Adversary Emulation with MITRE ATT&CK

Chapter 4. The Adversary’s Modus Operandi

Modus operandi (MO) is a term widely used in law enforcement work to analyze and understand the methods criminals employ in committing an offense, including the steps they take to execute, conceal, and escape. In criminal profiling, studying MO helps to shed light on thought processes and habits by giving a deeper understanding of psychology and behavior patterns. Just like understanding MO is important in understanding the behavior patterns and thought processes of criminals in traditional law enforcement, understanding tactics are essential in cybersecurity to understanding the methods used by cybercriminals in executing attacks. Think of tactics like a sports team’s playbook: just as a football team needs to know the different plays their opponents might use, cybersecurity teams need to understand the various methods that hackers could use to attack their systems.

The primary purpose of the ATT&CK framework is to provide a helpful tool for understanding the common tactics used by cybercriminals, while also serving as a useful resource for incident response, penetration testing, and enhancing security operations. However, it’s important to remember that not every attacker will follow all the tactics listed in the framework. Cyberattacks can take many forms, and the methods used by attackers can vary greatly depending on what they’re trying to accomplish and whom they’re targeting. This means it would be hard to order the tactics in a way that would make sense for every situation. Also, many cyberattacks are carried out in stages, where the attacker will use different tactics at different times. But the order in which they use these tactics can change depending on the target, the attacker’s skills and resources, and other factors. The lack of ordering in the ATT&CK framework reflects the diversity and constant evolution of cyberattacks and instead focuses on the tactics used rather than the order (see Figure 4-1).

Figure 4-1. ATT&CK Enterprise high-level breakdown

As previously mentioned, tactics are represented by techniques and sub-techniques that provide more information on how an adversary can accomplish a tactic. The framework covers not only the Enterprise technology domain but also other areas of attack such as Mobile, Pre-Attack, Cloud, and ICS. The Enterprise model includes some of the most commonly used techniques for each tactic. At the present time, in the Enterprise technology domain, you will find 14 tactics, 193 techniques, and 401 sub-techniques.¹

Navigate to Enterprise to access all available tactics, or you can do so from the home page menu by hovering on Tactics and selecting the Enterprise field. When the content has loaded, you will see a table with the latest tactics. The three main objects (ID, Name, and Description) in the table, as seen in Figure 4-2, will guide you while engaging with the platform.

Figure 4-2. ATT&CK Enterprise tactics

The ID is a unique identifier for a tactic and is used for reference purposes, providing an easy way to communicate with external teams, primarily when different technical languages are used. It comes in handy when automating or developing new tools, letting the developer programmatically access other details of a tactic. The Name object is a short, concise description that gives an overview of the tactic. Finally, the Description provides a more in-depth explanation of the tactic, its purpose, and any relevant information. These arguments help organize and present the vast amounts of information contained within the ATT&CK platform clearly and concisely.

It is crucial to understand the mindset and techniques of adversaries in order to effectively defend against them. The next section provides an in-depth analysis of the tactics and motivations of attackers. Practical methods for combating these threats are discussed in Chapter 5.

Reconnaissance

Reconnaissance is the foundation upon which a successful cyberattack is built. It starts by gathering information about a target, including its assets, vulnerabilities, and weaknesses, to plan and execute an attack. This crucial phase of a cyberattack provides the adversary with the information they need to tailor their operation, increasing their chances of success. Reconnaissance can be performed passively and actively, involving port scanning, vulnerability scanning, social engineering, or through the use of tools and platforms, such as search engines, social media platforms, and databases.

Give me six hours to chop down a tree, and I will spend the first four sharpening the axe.

Abraham Lincoln

As the quote suggests, investing time and effort in proper preparation and reconnaissance can lead to more efficient and effective results in the long run. Like sharpening the axe, reconnaissance is a critical step in the attack process because, in the absence of proper reconnaissance, an attacker might waste time and resources trying to penetrate a target that is not vulnerable or not worth attacking. In the same way that an axe must be sharpened to perfection, the information gathered during reconnaissance must be accurate and up to date.

Passive reconnaissance means that all the operations are performed indirectly without interfering with the target. It is essential because it will provide the adversary with information to help construct other actions in later stages. Instead of just attacking, the adversary will use open source intelligence (OSINT) techniques or public data such as password dumps to achieve initial compromise. Using platforms like Shodan, the adversary can search for public-facing infrastructures or potential vulnerabilities identified by the platform. Shodan has many widely used features, including port and vulnerability scanning and service detection, that do not require the user to interact directly with the target. It is time-consuming, as it requires the attacker to comb through numerous sources to gather all of the relevant information. However, it is also the least risky, because the attacker is not directly interacting with the target and leaving traces of their presence, which is characteristic of an APT behavior.

When executing red team engagement, I search job listings for any open position to join the client’s company, because this process is generally handled through an external partner or service. You will find information on what programing language they use, software, operating systems, and other information that can help map the technology stack.

Reconnaissance with Shodan

Shodan is a search engine for internet-connected devices and networks. It allows users to find specific types of devices and collect data from them, such as open ports and IP addresses. While it has legitimate uses, it has also been used by malicious actors for nefarious purposes.

Active reconnaissance is proactive effort made by an attacker to gather information about a target system, network, or organization. Unlike passive reconnaissance, which involves gathering information from public sources, active reconnaissance requires direct interaction with the target. It can involve network scanning, port scanning, and vulnerability assessment using a variety of tools and solutions. The goal is to gather enough information to create a complete picture of the target and to identify weaknesses that can be exploited later on. One of the most common methods of active reconnaissance is network scanning, which involves sending packets to various hosts on a target network to gather information about its open ports, services, and operating systems.

Vulnerability assessment is another important aspect of reconnaissance because the attacker can use tools and techniques to identify security weaknesses in a target system. It can include identifying known vulnerabilities in software and hardware, checking for misconfigurations, and evaluating the effectiveness of security controls. The results of a vulnerability assessment can be used to prioritize areas for attack and to develop a plan for exploitation. It is important to note that vulnerability assessment can be detected by security systems and is generally a sign of an ongoing attack.

When looking for details about the internal infrastructure or technologies of a target company, it is possible that an adversary may apply for a job position and participate in the interview process. During the interview, the adversary may engage in reconnaissance activities and attempt to gather valuable intelligence based on the questions asked.

It is important to note that reconnaissance can occur at any stage in the attack life cycle, and the information gathered during this phase can be used throughout the attack. The Reconnaissance technique was introduced into the framework in 2020 with the identifier TA0043, and since then, it has been updated with 10 techniques, including Hardware, Network Topology, and more, some of which are discussed next.

Note

Techniques and sub-techniques are not step-by-step procedures for how an adversary accomplishes a specific tactic. Chapter 5 explores the in-the-wild use of some of these techniques at the atomic level, showing the exact commands observed and reported in the real world.

