| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may manipulate software dependencies and develop | t | 1 | Adversaries may manipulate software dependencies and develop |
| > | ment tools prior to receipt by a final consumer for the purp | > | ment tools prior to receipt by a final consumer for the purp | ||
| > | ose of data or system compromise. Applications often depend | > | ose of data or system compromise. Applications often depend | ||
| > | on external software to function properly. Popular open sour | > | on external software to function properly. Popular open sour | ||
| > | ce projects that are used as dependencies in many applicatio | > | ce projects that are used as dependencies in many applicatio | ||
| > | ns, such as pip and NPM packages, may be targeted as a means | > | ns, such as pip and NPM packages, may be targeted as a means | ||
| > | to add malicious code to users of the dependency.(Citation: | > | to add malicious code to users of the dependency.(Citation: | ||
| > | Trendmicro NPM Compromise)(Citation: Bitdefender NPM Reposi | > | Trendmicro NPM Compromise)(Citation: Bitdefender NPM Reposi | ||
| > | tories Compromised 2021)(Citation: MANDVI Malicious npm and | > | tories Compromised 2021)(Citation: MANDVI Malicious npm and | ||
| > | PyPI Packages Disguised) This may also include abandoned pac | > | PyPI Packages Disguised) This may also include abandoned pac | ||
| > | kages, which in some cases could be re-registered by threat | > | kages, which in some cases could be re-registered by threat | ||
| > | actors after being removed by adversaries.(Citation: The Hac | > | actors after being removed by adversaries.(Citation: The Hac | ||
| > | ker News PyPi Revival Hijack 2024) Adversaries may also empl | > | ker News PyPi Revival Hijack 2024) Adversaries may also empl | ||
| > | oy \"typosquatting\" or name-confusion by choosing names simil | > | oy \"typosquatting\" or name-confusion by choosing names simil | ||
| > | ar to existing popular libraries or packages in order to dec | > | ar to existing popular libraries or packages in order to dec | ||
| > | eive a user.(Citation: Ahmed Backdoors in Python and NPM Pac | > | eive a user.(Citation: Ahmed Backdoors in Python and NPM Pac | ||
| > | kages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(C | > | kages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(C | ||
| > | itation: Checkmarx-oss-seo) Additionally, CI/CD pipeline co | > | itation: Checkmarx-oss-seo) Additionally, CI/CD pipeline co | ||
| > | mponents, such as GitHub Actions, may be targeted in order t | > | mponents, such as GitHub Actions, may be targeted in order t | ||
| > | o gain access to the building, testing, and deployment cycle | > | o gain access to the building, testing, and deployment cycle | ||
| > | s of an application.(Citation: Unit 42 Palo Alto GitHub Acti | > | s of an application.(Citation: Unit 42 Palo Alto GitHub Acti | ||
| > | ons Supply Chain Attack 2025) By adding malicious code into | > | ons Supply Chain Attack 2025) By adding malicious code into | ||
| > | a GitHub action, a threat actor may be able to collect runti | > | a GitHub action, a threat actor may be able to collect runti | ||
| > | me credentials (e.g., via [Proc Filesystem](https://attack.m | > | me credentials (e.g., via [Proc Filesystem](https://attack.m | ||
| > | itre.org/techniques/T1003/007)) or insert further malicious | > | itre.org/techniques/T1003/007)) or insert further malicious | ||
| > | components into the build pipelines for a second-order suppl | > | components into the build pipelines for a second-order suppl | ||
| > | y chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Ac | > | y chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Ac | ||
| > | tions are often dependent on other GitHub Actions, threat ac | > | tions are often dependent on other GitHub Actions, threat ac | ||
| > | tors may be able to infect a large number of repositories vi | > | tors may be able to infect a large number of repositories vi | ||
| > | a the compromise of a single Action.(Citation: Palo Alto Net | > | a the compromise of a single Action.(Citation: Palo Alto Net | ||
| > | works GitHub Actions Worm 2023) Targeting may be specific t | > | works GitHub Actions Worm 2023) Adversaries may also target | ||
| > | o a desired victim set or may be distributed to a broad set | > | the configuration and instruction files consumed by integra | ||
| > | of consumers but only move on to additional tactics on speci | > | ted development environments and AI coding agents. Project f | ||
| > | fic victims. | > | iles such as tasks.json may execute commands when a develope | ||
| > | r opens or builds a project, while agent skill files (SKILL. | ||||
| > | md) supply an agent with instructions and resources that it | ||||
| > | loads on demand and runs with the permissions of the agent p | ||||
| > | rocess.(Citation: Microsoft - Agent Skills Docs)(Citation: G | ||||
| > | oogle Agent Files May 2026)(Citation: CrowdStrike Threat Hun | ||||
| > | ting Report 2026)(Citation: Microsoft Contagious Interview M | ||||
| > | arch 2026) To encourage downloads, adversaries may publish t | ||||
| > | hese files under benign-appearing or typo-squatted names, up | ||||
| > | load unmodified copies of the genuine skills first so the li | ||||
| > | stings accumulate installs before the content behind them is | ||||
| > | weaponized, or may place the malicious instructions in a se | ||||
| > | condary document that the reviewed entry point references.(C | ||||
| > | itation: Zenity Skill Supply Chain August 2026)(Citation: ES | ||||
| > | ET Agent Skills March 2026) Because these artifacts are natu | ||||
| > | ral language or configuration rather than executable code, t | ||||
| > | hey may pass registry screening and signature-based scanning | ||||
| > | .(Citation: ESET Agent Skills March 2026)(Citation: TrendMic | ||||
| > | ro - OpenClaw Skills Distribute ATMOS) Targeting may be sp | ||||
| > | ecific to a desired victim set or may be distributed to a br | ||||
| > | oad set of consumers but only move on to additional tactics | ||||
| > | on specific victims. |
Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).\n\nPowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.\n\nA number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack)\n\nPowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1059/001",
