T1078
Valid Accounts
Version: ATT&CK v17.1Cyber exercise: Standoff 13 main stage
The MITRE ATT&CK matrix describes tactics and techniques used by adversaries in cyberattacks. Applying and researching these methods helps in assessing vulnerabilities and developing strategies to protect information systems. When designing tasks for this cyberbattle, we included the ability to use 73% of the techniques from the matrix. However, experienced attackers can go beyond them and employ other methods, enabling defenders to enhance their skills by investigating a wider range of cyberattacks. Explore the table below to learn about the techniques covered on the platform, implemented by attackers, and identified by defenders. If you want to try out and analyze even more attack techniques, join the online cyberrange and practice 24/7/365.
Valid Accounts
Replication Through Removable Media
External Remote Services
Drive-by Compromise
Exploit Public-Facing Application
Supply Chain Compromise
Trusted Relationship
Hardware Additions
Phishing
Content Injection
Wi-Fi Networks
Windows Management Instrumentation
Scheduled Task/Job
Command and Scripting Interpreter
Software Deployment Tools
Native API
Shared Modules
Exploitation for Client Execution
User Execution
Inter-Process Communication
System Services
Container Administration Command
Deploy Container
Serverless Execution
Cloud Administration Command
Input Injection
ESXi Administration Command
Boot or Logon Initialization Scripts
Scheduled Task/Job
Valid Accounts
Account Manipulation
Modify Registry
External Remote Services
Create Account
Office Application Startup
Software Extensions
BITS Jobs
Traffic Signaling
Server Software Component
Implant Internal Image
Pre-OS Boot
Create or Modify System Process
Event Triggered Execution
Boot or Logon Autostart Execution
Compromise Host Software Binary
Modify Authentication Process
Hijack Execution Flow
Power Settings
Exclusive Control
Cloud Application Integration
Boot or Logon Initialization Scripts
Scheduled Task/Job
Process Injection
Exploitation for Privilege Escalation
Valid Accounts
Account Manipulation
Access Token Manipulation
Domain or Tenant Policy Modification
Create or Modify System Process
Event Triggered Execution
Boot or Logon Autostart Execution
Abuse Elevation Control Mechanism
Hijack Execution Flow
Escape to Host
Direct Volume Access
Rootkit
Obfuscated Files or Information
Masquerading
Process Injection
Indicator Removal
Valid Accounts
Modify Registry
Trusted Developer Utilities Proxy Execution
Access Token Manipulation
Deobfuscate/Decode Files or Information
BITS Jobs
Indirect Command Execution
Traffic Signaling
Rogue Domain Controller
Exploitation for Defense Evasion
System Script Proxy Execution
System Binary Proxy Execution
XSL Script Processing
Template Injection
File and Directory Permissions Modification
Execution Guardrails
Domain or Tenant Policy Modification
Virtualization/Sandbox Evasion
Unused/Unsupported Cloud Regions
Pre-OS Boot
Abuse Elevation Control Mechanism
Use Alternate Authentication Material
Subvert Trust Controls
Modify Authentication Process
Impair Defenses
Hide Artifacts
Hijack Execution Flow
Modify Cloud Compute Infrastructure
Network Boundary Bridging
Weaken Encryption
Modify System Image
Deploy Container
Build Image on Host
Reflective Code Loading
Debugger Evasion
Plist File Modification
Impersonation
Modify Cloud Resource Hierarchy
Email Spoofing
OS Credential Dumping
Network Sniffing
Input Capture
Brute Force
Multi-Factor Authentication Interception
Forced Authentication
Exploitation for Credential Access
Steal Application Access Token
Steal Web Session Cookie
Unsecured Credentials
Credentials from Password Stores
Modify Authentication Process
Adversary-in-the-Middle
Steal or Forge Kerberos Tickets
Forge Web Credentials
Multi-Factor Authentication Request Generation
Steal or Forge Authentication Certificates
System Service Discovery
Application Window Discovery
Query Registry
System Network Configuration Discovery
Remote System Discovery
System Owner/User Discovery
Network Sniffing
Network Service Discovery
System Network Connections Discovery
Process Discovery
Permission Groups Discovery
System Information Discovery
File and Directory Discovery
Account Discovery
Peripheral Device Discovery
System Time Discovery
Network Share Discovery
Password Policy Discovery
Browser Information Discovery
Domain Trust Discovery
Virtualization/Sandbox Evasion
Software Discovery
Cloud Service Discovery
Cloud Service Dashboard
Cloud Infrastructure Discovery
Container and Resource Discovery
System Location Discovery
Group Policy Discovery
Cloud Storage Object Discovery
Debugger Evasion
Device Driver Discovery
Log Enumeration
Virtual Machine Discovery
Remote Services
Software Deployment Tools
Taint Shared Content
Replication Through Removable Media
Exploitation of Remote Services
Internal Spearphishing
Use Alternate Authentication Material
Remote Service Session Hijacking
Lateral Tool Transfer
Data from Local System
Data from Removable Media
Data from Network Shared Drive
Input Capture
Data Staged
Screen Capture
Email Collection
Clipboard Data
Automated Collection
Audio Capture
Video Capture
Browser Session Hijacking
Data from Information Repositories
Data from Cloud Storage
Adversary-in-the-Middle
Archive Collected Data
Data from Configuration Repository
Exfiltration Over Other Network Medium
Automated Exfiltration
Scheduled Transfer
Data Transfer Size Limits
Exfiltration Over C2 Channel
Exfiltration Over Alternative Protocol
Exfiltration Over Physical Medium
Transfer Data to Cloud Account
Exfiltration Over Web Service
Data Obfuscation
Fallback Channels
Application Layer Protocol
Proxy
Communication Through Removable Media
Non-Application Layer Protocol
Web Service
Multi-Stage Channels
Ingress Tool Transfer
Data Encoding
Traffic Signaling
Remote Access Tools
Dynamic Resolution
Non-Standard Port
Protocol Tunneling
Encrypted Channel
Content Injection
Hide Infrastructure
Data Destruction
Data Encrypted for Impact
Service Stop
Inhibit System Recovery
Defacement
Firmware Corruption
Resource Hijacking
Network Denial of Service
Endpoint Denial of Service
System Shutdown/Reboot
Account Access Removal
Disk Wipe
Data Manipulation
Financial Theft
Email Bombing
Acquire Infrastructure
Compromise Infrastructure
Establish Accounts
Compromise Accounts
Develop Capabilities
Obtain Capabilities
Stage Capabilities
Acquire Access
Gather Victim Identity Information
Gather Victim Network Information
Gather Victim Org Information
Gather Victim Host Information
Search Open Websites/Domains
Search Victim-Owned Websites
Active Scanning
Search Open Technical Databases
Search Closed Sources
Phishing for Information