Active Scanning (T1595)

The MITRE ATT&CK framework is a widely used knowledge base that categorizes various tactics and techniques cyberattackers use during their campaigns. One such tactic is active reconnaissance, which involves probing a victim’s network through direct interaction. Cyberattackers may conduct reconnaissance scans to gather the information they can use to target their victims. These scans differ from passive approaches that don’t involve direct interaction. During active scanning, the adversary sends network traffic to the target and analyzes the responses, which can provide valuable information about the target’s configurations, vulnerabilities, and services. This information can help the adversary identify potential entry points into the target network and determine the best approach for compromising the target. Table 4-1 lists the sub-techniques associated with Active Scanning in the framework.

Table 4-1. Active Scanning sub-techniques

ID	Name	Created
T1595.001	Scanning IP Blocks	02 October 2020
T1595.002	Vulnerability Scanning	02 October 2020
T1595.003	Wordlist Scanning	04 March 2022

Gather Victim Identity Information (T1589)

Adversaries may try to gather information about the target’s identity to use during the attack, including personal data like names and email addresses or sensitive information like login credentials. This information can be collected in several ways, such as by sending phishing emails to trick people into giving them information, probing and analyzing responses from authentication services, or finding information online on social media or other websites. Information such as account credentials may be directly associated with the target victim organization, or adversaries may attempt to take advantage of the reuse of passwords in work and private life. Table 4-2 lists the sub-techniques associated with Gather Victim Identity Information in the framework.

Table 4-2. Gather Victim Identity Information sub-techniques

ID	Name	Created
T1589.001	Credentials	02 October 2020
T1589.002	Email Addresses	02 October 2020
T1589.003	Employee Names	02 October 2020

Search Closed Sources (T1597)

To target a victim, attackers may search for and gather information from closed sources in cases where such information is not publicly available and can be obtained by purchasing it from private sources, such as threat intelligence platforms or dark web black markets. For example, they may seek personal information about individuals within the target organization, such as names, email addresses, or login credentials. They may also gather information about the target’s technology infrastructure, including hardware and software configurations, network topologies, and other technical details. Table 4-3 lists the sub-techniques associated with Search Closed Sources in the framework.

Table 4-3. Search Closed Sources sub-techniques

ID	Name	Created
T1597.001	Threat Intel Vendors	02 October 2020
T1597.002	Purchase Technical Data	02 October 2020

Resource Development

As new technologies and systems are developed, adversaries are quickly finding ways to exploit or weaponize them. The goal of resource development is to gain knowledge of the resources that adversaries use to create cyber weapons as well as the methods they use to acquire them, including tools from the black market that exploit software and system vulnerabilities. Some common resources are malicious software, command and control (C2) servers, and infected machines. Malicious software, such as malware, is used to carry out various functions, such as data theft, information exfiltration, and disruption of operations. C2 servers are used to control the infected machines and carry out attacks.

Imagine a criminal trying to rob a bank. They wouldn’t just walk in empty-handed and expect to be successful. They would need resources, such as a mask to conceal their identity, a getaway car, and tools to break into the vault. In a similar fashion, cybercriminals might build a network of computers to control or purchase resources on the dark web, such as a list of email addresses for phishing. They might even compromise legitimate resources, such as stealing a company’s code signing certificates to bypass security measures.

Effective resource development requires a comprehensive understanding of the available resources and the ability to optimize their use to meet the operation’s needs. It’s like putting together a puzzle where you need to have all the parts in the right place or the picture won’t be complete. The Resource Development tactic was introduced into the framework on September 30, 2020, with the identifier TA0042, and since then, seven techniques have been added, some of which are discussed next.

Acquire Infrastructure (T1583)

Just like a handyman needs a toolbox, adversaries need infrastructure to achieve their objectives. To be successful, adversaries need the right tools—servers, domains, and other resources they must use to carry out the plan. Threat actors can easily acquire the necessary infrastructure by buying, leasing, or renting. With access to physical or cloud servers, domains, and third-party web services, they have a wide variety of options to choose from. Having the proper infrastructure allows adversaries to stage, launch, and execute their operations efficiently. They can blend in with regular online traffic, making it difficult for others to detect their activities. And because they can quickly provision, modify, and shut down their infrastructure as needed, they can promptly abort a mission and move on to the next target.

In today’s digital landscape, having the proper infrastructure is critical for any adversary who wants to achieve their objectives. Whether they are looking to do harm, steal sensitive information, or cause chaos, the proper infrastructure gives them the power to succeed. In simple terms, it can be difficult to stop this technique because it takes place outside of the company’s protection and control. As a result, preventive measures may not be effective in stopping it. Table 4-4 lists the sub-techniques associated with Acquire Infrastructure in the framework.

Table 4-4. Acquire Infrastructure sub-techniques

ID	Name	Created
T1583.001	Domains	30 September 2020
T1583.002	DNS Server	01 October 2020
T1583.003	Virtual Private Server	01 October 2020
T1583.004	Server	01 October 2020
T1583.005	Botnet	01 October 2020
T1583.006	Web Services	01 October 2020
T1583.007	Serverless	08 July 2022

Develop Capabilities (T1587)

Instead of buying or stealing tools, threat actors may choose to build them themselves. This could include creating malware, exploits, or even their own certificates to support their operations at different stages of their plan. Of course, building anything requires different skills and abilities, but making these tools requires specific knowledge and expertise. Adversaries may have these skills in-house, or they may hire outside help. Even if they choose to hire someone, they may have control and play a role in shaping what they need the tool to do , as well as making it exclusively for their own use. Table 4-5 lists the sub-techniques associated with Develop Capabilities in the framework.

Table 4-5. Develop Capabilities sub-techniques

ID	Name	Created
T1587.001	Malware	01 October 2020
T1587.002	Code Signing Certificates	01 October 2020
T1587.003	Digital Certificates	01 October 2020
T1587.004	Exploits	01 October 2020

Establish Accounts (T1585)

Establish Accounts is a technique that encompasses actions taken by adversaries to create and cultivate accounts with various online services and platforms. They may use public information to build an identity with a fake history in order to make their actions seem more legitimate. This is essential for social engineering operations, as they may use this phony identity to interact with others and gather information. Creating these fake personas could also involve filling out profiles, building social networks, and adding photos to make them seem real. Adversaries may also create accounts with email providers, which can be directly used for phishing attacks, where they try to trick people into giving away sensitive information. Table 4-6 lists the sub-techniques associated with Establish Accounts in the framework.