"external_id": "T1059.001"
},
{
"source_name": "Microsoft PSfromCsharp APR 2014",
"description": "Babinec, K. (2014, April 28). Executing PowerShell scripts from C#. Retrieved April 22, 2019.",
"url": "https://blogs.msdn.microsoft.com/kebab/2014/04/28/executing-powershell-scripts-from-c/"
},
{
"source_name": "SilentBreak Offensive PS Dec 2015",
"description": "Christensen, L.. (2015, December 28). The Evolution of Offensive PowerShell Invocation. Retrieved December 8, 2018.",
"url": "https://web.archive.org/web/20190508170150/https://silentbreaksecurity.com/powershell-jobs-without-powershell-exe/"
},
{
"source_name": "Github PSAttack",
"description": "Haight, J. (2016, April 21). PS>Attack. Retrieved September 27, 2024.",
"url": "https://github.com/Exploit-install/PSAttack-1"
},
{
"source_name": "Powershell installation",
"description": "Microsoft. (n.d.). Install PowerShell on Windows, Linux, and macOS. Retrieved September 17, 2026.",
"url": "https://learn.microsoft.com/en-us/powershell/scripting/install/install-powershell?view=powershell-7.6"
},
{
"source_name": "TechNet PowerShell",
"description": "Microsoft. (n.d.). Windows PowerShell Scripting. Retrieved April 28, 2016.",
"url": "https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx"
},
{
"source_name": "Sixdub PowerPick Jan 2016",
"description": "Warner, J.. (2015, January 6). Inexorable PowerShell \u2013 A Red Teamer\u2019s Tale of Overcoming Simple AppLocker Policies. Retrieved December 8, 2018.",
"url": "https://web.archive.org/web/20160327101330/http://www.sixdub.net/?p=367"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Mayuresh Dani, Qualys",
"Praetorian",
"Ross Brittain",
"Stephan H. Wenderlich, Gray-Hat IT-Security Consulting"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS"
],
"x_mitre_remote_support": false,
"x_mitre_version": "1.6",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-18 13:23:14.419000+00:00\", \"old_value\": \"2026-05-12 15:12:00.706000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) PowerShell can also be installed on Linux and macOS.(Citation: Powershell installation) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).\\n\\nPowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.\\n\\nA number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack)\\n\\nPowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)\", \"old_value\": \"Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).\\n\\nPowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.\\n\\nA number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack)\\n\\nPowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)\", \"diff\": \"--- \\n+++ \\n@@ -1,4 +1,4 @@\\n-Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).\\n+Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) PowerShell can also be installed on Linux and macOS.(Citation: Powershell installation) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).\\n \\n PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.\\n \"}, \"root['external_references'][3]['source_name']\": {\"new_value\": \"Powershell installation\", \"old_value\": \"FireEye PowerShell Logging 2016\", \"new_path\": \"root['external_references'][4]['source_name']\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"Microsoft. (n.d.). Install PowerShell on Windows, Linux, and macOS. Retrieved September 17, 2026.\", \"old_value\": \"Dunwoody, M. (2016, February 11). GREATER VISIBILITY THROUGH POWERSHELL LOGGING. Retrieved February 16, 2016.\", \"new_path\": \"root['external_references'][4]['description']\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://learn.microsoft.com/en-us/powershell/scripting/install/install-powershell?view=powershell-7.6\", \"old_value\": \"https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html\", \"new_path\": \"root['external_references'][4]['url']\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.6\", \"old_value\": \"1.5\"}}, \"iterable_item_added\": {\"root['x_mitre_contributors'][3]\": \"Stephan H. Wenderlich, Gray-Hat IT-Security Consulting\", \"root['x_mitre_platforms'][1]\": \"Linux\", \"root['x_mitre_platforms'][2]\": \"macOS\"}, \"iterable_item_removed\": {\"root['external_references'][5]\": {\"source_name\": \"inv_ps_attacks\", \"description\": \"Hastings, M. (2014, July 16). Investigating PowerShell Attacks. Retrieved December 1, 2021.\", \"url\": \"https://powershellmagazine.com/2014/07/16/investigating-powershell-attacks/\"}, \"root['external_references'][6]\": {\"source_name\": \"Malware Archaeology PowerShell Cheat Sheet\", \"description\": \"Malware Archaeology. (2016, June). WINDOWS POWERSHELL LOGGING CHEAT SHEET - Win 7/Win 2008 or later. Retrieved June 24, 2016.\", \"url\": \"http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf\"}}}",
"previous_version": "1.5",
"version_change": "1.5 \u2192 1.6",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse PowerShell commands and scripts for ex | t | 1 | Adversaries may abuse PowerShell commands and scripts for ex |
| > | ecution. PowerShell is a powerful interactive command-line i | > | ecution. PowerShell is a powerful interactive command-line i | ||
| > | nterface and scripting environment included in the Windows o | > | nterface and scripting environment included in the Windows o | ||
| > | perating system.(Citation: TechNet PowerShell) Adversaries c | > | perating system.(Citation: TechNet PowerShell) PowerShell ca | ||
| > | an use PowerShell to perform a number of actions, including | > | n also be installed on Linux and macOS.(Citation: Powershell | ||
| > | discovery of information and execution of code. Examples inc | > | installation) Adversaries can use PowerShell to perform a n | ||
| > | lude the <code>Start-Process</code> cmdlet which can be used | > | umber of actions, including discovery of information and exe | ||
| > | to run an executable and the <code>Invoke-Command</code> cm | > | cution of code. Examples include the <code>Start-Process</co | ||
| > | dlet which runs a command locally or on a remote computer (t | > | de> cmdlet which can be used to run an executable and the <c | ||
| > | hough administrator permissions are required to use PowerShe | > | ode>Invoke-Command</code> cmdlet which runs a command locall | ||
| > | ll to connect to remote systems). PowerShell may also be us | > | y or on a remote computer (though administrator permissions | ||
