Techniques
How an adversary achieves a tactical goal.
227 entries (top-level; sub-techniques are listed on each technique).
- T1571 Non-Standard Port
- T1572 Protocol Tunneling
- T1573 Encrypted Channel +2 sub
- T1574 Hijack Execution Flow +12 sub
- T1578 Modify Cloud Compute Infrastructure +5 sub
- T1580 Cloud Infrastructure Discovery
- T1583 Acquire Infrastructure +8 sub
- T1584 Compromise Infrastructure +8 sub
- T1585 Establish Accounts +3 sub
- T1586 Compromise Accounts +3 sub
- T1587 Develop Capabilities +4 sub
- T1588 Obtain Capabilities +7 sub
- T1589 Gather Victim Identity Information +3 sub
- T1590 Gather Victim Network Information +6 sub
- T1591 Gather Victim Org Information +4 sub
- T1592 Gather Victim Host Information +4 sub
- T1593 Search Open Websites/Domains +3 sub
- T1594 Search Victim-Owned Websites
- T1595 Active Scanning +3 sub
- T1596 Search Open Technical Databases +5 sub
- T1597 Search Closed Sources +2 sub
- T1598 Phishing for Information +4 sub
- T1599 Network Boundary Bridging +1 sub
- T1600 Weaken Encryption +2 sub
- T1601 Modify System Image +2 sub
- T1602 Data from Configuration Repository +2 sub
- T1606 Forge Web Credentials +2 sub
- T1608 Stage Capabilities +7 sub
- T1609 Container Administration Command
- T1610 Deploy Container
- T1611 Escape to Host
- T1612 Build Image on Host
- T1613 Container and Resource Discovery
- T1614 System Location Discovery +1 sub
- T1615 Group Policy Discovery
- T1619 Cloud Storage Object Discovery
- T1620 Reflective Code Loading
- T1621 Multi-Factor Authentication Request Generation
- T1622 Debugger Evasion
- T1647 Plist File Modification
- T1648 Serverless Execution
- T1649 Steal or Forge Authentication Certificates
- T1650 Acquire Access
- T1651 Cloud Administration Command
- T1652 Device Driver Discovery
- T1653 Power Settings
- T1654 Log Enumeration
- T1657 Financial Theft
- T1659 Content Injection
- T1665 Hide Infrastructure