Table 4-6. Establish Accounts sub-techniques

ID	Name	Created
T1585.001	Social Media Accounts	01 October 2020
T1585.002	Email Accounts	01 October 2020
T1585.003	Cloud Accounts	27 May 2022

Initial Access

Initial access is a term used in cybersecurity to describe the first point of entry that an adversary gains into a target system or network. This can be accomplished through various methods, including exploiting vulnerabilities in software or hardware, tricking individuals into giving away their login credentials, or physically accessing a device and installing malware. For example, an attacker may trick an individual into downloading a malicious file or clicking on a malicious link, giving the attacker access to the target system or network. However, the access they gain during initial access may be short-lived if the target changes their passwords or otherwise limits the attackers’ abilities.

The first step in a successful theft is gaining entry into the building where the valuable items are stored. To do this, the robber must identify and exploit weaknesses in the building’s security, such as an unlocked window or door. Once they have gained entry, they can start looking for valuable items and plan their next steps to obtain them.

In the same way, cybercriminals must first gain entry into a target network to carry out their plans. They look for vulnerabilities in the network’s defenses, such as a weak web server, and use these weaknesses to gain their initial foothold. Once inside, they can move around the network, searching for valuable data or systems to target. Initial Access was introduced into the framework on October 17, 2018, with the identifier TA0001, and since then, it has been updated with a total of nine techniques, some of which are discussed next.

Drive-by Compromise (T1189)

Imagine browsing the internet, visiting different websites as you usually do, and you come across a website that looks legitimate and trustworthy. But little do you know, the system has been compromised, and malicious content has been injected into the website.

As soon as you visit the link, the malicious code automatically starts running on your browser, exploiting any known vulnerability it targets. It scans the different versions of your browser and plug-ins, and if it finds any weak point, it will then deliver the exploit code to your browser. The exploit code can then potentially give the attacker access to your system. Sometimes, the compromised website may also be used to deliver malicious applications that steal access tokens, such as OAuth security credentials. These tokens give the attacker access to restricted applications and information, like online account data and other sensitive information. The typical drive-by compromise process is a dangerous way for threat actors to access a user’s system. Here’s how it works:

1. A user visits a website that an adversary controls, which may look legitimate and trustworthy but contains malicious code.

2. As soon as the user visits the website, the scripts on the website automatically start to run on the user’s browser. These scripts scan the different browser versions and plug-ins, looking for any vulnerabilities.

3. The user may be asked to assist in this process by enabling scripting or active website components or ignoring warning dialog boxes on their screen.

4. If a vulnerable version is found, the exploit code is delivered to the browser; this gives the adversary control of the user’s system.

Exploit Public-Facing Application (T1190)

When you use the internet, there are often computers and programs that anyone with an internet connection can access (known as public-facing applications). Unfortunately, there may be weaknesses in these systems that can be taken advantage of by malicious actors. Bugs, glitches, or design flaws in the system can cause these weaknesses, resulting in attackers commonly targeting websites and databases, standard services like SMB or SSH, and network device administration and management protocols like SNMP. When these systems are hosted on cloud-based infrastructure or in containers, exploiting them can compromise the underlying infrastructure, giving the attacker a path to access sensitive data.

Phishing (T1566)

Phishing is a type of cyberattack that aims to steal sensitive information or compromise computer systems. Adversaries conduct phishing attacks by sending electronic messages, such as emails or instant messages, that appear to be from a trustworthy source. These messages are designed to trick the recipient into clicking on a malicious link or downloading a malicious attachment, which can then be used to steal sensitive information or install malware on the recipient’s computer.

Targeted phishing, also known as spearphishing, occurs when the attacker targets a particular individual, company, or industry. In these attacks, the adversary will often use personal information about the target to make the message appear more legitimate. For example, an attacker might send an email to an employee at a financial institution that seems to be from their supervisor, asking the employee to provide sensitive information or download and execute files. Nontargeted phishing, on the other hand, occurs when the attacker sends out many messages to a wide range of potential victims. These attacks often use generic messages or images and are typically sent in large-scale spam campaigns.

Phishing attacks can also occur through social media platforms, as attackers may use these platforms to send malicious messages or to create fake profiles that appear to be from trustworthy sources. Table 4-7 lists the sub-techniques associated with Phishing in the framework.

Table 4-7. Phishing sub-techniques

ID	Name	Created
T1566.001	Spearphishing Attachment	02 March 2020
T1566.002	Spearphishing Link	02 March 2020
T1566.003	Spearphishing via Service	02 March 2020

Supply Chain Compromise (T1195)

Supply chain compromise is a dangerous type of cyberattack that occurs when an adversary manipulates products or delivery mechanisms before they reach the final consumer. It can happen at any stage of the supply chain, from the development tools used to create the product to the delivery of the product to the customer.

This attack usually aims to gain control of a system or steal data, and it is often focused on adding malicious code to distributed or updated software, either targeting specific victims or distributing the code more widely. It can include replacing legitimate software with modified versions, infecting system images, or manipulating source code repositories. Table 4-8 lists the sub-techniques associated with Supply Chain Compromise in the framework.

Table 4-8. Supply Chain Compromise sub-techniques

ID	Name	Created
T1195.001	Compromise Software Dependencies and Development Tools	11 March 2020
T1195.002	Compromise Software Supply Chain	11 March 2020
T1195.003	Compromise Hardware Supply Chain	11 March 2020

Execution

The Execution tactic in the ATT&CK framework encompasses the methods that attackers use to run their code on a target system. Essentially, this is how they get their malicious software to work on their target computer.

Adversaries might take advantage of known software or operating system weaknesses, trick users into running the code themselves through phishing scams, or use scripting languages like PowerShell to run the code directly. Once the attacker has successfully executed their code, they can start to carry out their malicious goals, which include gathering information about the target system, moving laterally to other systems on the network, or exfiltrating sensitive data. The Execution tactic was introduced into the framework on October 17, 2018, with the identifier TA0002, and since then, it has been updated with a total of nine techniques, some of which are discussed next.

Command and Scripting Interpreter (T1059)

A command and scripting interpreter is a computer program that allows you to execute instructions written in a programming or scripting language without compiling them first. Interpreters make writing code more accessible and enable you to run human-readable code directly. However, this also makes them preferred tools for attackers to use in their attack campaigns.

Command interpreters, such as Windows Command Shell, PowerShell, and Unix Shell, are built-in tools in operating systems that execute user-specified commands. Scripts, on the other hand, are series of commands written in scripting languages such as PowerShell, Perl, JavaScript, and Python, which a scripting interpreter executes. While these tools are used by legitimate users such as system administrators and programmers to automate tasks, attackers often use them to run malicious code, collect information, and persist in a victim machine. The tools mentioned here, along with others, are comprehensively covered in Chapter 5.

For example, PowerShell is a popular tool used by attackers because it is a built-in utility in Windows operating systems and provides extensive access to the internals of Windows. Attackers can use it to develop fileless malware that runs entirely in memory and leave no traces on the disk. Publicly available tools like Empire and Nishang have also been developed using PowerShell and are frequently leveraged by threat actors in cyberattacks.