| > | ed to download and run executables from the Internet, which | > | are required to use PowerShell to connect to remote systems) | ||
| > | can be executed from disk or in memory without touching disk | > | . PowerShell may also be used to download and run executabl | ||
| > | . A number of PowerShell-based offensive testing tools are | > | es from the Internet, which can be executed from disk or in | ||
| > | available, including [Empire](https://attack.mitre.org/softw | > | memory without touching disk. A number of PowerShell-based | ||
| > | are/S0363), [PowerSploit](https://attack.mitre.org/software | > | offensive testing tools are available, including [Empire](ht | ||
| > | /S0194), [PoshC2](https://attack.mitre.org/software/S0378), | > | tps://attack.mitre.org/software/S0363), [PowerSploit](https | ||
| > | and PSAttack.(Citation: Github PSAttack) PowerShell command | > | ://attack.mitre.org/software/S0194), [PoshC2](https://attack | ||
| > | s/scripts can also be executed without directly invoking the | > | .mitre.org/software/S0378), and PSAttack.(Citation: Github P | ||
| > | <code>powershell.exe</code> binary through interfaces to Po | > | SAttack) PowerShell commands/scripts can also be executed w | ||
| > | werShell's underlying <code>System.Management.Automation</co | > | ithout directly invoking the <code>powershell.exe</code> bin | ||
| > | de> assembly DLL exposed through the .NET framework and Wind | > | ary through interfaces to PowerShell's underlying <code>Syst | ||
| > | ows Common Language Interface (CLI).(Citation: Sixdub PowerP | > | em.Management.Automation</code> assembly DLL exposed through | ||
| > | ick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(C | > | the .NET framework and Windows Common Language Interface (C | ||
| > | itation: Microsoft PSfromCsharp APR 2014) | > | LI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBr | ||
| > | eak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp | ||||
| > | APR 2014) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may exfiltrate data in fixed size chunks instea | t | 1 | An adversary may exfiltrate data in fixed size chunks instea |
| > | d of whole files or limit packet sizes below certain thresho | > | d of whole files or limit packet sizes below certain thresho | ||
| > | lds. This approach may be used to avoid triggering network d | > | lds. This approach may be used to avoid triggering network d | ||
| > | ata transfer threshold alerts. | > | ata transfer threshold alerts.(Citation: Chunked Encoding) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may leverage Confluence repositories to mine va | t | 1 | Adversaries may leverage Confluence repositories to mine va |
| > | luable information. Often found in development environments | > | luable information.(Citation: Confluence Standards in Data E | ||
| > | alongside Atlassian JIRA, Confluence is generally used to st | > | ngineering) Often found in development environments alongsid | ||
| > | ore development-related documentation, however, in general m | > | e Atlassian JIRA, Confluence is generally used to store deve | ||
| > | ay contain more diverse categories of useful information, su | > | lopment-related documentation, however, in general may conta | ||
| > | ch as: * Policies, procedures, and standards * Physical / l | > | in more diverse categories of useful information, such as: | ||
| > | ogical network diagrams * System architecture diagrams * Tec | > | * Policies, procedures, and standards * Physical / logical n | ||
| > | hnical system documentation * Testing / development credenti | > | etwork diagrams * System architecture diagrams * Technical s | ||
| > | als (i.e., [Unsecured Credentials](https://attack.mitre.org/ | > | ystem documentation * Testing / development credentials (i.e | ||
| > | techniques/T1552)) * Work / project schedules * Source code | > | ., [Unsecured Credentials](https://attack.mitre.org/techniqu | ||
| > | snippets * Links to network shares and other internal resour | > | es/T1552)) * Work / project schedules * Source code snippets | ||
| > | ces | > | * Links to network shares and other internal resources |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may leverage the SharePoint repository as a sour | t | 1 | Adversaries may leverage the SharePoint repository as a sour |
| > | ce to mine valuable information. SharePoint will often conta | > | ce to mine valuable information.(Citation: Information archi | ||
| > | in useful information for an adversary to learn about the st | > | tecture guidance for SharePoint Online portals) SharePoint w | ||
| > | ructure and functionality of the internal network and system | > | ill often contain useful information for an adversary to lea | ||
| > | s. For example, the following is a list of example informati | > | rn about the structure and functionality of the internal net | ||
| > | on that may hold potential value to an adversary and may als | > | work and systems. For example, the following is a list of ex | ||
| > | o be found on SharePoint: * Policies, procedures, and stand | > | ample information that may hold potential value to an advers | ||
| > | ards * Physical / logical network diagrams * System architec | > | ary and may also be found on SharePoint: * Policies, proced | ||
| > | ture diagrams * Technical system documentation * Testing / d | > | ures, and standards * Physical / logical network diagrams * | ||
| > | evelopment credentials (i.e., [Unsecured Credentials](https: | > | System architecture diagrams * Technical system documentatio | ||
| > | //attack.mitre.org/techniques/T1552)) * Work / project sched | > | n * Testing / development credentials (i.e., [Unsecured Cred | ||
| > | ules * Source code snippets * Links to network shares and ot | > | entials](https://attack.mitre.org/techniques/T1552)) * Work | ||
| > | her internal resources | > | / project schedules * Source code snippets * Links to networ | ||
| > | k shares and other internal resources |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may search network shares on computers they have | t | 1 | Adversaries may search network shares on computers they have |
| > | compromised to find files of interest. Sensitive data can b | > | compromised to find files of interest. Sensitive data can b | ||
