namura's notes

ATT&CK techniques

1 min read

49 techniques across 53 rooms. Each page lists the rooms where the technique came up, and links to MITRE’s description.

TechniqueRooms
T1595 Active Scanning25
T1190 Exploit Public-Facing App22
T1078 Valid Accounts18
T1110 Brute Force18
T1027 Obfuscated Files or Information13
T1552 Unsecured Credentials12
T1053 Scheduled Task/Job9
T1548 Abuse Elevation Control Mechanism8
T1548.003 Sudo and Sudo Caching8
T1068 Exploitation for Privilege Escalation6
T1611 Escape to Host5
T1040 Network Sniffing4
T1059.006 Python4
T1592 Gather Victim Host Information4
T1003 OS Credential Dumping3
T1059 Command and Scripting Interpreter3
T1059.004 Command and Scripting Interpreter3
T1083 File and Directory Discovery3
T1548.001 Setuid and Setgid3
T1574 Hijack Execution Flow3
T1005 Data from Local System2
T1210 Exploitation of Remote Services2
T1596 Search Open Technical Databases2
T1014 Rootkit1
T1021 Remote Services1
T1021.002 SMB/Windows Admin Shares1
T1027.003 Steganography1
T1059.003 Command and Scripting Interpreter1
T1059.007 JavaScript1
T1082 System Information Discovery1
T1095 Non-Application Layer Protocol1
T1098 Account Manipulation1
T1195 Supply Chain Compromise1
T1222 File and Directory Permissions Modification1
T1485 Data Destruction/Manipulation1
T1543 Create or Modify System Process1
T1543.002 Create or Modify System Process: System Service1
T1552.001 Credentials in Files1
T1552.003 Unsecured Credentials: Bash History/Config1
T1553 Subvert Trust Controls1
T1555 Credentials from Password Stores1
T1565.001 Stored Data Manipulation1
T1566 Phishing/OSINT1
T1569 System Services1
T1572 Protocol Tunneling1
T1574.006 Hijack Execution Flow: LD_PRELOAD/LD_LIBRARY_PATH1
T1574.007 Hijack Execution Flow: Path Interception1
T1574.008 Hijack Execution Flow: Path Interception1
T1598 Phishing for Information1

49 items under this folder.