Similarly, AppleScript is a scripting language used for macOS that allows adversaries to interact with any application running locally or remotely. Adversaries use it to perform various tasks, such as locating open windows and transmitting keystrokes. Table 4-9 lists the sub-techniques associated with Command and Scripting Interpreter in the framework.

Table 4-9. Command and Scripting Interpreter sub-techniques

ID	Name	Created
T1059.001	PowerShell	09 March 2020
T1059.002	AppleScript	09 March 2020
T1059.003	Windows Command Shell	09 March 2020
T1059.004	Unix Shell	09 March 2020
T1059.005	Visual Basic	09 March 2020
T1059.006	Python	09 March 2020
T1059.007	JavaScript	23 June 2020
T1059.008	Network Device CLI	20 October 2020

Exploitation for Client Execution (T1203)

A client application is software individuals use to perform tasks, such as web browsing or word processing. These applications can have vulnerabilities, which are weaknesses in the code that attackers can exploit to gain access to the target system. There are several types of client execution exploitation, including browser-based exploitation, office application exploitation, and exploitation of common third-party applications. These exploits are delivered in various ways, such as through normal web browsing, spearphishing emails, or as attachments or links to malicious files. The user interaction required to execute the exploit depends on the type of exploit and the targeted application.

Browser-based exploitation can occur through drive-by compromise or spearphishing links, which do not require any action by the user for the exploit to be executed. Office applications, such as Microsoft Office, can be targeted through phishing, where malicious files are transmitted as attachments or links to download them. In these cases, the user must open the document or file for the exploit to run. Adversaries may also target third-party applications widely used in enterprise environments, such as Adobe Reader and Flash. Depending on the software and nature of the vulnerability, these exploits may be executed in the browser or require the user to open a file.

Software Deployment Tools (T1072)

Software deployment tools can be a potential security risk for companies because adversaries, or unauthorized individuals, may be able to access these tools and use them to move throughout a company’s network. This could result in the adversary’s ability to execute code on all connected systems, gather sensitive information, or even cause damage, such as wiping all data from computers. The specific permissions needed to carry out this type of attack may depend on the company’s system setup. In some cases, local credentials may be enough, while specific domain credentials may be required in others.

Persistence

Persistence is a tactic that cyberattackers use to maintain access to a target system for an extended period of time. It can include adding malicious code to the startup process, modifying the Windows registry, or using fileless attacks. The goal is to ensure that the attacker can continue to have access even if the target system is restarted or if security measures are taken that would otherwise cut off their access. Think of persistence as the attacker’s way of setting up a “beachhead” in your system so they can continue to operate and cause damage even if you try to stop them. The Persistence tactic was introduced into the framework on October 17, 2018, with the identifier TA0003, and since then, it has been updated with a total of 19 techniques, some of which are discussed next.

Account Manipulation (T1098)

Adversaries may try to manipulate accounts to maintain access to targeted systems. This manipulation can involve changing the credentials or permission groups associated with the account. The attackers might also perform actions that aim to bypass security policies, such as constantly updating the password to avoid being detected by password duration policies. To manipulate accounts, the attackers need to have a certain level of access to the systems or the domain. However, this manipulation can also result in privilege escalation, where the modifications grant the attackers access to accounts with higher privileges, such as more permissions or roles. Table 4-10 lists the sub-techniques associated with Account Manipulation in the framework.

Table 4-10. Account Manipulation sub-techniques

ID	Name	Created
T1098.001	Additional Cloud Credentials	19 January 2020
T1098.002	Additional Email Delegate Permissions	19 January 2020
T1098.003	Additional Cloud Roles	19 January 2020
T1098.004	SSH Authorized Keys	24 June 2020
T1098.005	Device Registration	04 March 2022

BITS Jobs (T1098)

Windows Background Intelligent Transfer Service, or BITS, is a file transfer mechanism designed to work in the background without interrupting other networked applications. It is commonly used by software updaters, messengers, and other applications that need to run in the background using available idle bandwidth. BITS is implemented as a queue of one or more file operations, known as BITS jobs. Adversaries can take advantage of BITS to persistently execute code and perform various malicious tasks. They can use BITS to download malicious code, execute it, and even clean up after it has run. The BITS job database is self-contained, meaning it does not create new files or registry modifications, making it easier for attackers to remain undetected. Additionally, host firewalls often allow BITS tasks, making it easier for attackers to execute their code.

BITS can also create long-standing jobs that persist even after the system reboots. In fact, BITS can be set up to invoke an arbitrary program when a job completes or encounters an error, which makes it a powerful tool for attackers to persist on a compromised system. It has upload functionalities that can be used to exfiltrate data over alternative protocols, making it an effective way for attackers to steal sensitive information.

Compromise Client Software Binary (T1554)

Adversaries may attempt to gain persistent access to systems by modifying client software binaries. Client software is any type of software that allows users to access services provided by a server. Some common examples of client software include SSH clients, FTP clients, email clients, and web browsers. To carry out malicious tasks, an adversary may modify the source code of the client software and add a backdoor. After compiling the code for the target system, the adversary may replace the legitimate application binary or support files with the backdoored version. This allows the adversary to gain persistent access to the host every time the user executes the client software.

Privilege Escalation

Privilege escalation is the process by which an attacker gains elevated permissions on a computer system or network. The attacker’s ultimate goal is to gain access to sensitive information, carry out malicious actions, or cause damage to the system. Adversaries typically start by gaining unprivileged access to the network or system, but to achieve their objectives, they require higher-level permissions. This is where privilege escalation comes into play. The attacker seeks to exploit weaknesses, misconfigurations, and vulnerabilities in the system in order to gain elevated access.

Elevated access can take various forms, such as SYSTEM or root-level access, local administrator access, or access to a user account with admin-like privileges. In some cases, the attacker may also seek access to a user account with access to a specific system or function. The Privilege Escalation tactic was introduced into the framework on January 6, 2021, with the identifier TA0004, and since then, it has been updated with a total of 13 techniques, some of which are discussed next.

Exploitation for Privilege Escalation (T1068)

In simple terms, a software vulnerability is a flaw in a program or service that an attacker can exploit to gain unauthorized access to a system. This means that the attacker takes advantage of a mistake in the programming to run their code on the system. To do this, the attacker often needs to bypass security measures and increase their privileges, which may be limited initially. An attacker may start with lower privilege levels, which restrict their access to specific resources on the system. However, suppose vulnerabilities exist in the operating system components or high-level software. In that case, the attacker can exploit them to elevate their privileges to a higher level, such as SYSTEM or root. This will allow the attacker to access more sensitive information and perform more damaging actions.