| > | e collected from remote systems via shared network drives (h | > | e collected from remote systems via shared network drives (h | ||
| > | ost shared directory, network file server, etc.) that are ac | > | ost shared directory, network file server, etc.) that are ac | ||
| > | cessible from the current system prior to Exfiltration. Inte | > | cessible from the current system prior to Exfiltration. Inte | ||
| > | ractive command shells may be in use, and common functionali | > | ractive command shells may be in use, and common functionali | ||
| > | ty within [cmd](https://attack.mitre.org/software/S0106) may | > | ty within [cmd](https://attack.mitre.org/software/S0106) may | ||
| > | be used to gather information. | > | be used to gather information.(Citation: Net Use)(Citation: | ||
| > | Cybersecurity Advisory GRU Brute Force Campaign July 2021) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify visual content available internally o | t | 1 | Adversaries may modify visual content available internally o |
| > | r externally to an enterprise network, thus affecting the in | > | r externally to an enterprise network, thus affecting the in | ||
| > | tegrity of the original content. Reasons for [Defacement](ht | > | tegrity of the original content. Reasons for [Defacement](ht | ||
| > | tps://attack.mitre.org/techniques/T1491) include delivering | > | tps://attack.mitre.org/techniques/T1491) include delivering | ||
| > | messaging, intimidation, or claiming (possibly false) credit | > | messaging, intimidation, or claiming (possibly false) credit | ||
| > | for an intrusion. Disturbing or offensive images may be use | > | for an intrusion. Disturbing or offensive images may be use | ||
| > | d as a part of [Defacement](https://attack.mitre.org/techniq | > | d as a part of [Defacement](https://attack.mitre.org/techniq | ||
| > | ues/T1491) in order to cause user discomfort, or to pressure | > | ues/T1491) in order to cause user discomfort, or to pressure | ||
| > | compliance with accompanying messages. | > | compliance with accompanying messages.(Citation: Defacement | ||
| > | Attacks) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may build capabilities that can be used during t | t | 1 | Adversaries may build capabilities that can be used during t |
| > | argeting. Rather than purchasing, freely downloading, or ste | > | argeting. Rather than purchasing, freely downloading, or ste | ||
| > | aling capabilities, adversaries may develop their own capabi | > | aling capabilities, adversaries may develop their own capabi | ||
| > | lities in-house. This is the process of identifying developm | > | lities in-house. This is the process of identifying developm | ||
| > | ent requirements and building solutions such as malware, exp | > | ent requirements and building solutions such as malware, exp | ||
| > | loits, and self-signed certificates. Adversaries may develop | > | loits, and self-signed certificates. Adversaries may develop | ||
| > | capabilities to support their operations throughout numerou | > | capabilities to support their operations throughout numerou | ||
| > | s phases of the adversary lifecycle.(Citation: Mandiant APT1 | > | s phases of the adversary lifecycle.(Citation: Mandiant APT1 | ||
| > | )(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPi | > | )(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPi | ||
| > | ty June 2020)(Citation: Talos Promethium June 2020) As with | > | ty June 2020)(Citation: Talos Promethium June 2020) As with | ||
| > | legitimate development efforts, different skill sets may be | > | legitimate development efforts, different skill sets may be | ||
| > | required for developing capabilities. The skills needed may | > | required for developing capabilities. The skills needed may | ||
| > | be located in-house, or may need to be contracted out. Use | > | be located in-house, or may need to be contracted out. Use | ||
| > | of a contractor may be considered an extension of that adver | > | of a contractor may be considered an extension of that adver | ||
| > | sary's development capabilities, provided the adversary play | > | sary's development capabilities, provided the adversary play | ||
| > | s a role in shaping requirements and maintains a degree of e | > | s a role in shaping requirements and maintains a degree of e | ||
| > | xclusivity to the capability. | > | xclusivity to the capability. Adversaries may also employ th | ||
| > | e use of [Artificial Intelligence](https://attack.mitre.org/ | ||||
| > | techniques/T1588/007) for development. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create self-signed SSL/TLS certificates that | t | 1 | Adversaries may create self-signed SSL/TLS certificates that |
| > | can be used during targeting. SSL/TLS certificates are desi | > | can be used during targeting. SSL/TLS certificates are desi | ||
| > | gned to instill trust. They include information about the ke | > | gned to instill trust. They include information about the ke | ||
| > | y, information about its owner's identity, and the digital s | > | y, information about its owner's identity, and the digital s | ||
| > | ignature of an entity that has verified the certificate's co | > | ignature of an entity that has verified the certificate's co | ||
| > | ntents are correct. If the signature is valid, and the perso | > | ntents are correct. If the signature is valid, and the perso | ||
| > | n examining the certificate trusts the signer, then they kno | > | n examining the certificate trusts the signer, then they kno | ||
| > | w they can use that key to communicate with its owner. In th | > | w they can use that key to communicate with its owner. In th | ||
| > | e case of self-signing, digital certificates will lack the e | > | e case of self-signing, digital certificates will lack the e | ||
| > | lement of trust associated with the signature of a third-par | > | lement of trust associated with the signature of a third-par | ||
| > | ty certificate authority (CA). Adversaries may create self- | > | ty certificate authority (CA).(Citation: Spice Works Digital | ||
| > | signed SSL/TLS certificates that can be used to further thei | > | Certificates) Adversaries may create self-signed SSL/TLS c | ||
| > | r operations, such as encrypting C2 traffic (ex: [Asymmetric | > | ertificates that can be used to further their operations, su | ||
