Loading AttackTrace...
ATT&CK tactic
56 techniques mapped to this tactic.
Modify Registry (T1112) is a MITRE ATT&CK technique associated with Defense Impairment, Persistence . Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
Rogue Domain Controller (T1207) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data.
File and Directory Permissions Modification (T1222) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions…
Windows Permissions (T1222.001) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly managed…
Linux and Mac Permissions (T1222.002) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly m…
Domain or Tenant Policy Modification (T1484) is a MITRE ATT&CK technique associated with Defense Impairment, Privilege Escalation . Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally manage…
Group Policy Modification (T1484.001) is a MITRE ATT&CK technique associated with Defense Impairment, Privilege Escalation . Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of esc…
Trust Modification (T1484.002) is a MITRE ATT&CK technique associated with Defense Impairment, Privilege Escalation . Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between do…
Subvert Trust Controls (T1553) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.
Gatekeeper Bypass (T1553.001) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs.
Code Signing (T1553.002) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.
SIP and Trust Provider Hijacking (T1553.003) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks.
Install Root Certificate (T1553.004) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.
Mark of the Web Bypass (T1553.005) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may abuse specific file formats to subvert Mark of the Web (MOTW) controls.
Code Signing Policy Modification (T1553.006) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may modify code signing policies to enable execution of unsigned or self signed code.
Modify Authentication Process (T1556) is a MITRE ATT&CK technique associated with Defense Impairment, Persistence, Credential Access . Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.
Domain Controller Authentication (T1556.001) is a MITRE ATT&CK technique associated with Defense Impairment, Persistence, Credential Access . Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable acce…
Password Filter DLL (T1556.002) is a MITRE ATT&CK technique associated with Defense Impairment, Persistence, Credential Access . Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they…
Pluggable Authentication Modules (T1556.003) is a MITRE ATT&CK technique associated with Defense Impairment, Persistence, Credential Access . Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to acco…
Network Device Authentication (T1556.004) is a MITRE ATT&CK technique associated with Defense Impairment, Persistence, Credential Access . Adversaries may use Patch System Image to hard code a password in the operating system, thus bypassing of native authentication mechanisms…
Reversible Encryption (T1556.005) is a MITRE ATT&CK technique associated with Defense Impairment, Persistence, Credential Access . An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems.
Multi Factor Authentication (T1556.006) is a MITRE ATT&CK technique associated with Defense Impairment, Persistence, Credential Access . Adversaries may disable or modify multi factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Hybrid Identity (T1556.007) is a MITRE ATT&CK technique associated with Defense Impairment, Persistence, Credential Access . Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on premises user identities in order to bypass typi…
Network Provider DLL (T1556.008) is a MITRE ATT&CK technique associated with Defense Impairment, Persistence, Credential Access . Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication p…
Conditional Access Policies (T1556.009) is a MITRE ATT&CK technique associated with Defense Impairment, Persistence, Credential Access . Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts.
Modify Cloud Compute Infrastructure (T1578) is a MITRE ATT&CK technique associated with Defense Impairment . An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses.
Create Snapshot (T1578.001) is a MITRE ATT&CK technique associated with Defense Impairment . An adversary may create a snapshot or data backup within a cloud account to evade defenses.
Create Cloud Instance (T1578.002) is a MITRE ATT&CK technique associated with Defense Impairment . An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses.
Delete Cloud Instance (T1578.003) is a MITRE ATT&CK technique associated with Defense Impairment . An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence.
Revert Cloud Instance (T1578.004) is a MITRE ATT&CK technique associated with Defense Impairment . An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence.
Modify Cloud Compute Configurations (T1578.005) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses.
Network Boundary Bridging (T1599) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation.
Network Address Translation Traversal (T1599.001) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may bridge network boundaries by modifying a network device’s Network Address Translation (NAT) configuration.
Weaken Encryption (T1600) is a MITRE ATT&CK technique associated with Defense Impairment . Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes).
Reduce Key Space (T1600.001) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or…
Disable Crypto Hardware (T1600.002) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involv…
Modify System Image (T1601) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves.
Patch System Image (T1601.001) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses. Some network devices are built with a monolithic architect…
Downgrade System Image (T1601.002) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may install an older version of the operating system of a network device to weaken security.
Plist File Modification (T1647) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses.
Modify Cloud Resource Hierarchy (T1666) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may attempt to modify hierarchical structures in infrastructure as a service (IaaS) environments in order to evade defenses.
Disable or Modify Tools (T1685) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, lo…
Disable or Modify Windows Event Log (T1685.001) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits.
Disable or Modify Cloud Log (T1685.002) is a MITRE ATT&CK technique associated with Defense Impairment . An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection.
Modify or Spoof Tool UI (T1685.003) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response.
Disable or Modify Linux Audit System Log (T1685.004) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may disable or modify the Linux Audit system to hide malicious activity and avoid detection.
Clear Windows Event Logs (T1685.005) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may clear Windows Event Logs to hide the activity of an intrusion.
Clear Linux or Mac System Logs (T1685.006) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may clear system logs to hide evidence of an intrusion.
Disable or Modify System Firewall (T1686) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may disable or modify host based or network firewalls to impair defensive mechanisms and enable further action.
Cloud Firewall (T1686.001) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.
Network Device Firewall (T1686.002) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may disable network device based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage.
Windows Host Firewall (T1686.003) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may disable or modify the Windows host firewall to bypass controls limiting network usage.
Exploitation for Defense Impairment (T1687) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may exploit vulnerabilities in security software, infrastructure, or defensive components to degrade, disable, or otherwise continue to impair their ability…
Safe Mode Boot (T1688) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may abuse Windows safe mode to disable endpoint defenses.
Downgrade Attack (T1689) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls.
Prevent Command History Logging (T1690) is a MITRE ATT&CK technique associated with Defense Impairment . Adversaries may impair command history logging to hide commands they run on a compromised system.