In some cases, the attacker may use a signed vulnerable driver to exploit a vulnerability in kernel mode. This technique is known as Bring Your Own Vulnerable Driver (BYOVD) and involves delivering the vulnerable driver to the compromised system through various methods, such as Initial Access or Lateral Tool Transfer.

Domain Policy Modification (T1484)

Adversaries can threaten computer networks’ security, especially in domain environments where resources are managed centrally. These environments include settings that dictate how different computer systems and user accounts interact with one another on a network.

One way adversaries can do this is by altering domain Group Policy Objects (GPOs) or changing trust settings between domains, including federation trusts. This requires sufficient permissions and, once done, can result in a wide range of potential attacks. For instance, an adversary can modify GPOs to push a malicious task onto all computers in the network or change trust settings to include an adversary-controlled domain where they can control access tokens. Additionally, adversaries may change configuration settings within the Active Directory (AD) environment to set up a rogue domain controller, further compromising security. Sometimes, they may temporarily modify domain policy, carry out malicious actions, and then revert the changes to hide their tracks. Table 4-11 lists the sub-techniques associated with Domain Policy Modification in the framework.

Table 4-11. Domain Policy Modification sub-techniques

ID	Name	Created
T1484.001	Group Policy Modification	28 December 2020
T1484.002	Domain Trust Modification	28 December 2020

Defense Evasion

Defense evasion is a vital aspect of cyberattacks, where the adversary tries to avoid detection and determines whether the operation will succeed. Adversaries do this by using various techniques to conceal their presence and activities in the compromised system; this involves uninstalling or disabling security software to prevent it from detecting malicious actions.

Adversaries can also use encryption and obfuscation techniques to hide the data and scripts they use in their attacks, or they can abuse trusted processes to hide and disguise their malware. This makes it harder for security systems to detect and stop them, and it may have the added benefit of subverting defenses, making it even more challenging to detect and prevent these types of attacks.

As an example of the Defense Evasion tactic in the MITRE ATT&CK framework, the Duqu malware employs sophisticated techniques to evade detection and compromise targeted systems. Initially discovered in 2011, Duqu is believed to have been created by the same group responsible for the Stuxnet worm that targeted Iran’s nuclear program. One of Duqu’s key techniques involves examining running system processes for tokens with specific system privileges. Once identified, Duqu copies and stores the tokens for later use, allowing attackers to launch new processes with elevated privileges and gain unfettered access to the compromised system. Furthermore, Duqu can steal tokens outright to acquire administrative privileges, making it an especially dangerous threat. The use of token copying and stealing highlights modern cyber threats’ advanced and evasive tactics. Organizations can better protect their systems and data from malicious actors by identifying and mitigating such techniques. The Defense Evasion tactic was introduced into the framework on October 17, 2018, with the identifier TA0005, and since then, it has been updated with a total of 42 techniques, some of which are discussed next.

Deobfuscate/Decode Files or Information (T1140)

Adversaries often use obfuscation techniques to conceal the true nature of their malicious activities, making it more difficult for security solutions to detect and prevent them. During an attack, separate mechanisms may be required to decode or deobfuscate files and information, which can involve the built-in functionality of malware or using utilities present on the system.

An example of this would be certutil, a command-line utility in Windows that is used to manage digital certificates and certificate trust lists. It is typically used to view and manage certificate stores, convert certificate formats, and verify certificate trust. By hiding a remote access tool (RAT) portable executable file inside a certificate file and then using certutil to decode it, adversaries can evade security solutions that rely on recognizing known malicious code.

Masquerading (T1036)

Adversaries sometimes use masquerading techniques to make their malicious software look like it’s a harmless or even a helpful tool. They do this by changing the name or location of the software so that it’s harder for security programs and users to identify it as harmful. It could mean giving the software a misleading filename or file type, making it appear as if it’s a different kind of file altogether, or even giving it a name that sounds like a trusted system utility.

Masquerading aims to avoid detection and trick people into downloading or running malicious software. By making software appear legitimate or harmless, the attacker hopes to give themselves a better chance of succeeding in their attack. Table 4-12 lists the sub-techniques associated with Masquerading in the framework.

Table 4-12. Masquerading sub-techniques

ID	Name	Created
T1036.001	Invalid Code Signature	10 February 2020
T1036.002	Right-to-Left Override	10 February 2020
T1036.003	Rename System Utilities	10 February 2020
T1036.004	Masquerade Task or Service	10 February 2020
T1036.005	Match Legitimate Name or Location	10 February 2020
T1036.006	Space after Filename	10 February 2020
T1036.007	Double File Extension	04 August 2021

Indirect Command Execution (T1202)

Adversaries can abuse certain utilities in Windows that allow for command execution to bypass security restrictions. This enables them to execute arbitrary commands and scripts without invoking the command-line interpreter (cmd), thereby avoiding detection. The utilities that can be used for this purpose include Forfiles, the Program Compatibility Assistant (pcalua.exe), and components of the Windows Subsystem for Linux (WSL), as well as others.

Credential Access

Credential access is a term used to describe malicious actors’ techniques to obtain sensitive information such as usernames and passwords. This information is crucial to gaining unauthorized access to systems and networks, which can lead to the theft of confidential information, disruption of services, and other activities.

One of the main ways that adversaries obtain credentials is through keylogging, which involves capturing every keystroke on a computer, including sensitive information such as usernames and passwords. Keylogging can be achieved through malicious software or hardware devices installed on a target’s computer. Another technique used in credential access is credential dumping, which involves extracting sensitive information, such as passwords, from a computer’s or server’s memory. Adversaries can use tools such as Mimikatz to perform credential dumping and obtain valuable information that can be used to gain unauthorized access to systems and networks. The Credential Access tactic was introduced into the framework on October 17, 2018, with the identifier TA0006, and since then, it has been updated with a total of 17 techniques, some of which are discussed next.

Brute Force (T1110)

Brute force is a method malicious actors use to gain access to sensitive accounts, such as online accounts or computer systems, when the password is unknown or password hashes have been obtained. The idea behind it is to guess the password by repeatedly trying different combinations until the correct one is found. Adversaries can use brute-force attacks at various points during a breach to access valid accounts within a victim’s environment by leveraging information gathered from other malicious activities, like OS credential dumping, account discovery, or password policy discovery. Table 4-13 lists the sub-techniques associated with Brute Force in the framework.

Table 4-13. Brute Force sub-techniques

ID	Name	Created
T1110.001	Password Guessing	11 February 2020
T1110.002	Password Cracking	11 February 2020
T1110.003	Password Spraying	11 February 2020
T1110.004	Credential Stuffing	11 February 2020

Network Sniffing (T1040)

Network sniffing is monitoring or capturing information sent over a wired or wireless network connection. Essentially, attackers use their network interface to tap into the network and collect data that is in transit. One of the things attackers can target through network sniffing is sensitive information, like user credentials, especially if the information is being sent over an insecure or unencrypted protocol, making it easier for the attacker to access it. Aside from capturing user credentials, network sniffing can give attackers insight into the configuration details of the network environment, like running services, version numbers, IP addresses, hostnames, and VLAN IDs. Even in cloud-based environments, attackers can use traffic-mirroring services to sniff network traffic from virtual machines. Much of this traffic is often in clear text, as encryption is not applied to reduce the strain on the network.