| > | Cryptography](https://attack.mitre.org/techniques/T1573/002 | > | ch as encrypting C2 traffic (ex: [Asymmetric Cryptography](h | ||
| > | ) with [Web Protocols](https://attack.mitre.org/techniques/T | > | ttps://attack.mitre.org/techniques/T1573/002) with [Web Prot | ||
| > | 1071/001)) or even enabling [Adversary-in-the-Middle](https: | > | ocols](https://attack.mitre.org/techniques/T1071/001)) or ev | ||
| > | //attack.mitre.org/techniques/T1557) if added to the root of | > | en enabling [Adversary-in-the-Middle](https://attack.mitre.o | ||
| > | trust (i.e. [Install Root Certificate](https://attack.mitre | > | rg/techniques/T1557) if added to the root of trust (i.e. [In | ||
| > | .org/techniques/T1553/004)). After creating a digital certi | > | stall Root Certificate](https://attack.mitre.org/techniques/ | ||
| > | ficate, an adversary may then install that certificate (see | > | T1553/004)). After creating a digital certificate, an adver | ||
| > | [Install Digital Certificate](https://attack.mitre.org/techn | > | sary may then install that certificate (see [Install Digital | ||
| > | iques/T1608/003)) on infrastructure under their control. | > | Certificate](https://attack.mitre.org/techniques/T1608/003) | ||
| > | ) on infrastructure under their control. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may target an Exchange server, Office 365, or Go | t | 1 | Adversaries may target an Exchange server, Office 365, or Go |
| > | ogle Workspace to collect sensitive information. Adversaries | > | ogle Workspace to collect sensitive information. Adversaries | ||
| > | may leverage a user's credentials and interact directly wit | > | may leverage a user's credentials and interact directly wit | ||
| > | h the Exchange server to acquire information from within a n | > | h the Exchange server to acquire information from within a n | ||
| > | etwork. Adversaries may also access externally facing Exchan | > | etwork. Adversaries may also access externally facing Exchan | ||
| > | ge services, Office 365, or Google Workspace to access email | > | ge services, Office 365, or Google Workspace to access email | ||
| > | using credentials or access tokens. Tools such as [MailSnip | > | using credentials or access tokens. Tools such as [MailSnip | ||
| > | er](https://attack.mitre.org/software/S0413) can be used to | > | er](https://attack.mitre.org/software/S0413) can be used to | ||
| > | automate searches for specific keywords. | > | automate searches for specific keywords.(Citation: Cybersecu | ||
| > | rity Advisory GRU Brute Force Campaign July 2021) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may employ a known asymmetric encryption algorit | t | 1 | Adversaries may employ a known asymmetric encryption algorit |
| > | hm to conceal command and control traffic rather than relyin | > | hm to conceal command and control traffic rather than relyin | ||
| > | g on any inherent protections provided by a communication pr | > | g on any inherent protections provided by a communication pr | ||
| > | otocol. Asymmetric cryptography, also known as public key cr | > | otocol. Asymmetric cryptography, also known as public key cr | ||
| > | yptography, uses a keypair per party: one public that can be | > | yptography, uses a keypair per party: one public that can be | ||
| > | freely distributed, and one private. Due to how the keys ar | > | freely distributed, and one private. Due to how the keys ar | ||
| > | e generated, the sender encrypts data with the receiver\u2019s pu | > | e generated, the sender encrypts data with the receiver\u2019s pu | ||
| > | blic key and the receiver decrypts the data with their priva | > | blic key and the receiver decrypts the data with their priva | ||
| > | te key. This ensures that only the intended recipient can re | > | te key. This ensures that only the intended recipient can re | ||
| > | ad the encrypted data. Common public key encryption algorith | > | ad the encrypted data. Common public key encryption algorith | ||
| > | ms include RSA and ElGamal. For efficiency, many protocols | > | ms include RSA and ElGamal. For efficiency, many protocols | ||
| > | (including SSL/TLS) use symmetric cryptography once a connec | > | (including SSL/TLS) use symmetric cryptography once a connec | ||
| > | tion is established, but use asymmetric cryptography to esta | > | tion is established, but use asymmetric cryptography to esta | ||
| > | blish or transmit a key. As such, these protocols are classi | > | blish or transmit a key. As such, these protocols are classi | ||
| > | fied as [Asymmetric Cryptography](https://attack.mitre.org/t | > | fied as [Asymmetric Cryptography](https://attack.mitre.org/t | ||
| > | echniques/T1573/002). | > | echniques/T1573/002).(Citation: What is asymmetric encryptio | ||
| > | n)(Citation: Symmetric vs Asymmetric Cryptography) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may employ a known symmetric encryption algorith | t | 1 | Adversaries may employ a known symmetric encryption algorith |
| > | m to conceal command and control traffic rather than relying | > | m to conceal command and control traffic rather than relying | ||
| > | on any inherent protections provided by a communication pro | > | on any inherent protections provided by a communication pro | ||
| > | tocol. Symmetric encryption algorithms use the same key for | > | tocol. Symmetric encryption algorithms use the same key for | ||
| > | plaintext encryption and ciphertext decryption. Common symme | > | plaintext encryption and ciphertext decryption. Common symme | ||
| > | tric encryption algorithms include AES, DES, 3DES, Blowfish, | > | tric encryption algorithms include AES, DES, 3DES, Blowfish, | ||
| > | and RC4. | > | and RC4.(Citation: Destination Certification)(Citation: Sym | ||
| > | metric vs Asymmetric Cryptography) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may steal data by exfiltrating it over an asymme | t | 1 | Adversaries may steal data by exfiltrating it over an asymme |
| > | trically encrypted network protocol other than that of the e | > | trically encrypted network protocol other than that of the e | ||
| > | xisting command and control channel. The data may also be se | > | xisting command and control channel. The data may also be se | ||
