T1201

Password Policy Discovery

T1217

Browser Information Discovery

T1482

Domain Trust Discovery

T1497

Virtualization/Sandbox Evasion

3 sub-techniques

T1518

Software Discovery

1 sub-technique

T1526

Cloud Service Discovery

T1538

Cloud Service Dashboard

T1580

Cloud Infrastructure Discovery

T1613

Container and Resource Discovery

T1614

System Location Discovery

1 sub-technique

T1615

Group Policy Discovery

T1619

Cloud Storage Object Discovery

T1622

Debugger Evasion

T1652

Device Driver Discovery

T1654

Log Enumeration

T1673

Virtual Machine Discovery

Lateral Movement

T1021

Remote Services

8 sub-techniques

T1072

Software Deployment Tools

T1080

Taint Shared Content

T1091

Replication Through Removable Media

T1210

Exploitation of Remote Services

T1534

Internal Spearphishing

T1550

Use Alternate Authentication Material

4 sub-techniques

T1563

Remote Service Session Hijacking

2 sub-techniques

T1570

Lateral Tool Transfer

Collection

T1005

Data from Local System

T1025

Data from Removable Media

T1039

Data from Network Shared Drive

T1056

Input Capture

4 sub-techniques

T1074

Data Staged

2 sub-techniques

T1113

Screen Capture

T1114

Email Collection

3 sub-techniques

T1115

Clipboard Data

T1119

Automated Collection

T1123

Audio Capture

T1125

Video Capture

T1185

Browser Session Hijacking

T1213

Data from Information Repositories

5 sub-techniques

T1530

Data from Cloud Storage

T1557

Adversary-in-the-Middle

4 sub-techniques

T1560

Archive Collected Data

3 sub-techniques

T1602

Data from Configuration Repository

2 sub-techniques
Exfiltration

T1011

Exfiltration Over Other Network Medium

1 sub-technique

T1020

Automated Exfiltration

1 sub-technique

T1029

Scheduled Transfer

T1030

Data Transfer Size Limits

T1041

Exfiltration Over C2 Channel

T1048

Exfiltration Over Alternative Protocol

3 sub-techniques

T1052

Exfiltration Over Physical Medium

1 sub-technique

T1537

Transfer Data to Cloud Account

T1567

Exfiltration Over Web Service

4 sub-techniques
Command and Control

T1001

Data Obfuscation

3 sub-techniques

T1008

Fallback Channels

T1071

Application Layer Protocol

5 sub-techniques

T1090

Proxy

4 sub-techniques

T1092

Communication Through Removable Media

T1095

Non-Application Layer Protocol

T1102

Web Service

3 sub-techniques

T1104

Multi-Stage Channels

T1105

Ingress Tool Transfer

T1132

Data Encoding

2 sub-techniques

T1205

Traffic Signaling

2 sub-techniques

T1219

Remote Access Tools

3 sub-techniques

T1568

Dynamic Resolution

3 sub-techniques

T1571

Non-Standard Port

T1572

Protocol Tunneling

T1573

Encrypted Channel

2 sub-techniques

T1659

Content Injection

T1665

Hide Infrastructure

Impact

T1485

Data Destruction

1 sub-technique

T1486

Data Encrypted for Impact

T1489

Service Stop

T1490

Inhibit System Recovery

T1491

Defacement

2 sub-techniques

T1495

Firmware Corruption

T1496

Resource Hijacking

4 sub-techniques

T1498

Network Denial of Service

2 sub-techniques

T1499

Endpoint Denial of Service

4 sub-techniques

T1529

System Shutdown/Reboot

T1531

Account Access Removal

T1561

Disk Wipe

2 sub-techniques

T1565

Data Manipulation

3 sub-techniques

T1657

Financial Theft

T1667

Email Bombing

Resource Development

T1583

Acquire Infrastructure

8 sub-techniques

T1584

Compromise Infrastructure

8 sub-techniques

T1585

Establish Accounts

3 sub-techniques

T1586

Compromise Accounts

3 sub-techniques

T1587

Develop Capabilities

4 sub-techniques

T1588

Obtain Capabilities

7 sub-techniques

T1608

Stage Capabilities

6 sub-techniques

T1650

Acquire Access

Reconnaissance

T1589

Gather Victim Identity Information

3 sub-techniques

T1590

Gather Victim Network Information

6 sub-techniques

T1591

Gather Victim Org Information

4 sub-techniques

T1592

Gather Victim Host Information

4 sub-techniques

T1593

Search Open Websites/Domains

3 sub-techniques

T1594

Search Victim-Owned Websites

T1595

Active Scanning

3 sub-techniques

T1596

Search Open Technical Databases

5 sub-techniques

T1597

Search Closed Sources

2 sub-techniques

T1598

Phishing for Information

4 sub-techniques