OS Credential Dumping (T1003)

OS credential dumping is an attacker’s technique to steal account login information, like passwords or hash values, from an operating system or software. With the credentials obtained through OS credential dumping, attackers can access restricted information and critical assets, move laterally in the network, create new accounts, perform actions, and even remove accounts to clear their tracks. In addition, they may also analyze password patterns and password policies to reveal other credentials. This technique is used by attackers who have already gained access to a system with elevated privileges. Table 4-14 lists the sub-techniques associated with OS Credential Dumping in the framework.

Table 4-14. OS Credential Dumping sub-techniques

ID	Name	Created
T1003.001	LSASS Memory	11 February 2020
T1003.002	Security Account Manager	11 February 2020
T1003.003	NTDS	11 February 2020
T1003.004	LSA Secrets	11 February 2020
T1003.005	Cached Domain Credentials	11 February 2020
T1003.006	DCSync	11 February 2020
T1003.007	Proc Filesystem	11 February 2020
T1003.008	/etc/passwd and /etc/shadow	11 February 2020

Discovery

Discovery is a crucial tactic because it consists of collecting information about the target environment to better understand the system and its components. The goal of discovery is to map out the environment and assemble information about the system and its components, such as operating systems, software applications, and open ports. It’s important to note that the discovery phase can take a long time; the information gathered during discovery helps the attacker identify the target’s weak spots and devise a plan to exploit those weaknesses. The Discovery tactic was introduced into the framework on October 17, 2018, with the identifier TA0007, and since then, it has been updated with 30 techniques, some of which are discussed next.

Account Discovery (T1087)

Account discovery is a technique adversaries use to collect information about accounts on a system or within a network environment. The purpose of account discovery is to identify the users who have access to the system and to determine which accounts can be targeted further. Adversaries may try to gather information about the cloud accounts that an organization has established, as well as compile a list of email addresses that can be targeted in a later stage of the operation. Table 4-15 lists the sub-techniques associated with Account Discovery in the framework.

Table 4-15. Account Discovery sub-techniques

ID	Name	Created
T1087.001	Local Account	21 February 2020
T1087.002	Domain Account	21 February 2020
T1087.003	Email Account	21 February 2020
T1087.004	Cloud Account	21 February 2020

Browser Information Discovery (T1217)

Adversaries may attempt to find information about the systems and networks they have compromised by examining the bookmarks saved in a user’s web browser. These bookmarks can provide valuable information about the user, such as their banking websites, social media accounts, and interests, as well as details about the internal network, such as servers, tools, and dashboards. If an adversary has obtained valid login credentials, examining the browser bookmarks can help them identify other potential targets. This is especially true if the browser has saved website login information, which is stored in files on the user’s device. The location of browser bookmarks depends on the user’s platform and web browser, but they are typically stored in local files or databases on the user’s device.

System Network Connections Discovery (T1049)

When an adversary gains unauthorized access to a computer system or network, they may try to find out more about the connections to and from that system. This is a way for attackers to gather information about connections to and from a compromised system or network, which can help them further their malicious goals. For instance, an attacker may search for details about virtual private clouds or networks in a cloud computing setup. Additionally, attackers with access to network devices can conduct a similar discovery process by utilizing the built-in features or command-line interface to uncover information about linked systems and services.

Lateral Movement

Lateral movement is a crucial tactic in many cyberattacks, as it enables attackers to spread their reach across a target network and gain access to sensitive resources and data. Adversaries use various methods to perform lateral movement, such as exploiting vulnerabilities in the network to gain access to other systems or obtaining legitimate credentials using techniques such as phishing, password spraying, or social engineering; these credentials can then be used to access other systems on the network. Additionally, attackers may install remote access tools, such as RDP or VPN servers. Once they gain access to one system, they can pivot through it to achieve access to other systems on the infrastructure. The Lateral Movement tactic was introduced into the framework on October 17, 2018, with the identifier TA0008, and since then, it has been updated with nine techniques, some of which are discussed next.

Exploitation of Remote Services (T1210)

Exploitation of remote services is the process where an attacker takes advantage of a vulnerability in a remote system to gain unauthorized access to it. This access can then be used to move laterally within the network and gain access to other systems and sensitive data. To carry out this attack, an adversary must first determine if the remote system is vulnerable. This can be done by using methods of network service discovery to identify susceptible software, looking for missing patches, or checking for the presence of security software. Many common services and systems are known to have vulnerabilities; if an attacker successfully exploits one of these systems, they may gain access to the network and cause damage. In some cases, the attacker may also be able to escalate their privileges, giving them even greater control over the system.

Replication Through Removable Media (T1091)

Replication through removable media is a technique cyberattackers use to spread malware from one computer to another. This is done by copying the malware onto a removable device, such as a USB drive, and taking advantage of the device’s Autorun feature. The feature was designed to make it easier for users of removable devices to run applications or files without manually locating and executing them.

The malware can infect a target computer when the removable device is inserted and executed. Adversaries use this method to gain access to systems, especially those that are disconnected or have limited access to the internet (also known as air-gapped networks). This can be done through various means, such as modifying the executable files stored on the removable device or disguising the malware as a legitimate file to trick users into executing it. Mobile devices such as smartphones can also be used as a means of spreading malware to PCs. When a smartphone is connected to a computer via USB, it can show up as if it’s a mounted hard drive. If there is malware on the smartphone, the computer can get infected if the Autorun feature is turned on.

Use Alternate Authentication Material (T1550)

When you log in to a system, you usually need to provide a username and some form of authentication, such as a password or a smart card. After successfully logging in, the system generates alternate authentication material, which is used to verify your identity and allow you to access different parts of the system without having to log in again. The system stores this alternate authentication material, but if it’s not adequately secured, it could be stolen by attackers. If this happens, the attackers could bypass normal access controls and log in to the system as you, even if they don’t know your password or other authentication factors. Table 4-16 lists the sub-techniques associated with Use Alternate Authentication Material in the framework.