| > | nt to an alternate network location from the main command an | > | nt to an alternate network location from the main command an | ||
| > | d control server. Asymmetric encryption algorithms are tho | > | d control server. Asymmetric encryption algorithms are tho | ||
| > | se that use different keys on each end of the channel. Also | > | se that use different keys on each end of the channel. Also | ||
| > | known as public-key cryptography, this requires pairs of cry | > | known as public-key cryptography, this requires pairs of cry | ||
| > | ptographic keys that can encrypt/decrypt data from the corre | > | ptographic keys that can encrypt/decrypt data from the corre | ||
| > | sponding key. Each end of the communication channels require | > | sponding key. Each end of the communication channels require | ||
| > | s a private key (only in the procession of that entity) and | > | s a private key (only in the procession of that entity) and | ||
| > | the public key of the other entity. The public keys of each | > | the public key of the other entity. The public keys of each | ||
| > | entity are exchanged before encrypted communications begin. | > | entity are exchanged before encrypted communications begin. | ||
| > | Network protocols that use asymmetric encryption (such as | > | Network protocols that use asymmetric encryption (such as | ||
| > | HTTPS/TLS/SSL) often utilize symmetric encryption once keys | > | HTTPS/TLS/SSL) often utilize symmetric encryption once keys | ||
| > | are exchanged. Adversaries may opt to use these encrypted me | > | are exchanged.(Citation: Cybersecurity Advisory GRU Brute Fo | ||
| > | chanisms that are baked into a protocol. | > | rce Campaign July 2021) Adversaries may opt to use these enc | ||
| > | rypted mechanisms that are baked into a protocol. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may steal data by exfiltrating it over a symmetr | t | 1 | Adversaries may steal data by exfiltrating it over a symmetr |
| > | ically encrypted network protocol other than that of the exi | > | ically encrypted network protocol other than that of the exi | ||
| > | sting command and control channel. The data may also be sent | > | sting command and control channel. The data may also be sent | ||
| > | to an alternate network location from the main command and | > | to an alternate network location from the main command and | ||
| > | control server. Symmetric encryption algorithms are those | > | control server. Symmetric encryption algorithms are those | ||
| > | that use shared or the same keys/secrets on each end of the | > | that use shared or the same keys/secrets on each end of the | ||
| > | channel. This requires an exchange or pre-arranged agreement | > | channel. This requires an exchange or pre-arranged agreement | ||
| > | /possession of the value used to encrypt and decrypt data. | > | /possession of the value used to encrypt and decrypt data.(C | ||
| > | Network protocols that use asymmetric encryption often util | > | itation: Exfiltration Over Symmetric Encrypted Non-C2 Protoc | ||
| > | ize symmetric encryption once keys are exchanged, but advers | > | ol) Network protocols that use asymmetric encryption often | ||
| > | aries may opt to manually share keys and implement symmetric | > | utilize symmetric encryption once keys are exchanged, but ad | ||
| > | cryptographic algorithms (ex: RC4, AES) vice using mechanis | > | versaries may opt to manually share keys and implement symme | ||
| > | ms that are baked into a protocol. This may result in multip | > | tric cryptographic algorithms (ex: RC4, AES) vice using mech | ||
| > | le layers of encryption (in protocols that are natively encr | > | anisms that are baked into a protocol. This may result in mu | ||
| > | ypted such as HTTPS) or encryption in protocols that not typ | > | ltiple layers of encryption (in protocols that are natively | ||
| > | ically encrypted (such as HTTP or FTP). | > | encrypted such as HTTPS) or encryption in protocols that not | ||
| > | typically encrypted (such as HTTP or FTP). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may steal data by exfiltrating it over an existi | t | 1 | Adversaries may steal data by exfiltrating it over an existi |
| > | ng command and control channel. Stolen data is encoded into | > | ng command and control channel. Stolen data is encoded into | ||
| > | the normal communications channel using the same protocol as | > | the normal communications channel using the same protocol as | ||
| > | command and control communications. | > | command and control communications.(Citation: C2 FRAMEWORKS | ||
| > | ) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to exfiltrate data via a physical me | t | 1 | Adversaries may attempt to exfiltrate data via a physical me |
| > | dium, such as a removable drive. In certain circumstances, s | > | dium, such as a removable drive. In certain circumstances, s | ||
| > | uch as an air-gapped network compromise, exfiltration could | > | uch as an air-gapped network compromise, exfiltration could | ||
| > | occur via a physical medium or device introduced by a user. | > | occur via a physical medium or device introduced by a user. | ||
| > | Such media could be an external hard drive, USB drive, cellu | > | Such media could be an external hard drive, USB drive, cellu | ||
| > | lar phone, MP3 player, or other removable storage and proces | > | lar phone, MP3 player, or other removable storage and proces | ||
| > | sing device. The physical medium or device could be used as | > | sing device. The physical medium or device could be used as | ||
| > | the final exfiltration point or to hop between otherwise dis | > | the final exfiltration point or to hop between otherwise dis | ||
| > | connected systems. | > | connected systems.(Citation: USB Drives Threaten Enterprise | ||
| > | Security)(Citation: Tropic Trooper\u2019s USBferry)(Citation: APT | ||||
| > | 37 Adds New Capabilities for Air-Gapped Networks) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to exfiltrate data over a USB connec | t | 1 | Adversaries may attempt to exfiltrate data over a USB connec |
| > | ted physical device. In certain circumstances, such as an ai | > | ted physical device. In certain circumstances, such as an ai | ||
| > | r-gapped network compromise, exfiltration could occur via a | > | r-gapped network compromise, exfiltration could occur via a | ||
| > | USB device introduced by a user. The USB device could be use | > | USB device introduced by a user. The USB device could be use | ||
| > | d as the final exfiltration point or to hop between otherwis | > | d as the final exfiltration point or to hop between otherwis | ||
| > | e disconnected systems. | > | e disconnected systems.(Citation: A USB data exfiltration ca | ||
| > | se study) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking the way operating systems run programs. Hijacking exec | > | cking the way operating systems run programs. Hijacking exec | ||
| > | ution flow can be for the purposes of persistence, since thi | > | ution flow can be for the purposes of persistence, since thi | ||
| > | s hijacked execution may reoccur over time. Adversaries may | > | s hijacked execution may reoccur over time. Adversaries may | ||
| > | also use these mechanisms to elevate privileges or evade def | > | also use these mechanisms to elevate privileges or evade def | ||
| > | enses, such as application control or other restrictions on | > | enses, such as application control or other restrictions on | ||
| > | execution. There are many ways an adversary may hijack the | > | execution. There are many ways an adversary may hijack the | ||
| > | flow of execution, including by manipulating how the operati | > | flow of execution, including by manipulating how the operati | ||
| > | ng system locates programs to be executed. How the operating | > | ng system locates programs to be executed. How the operating | ||
| > | system locates libraries to be used by a program can also b | > | system locates libraries to be used by a program can also b | ||
| > | e intercepted. Locations where the operating system looks fo | > | e intercepted. Locations where the operating system looks fo | ||
| > | r programs/resources, such as file directories and in the ca | > | r programs/resources, such as file directories and in the ca | ||
| > | se of Windows the Registry, could also be poisoned to includ | > | se of Windows the Registry, could also be poisoned to includ | ||
| > | e malicious payloads. | > | e malicious payloads.(Citation: Execution flow hijack attemp | ||
| > | t) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may make changes to the operating system of embe | t | 1 | Adversaries may make changes to the operating system of embe |
| > | dded network devices to weaken defenses and provide new capa | > | dded network devices to weaken defenses and provide new capa | ||
| > | bilities for themselves. On such devices, the operating sys | > | bilities for themselves. On such devices, the operating sys | ||
| > | tems are typically monolithic and most of the device functio | > | tems are typically monolithic and most of the device functio | ||
| > | nality and capabilities are contained within a single file. | > | nality and capabilities are contained within a single file.( | ||
| > | To change the operating system, the adversary typically onl | > | Citation: Cisco Networking Software Product Lines)(Citation: | ||
| > | y needs to affect this one file, replacing or modifying it. | > | Network Device Integrity Methodology) To change the operat | ||
| > | This can either be done live in memory during system runtim | > | ing system, the adversary typically only needs to affect thi | ||
| > | e for immediate effect, or in storage to implement the chang | > | s one file, replacing or modifying it. This can either be d | ||
| > | e on the next boot of the network device. | > | one live in memory during system runtime for immediate effec | ||
| > | t, or in storage to implement the change on the next boot of | ||||
| > | the network device. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may remove indicators from tools if they believe | t | 1 | Adversaries may remove indicators from tools if they believe |
| > | their malicious tool was detected, quarantined, or otherwis | > | their malicious tool was detected, quarantined, or otherwis | ||
| > | e curtailed. They can modify the tool by removing the indica | > | e curtailed. They can modify the tool by removing the indica | ||
| > | tor and using the updated version that is no longer detected | > | tor and using the updated version that is no longer detected | ||
| > | by the target's defensive systems or subsequent targets tha | > | by the target's defensive systems or subsequent targets tha | ||
| > | t may use similar systems. A good example of this is when m | > | t may use similar systems. A good example of this is when m | ||
| > | alware is detected with a file signature and quarantined by | > | alware is detected with a file signature and quarantined by | ||
| > | anti-virus software. An adversary who can determine that the | > | anti-virus software. An adversary who can determine that the | ||
| > | malware was quarantined because of its file signature may m | > | malware was quarantined because of its file signature may m | ||
| > | odify the file to explicitly avoid that signature, and then | > | odify the file to explicitly avoid that signature, and then | ||
| > | re-use the malware. | > | re-use the malware.(Citation: Files and Antivirus Detection) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may obtain access to generative artificial intel | t | 1 | Adversaries may obtain access to generative artificial intel |
| > | ligence tools, such as large language models (LLMs), to aid | > | ligence (AI) tools, such as large language models (LLMs), to | ||
| > | various techniques during targeting. These tools may be used | > | aid various techniques during targeting. These tools may be | ||
| > | to inform, bolster, and enable a variety of malicious tasks | > | used to inform, bolster, and enable a variety of malicious | ||
| > | , including conducting [Reconnaissance](https://attack.mitre | > | tasks, including creating scripts, assisting social engineer | ||
| > | .org/tactics/TA0043), creating basic scripts, assisting soci | > | ing, developing payloads, and to [Query Public AI Services]( | ||
| > | al engineering, and even developing payloads.(Citation: MSFT | > | https://attack.mitre.org/techniques/T1682) in support of [Re | ||
| > | -AI) For example, by utilizing a publicly available LLM an | > | connaissance](https://attack.mitre.org/tactics/TA0043).(Cita | ||