Table 4-16. Use Alternate Authentication Material sub-techniques

ID	Name	Created
T1550.001	Application Access Token	30 January 2020
T1550.002	Pass the Hash	30 January 2020
T1550.003	Pass the Ticket	30 January 2020
T1550.004	Web Session Cookie	30 January 2020

Collection

In cybersecurity, collection is the term used to define an adversary’s activities that attempt to gather the information relevant to the objective. These objectives might include stealing sensitive information, compromising a target system, or carrying out other malicious activities. This occurs after an adversary has gained entry into a system and involves the active collection of information or data from that system. Various techniques can be used to collect information from different sources, including drives (such as hard drives or USB devices), browsers, email clients, and even audio and video feeds. Some common collection methods include capturing screenshots of a target system, recording keyboard input to capture passwords or other sensitive data, and extracting data from web browsers or email clients. The Collection tactic was introduced into the framework on October 17, 2018, with the identifier TA0009, and since then, it has been updated with a total of 17 techniques, some of which are discussed next.

Automated Collection (T1119)

Automated collection is a technique used by adversaries to gather internal data within a system or network using automated tools. This can involve using command and scripting interpreters to search for and copy information that matches specific criteria, such as file type, location, or name, at set time intervals. In cloud-based environments, adversaries may use cloud APIs; command-line interfaces; or extract, transform, and load (ETL) services to collect data automatically. Adversaries can use this technique to quickly and efficiently collect large amounts of data without manual intervention.

Archive Collected Data (T1560)

When an adversary collects data, they may compress and encrypt it before exfiltrating it from the target system. Compressing the data helps make it more difficult to detect and reduces the amount of data that needs to be transferred over the network. By using compression, an adversary can hide the data among other network traffic, making it less conspicuous. Encryption is another technique adversaries may use to protect the collected information, where the data becomes inaccessible to anyone who does not have the decryption key. This makes it difficult for defenders to detect or make sense of the information if they intercept it. Table 4-17 lists the sub-techniques associated with Archive Collected Data in the framework.

Table 4-17. Archive Collected Data sub-techniques

ID	Name	Created
T1560.001	Archive via Utility	20 February 2020
T1560.002	Archive via Library	20 February 2020
T1560.003	Archive via Custom Method	20 February 2020

Data from Network Shared Drive (T1039)

When adversaries gain access to a computer system, they often look for ways to find sensitive information that they can use or sell for profit. One way they can do this is by searching for files of interest on the network shares of the compromised computer. If it has access to shared network drives on other systems, the adversaries can use those drives to collect sensitive data. For example, a company might have a file server that stores all of its financial records, and if a threat actor gains access to a computer that can access that file server, they can use it to steal that data.

All of this is done before the adversary attempts to exfiltrate the stolen data, which means they gather the information they want and save it in a location they can access later.

Command and Control

In cybersecurity, command and control (C2) is a set of techniques that adversaries use to communicate with systems they have compromised or infected with malware. Once the attacker has gained access to a victim’s network or device, they may use C2 techniques to issue commands to the compromised systems and control their behavior.

Adversaries may attempt to establish C2 channels that mimic normal network traffic to avoid detection by security defenses. They may also use encryption or obfuscation techniques to make their C2 traffic harder to detect and analyze. Examples of C2 techniques include:

• Using remote access tools to connect to compromised systems

• Creating covert communication channels within seemingly benign network traffic (such as DNS requests)

• Using social engineering tactics to trick users into executing malicious commands

The Command and Control tactic was introduced into the framework on October 17, 2018, with the identifier TA0011, and since then, it has been updated with a total of 16 techniques, some of which are discussed next.

Application Layer Protocol (T1071)

An application layer protocol is a communication protocol that defines how applications communicate with each other over a network. It is a set of rules and standards that determine the format, sequence, and error checking of messages exchanged between applications at the application layer of the open systems interconnection (OSI) model.

Adversaries use application layer protocols to blend in with existing traffic. In other words, to avoid raising suspicion, they use the same protocols that legitimate traffic uses. This means that the commands they send to the remote system and the results of those commands are hidden within the normal traffic of the communication protocol. To achieve this, adversaries may use various protocols, such as those commonly used for web browsing, file transfers, email, or DNS, making it harder to detect their activity. This allows them to conduct their activities in a way that makes them harder to detect. Table 4-18 lists the sub-techniques associated with the Application Layer Protocol in the framework.

Table 4-18. Application Layer Protocol sub-techniques

ID	Name	Created
T1071.001	Web Protocols	15 March 2020
T1071.002	File Transfer Protocols	15 March 2020
T1071.003	Mail Protocols	15 March 2020
T1071.004	DNS	15 March 2020

Ingress Tool Transfer (T1105)

Ingress tool transfer is a technique adversaries use to transfer tools or files from an external system into a compromised environment. This may involve copying tools or files from an external adversary-controlled system to the victim network through a C2 channel or alternate protocols such as FTP. Once the tools or files are present in the compromised environment, adversaries may transfer or spread them between victim devices. It’s important to note that ingress tool transfer is a common technique used by attackers, allowing them to gain further access to and control of the compromised environment.

Proxy (T1090)

A proxy is an intermediary between a user’s computer and the internet. When a user requests access to a website or other online resource, the request first goes to the proxy server, which sends the request on behalf of the user. In a cyberattack, adversaries may use a connection proxy to redirect network traffic between systems or act as an intermediary for network communications to a C2 server. Various tools enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these resources to manage C2 communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or ride over existing trusted communications paths between victims to avoid suspicion.

Proxy Tools

HTRAN is a tool used for creating TCP/IP network connections through HTTP proxies, allowing users to bypass firewalls and other network restrictions.

ZXProxy is a web proxy tool that allows users to access websites and online content that may be blocked by geographical or network restrictions.

ZXPortMap is a tool used for mapping and redirecting network ports on a computer, allowing users to create custom network configurations and optimize network performance.

Adversaries can take advantage of routing schemes in content delivery networks (CDNs) to proxy C2 traffic. CDNs are used to optimize web content delivery, and attackers can exploit them to route C2 traffic through the same infrastructure already used by legitimate network traffic. This can make it more difficult to detect malicious activity and can help attackers avoid being flagged as malicious by security controls. Table 4-19 lists the sub-techniques associated with Proxy in the framework.

Table 4-19. Proxy sub-techniques

ID	Name	Created
T1090.001	Internal Proxy	14 March 2020
T1090.002	External Proxy	14 March 2020
T1090.003	Multi-hop Proxy	14 March 2020
T1090.004	Domain Fronting	14 March 2020

Exfiltration

Unlike data collection, which involves obtaining information, exfiltration is the process of extracting sensitive information from an organization’s systems and sending it to an external location. Adversaries can use various methods to exfiltrate data, some of which are quite obvious, whereas others are much more stealthy. One of the most commonly used techniques is to transfer data through a network channel that connects an organization with the outside world. Adversaries often try to hide the data by encrypting and compressing it before exfiltration, using steganography images, DNS queries, and packet metadata to embed small pieces of information. They can also implement automated exfiltration, where files are quietly downloaded in the background and blend in with legitimate traffic. The Exfiltration tactic was introduced into the framework on October 17, 2018, with the identifier TA0010, and since then, it has been updated with a total of nine techniques, some of which are discussed next.

Exfiltration over Alternative Protocol (T1048)

Exfiltration involves sending the stolen data over a different network protocol than the one used for the C2 channel, making it harder for security measures to detect and prevent the exfiltration. Attackers might hide the data or use tools to scramble the information being transmitted to further evade detection. They can use standard computer tools already installed on the system (like Net/Server Message Block (SMB) or FTP), or on macOS and Linux systems, they can use a tool called cURL to send the data out using alternate protocols (like HTTP/S or FTP/S). Table 4-20 lists the sub-techniques associated with Exfiltration over Alternative Protocol in the framework.

Table 4-20. Exfiltration over Alternative Protocol sub-techniques

ID	Name	Created
T1048.001	Exfiltration over Symmetric Encrypted Non-C2 Protocol	15 March 2020
T1048.002	Exfiltration over Asymmetric Encrypted Non-C2 Protocol	15 March 2020
T1048.003	Exfiltration over Unencrypted Non-C2 Protocol	15 March 2020

Scheduled Transfer (T1029)

When an adversary wants to steal data from a computer network, they might use a technique called scheduled transfer. This means they schedule a specific time or interval to steal the data so it looks like normal activity and is more challenging for security teams to detect. When using this technique, they carefully plan when they will transfer the stolen data to make it blend in with regular activity on the network. For example, an attacker may schedule the data transfer to occur when employees are typically busy sending and receiving large amounts of data, such as during peak business hours. This way, the transfer of the stolen data is less likely to be noticed by security teams monitoring the network.

Furthermore, attackers might use scheduled transfers to avoid setting off any alarms or alerts triggered by unusual activity. If data is being exfiltrated at random intervals, it can look suspicious and draw attention. But by scheduling the transfer, the attacker can make it appear as if the data were just part of regular network traffic.

Transfer Data to Cloud Account (T1537)

A cloud environment is a virtual space where your online data, applications, and systems are stored and accessed. It’s like a digital warehouse where you can keep your files and programs and access them from anywhere with an internet connection. Cloud environments offer several benefits, such as increased accessibility, scalability, and cost-effectiveness. They allow individuals and businesses to store and access data remotely without needing physical storage devices or on-premises servers.

Adversaries are known to utilize these scalable solutions for moving their files and large amounts of data from the target to their controlled cloud environment. They can transfer compromised cloud infrastructures, including their backups, to a different cloud account they control within the same service, making it harder for defenders to detect these anomalies.

Impact

The term impact is used in the cybersecurity world to describe the actions of adversaries that attempt to disrupt the availability or integrity of systems and data. This includes ransomware, denial of service (DoS) attacks, and other destructive methods that can manipulate business and operational processes.

Ransomware attacks, which fall under the Impact tactics category in the MITRE ATT&CK framework, are prevalent cyberattacks that can significantly impact an organization’s systems and data. Such attacks involve encrypting a victim’s files and demanding payment for the decryption key. Additionally, cybercriminals may target backups, leading to data recovery challenges. Other techniques, such as endpoint and network DoS, resource hijacking, and data manipulation, are frequently employed in ransomware attacks. The following sections will discuss some of these techniques and their impact on an organization’s security posture. Organizations can better protect their systems and data against ransomware threats by understanding and addressing these techniques.

Data Encrypted for Impact (T1486)

Data encrypted for impact is a technique in which the attacker encrypts essential files on a computer or network to make them inaccessible. The purpose of this attack could be to demand a ransom from the victim in exchange for a decryption key, or to cause permanent damage to the data. Usually, standard files like documents, pictures, and videos are targeted for encryption, and the attacker may use other methods to gain access to these files, like changing file permissions or shutting down the system. To spread the attack, techniques that allow the malware to infect other computers in the same network may be used, making it harder for defenders to contain the damage.

Endpoint Denial of Service (T1499)

In computing, an endpoint is a device or node connected to a network and capable of communicating with other devices or nodes on the network. Endpoints include computers, laptops, smartphones, servers, printers, and other network-connected devices. Adversaries can perform attacks that deny users access to services by overwhelming or blocking the resources that host those services. Some services that can be targeted include websites, email services, DNS, and web-based applications. Endpoint DoS attacks target different system layers, including the operating system, web servers, databases, and web applications.

Adversaries can use botnets to conduct distributed denial of service (DDoS) attacks. Botnets are large networks of computers that attackers control remotely to generate a significant amount of traffic. Botnets can be created by attackers, or existing botnets can be rented, and they can be so large that each computer only needs to send a small amount of traffic to exhaust the target’s resources. Table 4-21 lists the sub-techniques associated with Endpoint Denial of Service in the framework.

Table 4-21. Endpoint Denial of Service sub-techniques

ID	Name	Created
T1499.001	OS Exhaustion Flood	20 February 2020
T1499.002	Service Exhaustion Flood	20 February 2020
T1499.003	Application Exhaustion Flood	20 February 2020
T1499.004	Application or System Exploitation	20 February 2020

System Shutdown/Reboot (T1529)

Have you ever experienced a situation where your computer suddenly shuts down or restarts without permission? Unfortunately, sometimes malicious people may use these techniques to interrupt access to, or even destroy, computer systems. Operating systems have built-in commands that allow users to initiate a system shutdown or reboot the computer or remote computers connected to the same network. Adversaries can use these commands to disrupt access to computer resources for legitimate users, causing frustration and potentially the loss of important data or services.

What is more concerning is that some adversaries may intentionally impact a system in other ways, like wiping out the disk structure or preventing system recovery, before initiating a system shutdown or reboot, which can accelerate the effects on the system’s availability and make it more difficult for defenders to recover data.

Summary

When law enforcement officers try to catch a criminal, they often study the criminal’s MO, which is how they commit the crime, the they take to carry it out, and how they try to hide what they have done. It helps law enforcement to understand the criminal’s thought process and behavior patterns.

In the same way, cybersecurity experts study the behavior of hackers who attack computer systems. To do so, cybersecurity experts can reference ATT&CK, which describes the tactics that hackers commonly use to attack computer systems. The Enterprise domain of ATT&CK encompasses a comprehensive framework of 14 tactics, 193 techniques, and 401 sub-techniques, each identified by a unique ID. This provides cybersecurity experts with a straightforward method for referencing specific components of the framework, facilitating more effective threat detection and response.

It’s important to note that not every attacker will follow all the tactics listed in the framework, and cyberattacks can take many different forms. The lack of ordering in the framework reflects the diversity and constant evolution of cyberattacks. However, the ATT&CK framework is still a valuable tool for cybersecurity experts because it helps them to understand the common tactics that hackers use and to develop strategies to defend against them.

¹ “Enterprise Techniques,” MITRE ATT&CK, accessed February 6, 2023, https://attack.mitre.org/techniques/enterprise.