| > | adversary is essentially outsourcing or automating certain | > | tion: MSFT-AI) For example, by utilizing a publicly availa | ||
| > | tasks to the tool. Using AI, the adversary may draft and gen | > | ble LLM an adversary is essentially outsourcing or automatin | ||
| > | erate content in a variety of written languages to be used i | > | g certain tasks to the tool. Using AI, the adversary may dra | ||
| > | n [Phishing](https://attack.mitre.org/techniques/T1566)/[Phi | > | ft and [Generate Content](https://attack.mitre.org/technique | ||
| > | shing for Information](https://attack.mitre.org/techniques/T | > | s/T1683) in a variety of written languages to be used in [Ph | ||
| > | 1598) campaigns. The same publicly available tool may furthe | > | ishing](https://attack.mitre.org/techniques/T1566)/[Phishing | ||
| > | r enable vulnerability or other offensive research supportin | > | for Information](https://attack.mitre.org/techniques/T1598) | ||
| > | g [Develop Capabilities](https://attack.mitre.org/techniques | > | campaigns. The same publicly available tool may further ena | ||
| > | /T1587). AI tools may also automate technical tasks by gener | > | ble vulnerability or other offensive research supporting [De | ||
| > | ating, refining, or otherwise enhancing (e.g., [Obfuscated F | > | velop Capabilities](https://attack.mitre.org/techniques/T158 | ||
| > | iles or Information](https://attack.mitre.org/techniques/T10 | > | 7). AI tools may also automate technical tasks by generating | ||
| > | 27)) malicious scripts and payloads.(Citation: OpenAI-CTI) F | > | , refining, or otherwise enhancing (e.g., [Obfuscated Files | ||
| > | inally, AI-generated text, images, audio, and video may be u | > | or Information](https://attack.mitre.org/techniques/T1027)) | ||
| > | sed for fraud, [Impersonation](https://attack.mitre.org/tech | > | malicious scripts and payloads.(Citation: OpenAI-CTI) Finall | ||
| > | niques/T1684/001), and other malicious activities.(Citation: | > | y, AI-generated text, images, audio, and video may be used f | ||
| > | Google-Vishing24)(Citation: IC3-AI24)(Citation: WSJ-Vishing | > | or fraud, [Impersonation](https://attack.mitre.org/technique | ||
| > | -AI24) | > | s/T1684/001), and other malicious activities.(Citation: Goog | ||
| > | le-Vishing24)(Citation: IC3-AI24)(Citation: WSJ-Vishing-AI24 | ||||
| > | ) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may buy, steal, or download malware that can be | t | 1 | Adversaries may buy, steal, or download malware that can be |
| > | used during targeting. Malicious software can include payloa | > | used during targeting. Malicious software can include payloa | ||
| > | ds, droppers, post-compromise tools, backdoors, packers, and | > | ds, droppers, post-compromise tools, backdoors, packers, and | ||
| > | C2 protocols. Adversaries may acquire malware to support th | > | C2 protocols. Adversaries may acquire malware to support th | ||
| > | eir operations, obtaining a means for maintaining control of | > | eir operations, obtaining a means for maintaining control of | ||
| > | remote machines, evading defenses, and executing post-compr | > | remote machines, evading defenses, and executing post-compr | ||
| > | omise behaviors. In addition to downloading free malware fr | > | omise behaviors. In addition to downloading free malware fr | ||
| > | om the internet, adversaries may purchase these capabilities | > | om the internet, adversaries may purchase these capabilities | ||
| > | from third-party entities. Third-party entities can include | > | from third-party entities. Third-party entities can include | ||
| > | technology companies that specialize in malware development | > | technology companies that specialize in malware development | ||
| > | , criminal marketplaces (including Malware-as-a-Service, or | > | , criminal marketplaces (including Malware-as-a-Service, or | ||
| > | MaaS), or from individuals. In addition to purchasing malwar | > | MaaS), or from individuals.(Citation: BITSIGHT Malware Analy | ||
| > | e, adversaries may steal and repurpose malware from third-pa | > | sis) In addition to purchasing malware, adversaries may stea | ||
| > | rty entities (including other adversaries). | > | l and repurpose malware from third-party entities (including | ||
| > | other adversaries). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may send phishing messages to gain access to vic | t | 1 | Adversaries may send phishing messages to gain access to vic |
| > | tim systems. All forms of phishing are electronically delive | > | tim systems. All forms of phishing are electronically delive | ||
| > | red social engineering. Phishing can be targeted, known as s | > | red social engineering. Phishing can be targeted, known as s | ||
| > | pearphishing. In spearphishing, a specific individual, compa | > | pearphishing. In spearphishing, a specific individual, compa | ||
| > | ny, or industry will be targeted by the adversary. More gene | > | ny, or industry will be targeted by the adversary. More gene | ||
| > | rally, adversaries can conduct non-targeted phishing, such a | > | rally, adversaries can conduct non-targeted phishing, such a | ||
| > | s in mass malware spam campaigns. Adversaries may send vict | > | s in mass malware spam campaigns. Adversaries may send vict | ||
| > | ims emails containing malicious attachments or links, typica | > | ims emails containing malicious attachments or links, typica | ||
| > | lly to execute malicious code on victim systems. Phishing ma | > | lly to execute malicious code on victim systems. Phishing ma | ||
| > | y also be conducted via third-party services, like social me | > | y also be conducted via third-party services (like social me | ||
| > | dia platforms. Phishing may also involve social engineering | > | dia platforms) or delivered via calendar invites. Phishing m | ||
| > | techniques, such as posing as a trusted source, as well as e | > | ay also involve social engineering techniques, such as posin | ||
| > | vasive techniques such as removing or manipulating emails or | > | g as a trusted source, as well as evasive techniques such as | ||
| > | metadata/headers from compromised accounts being abused to | > | removing or manipulating emails or metadata/headers from co | ||
| > | send messages (e.g., [Email Hiding Rules](https://attack.mit | > | mpromised accounts being abused to send messages (e.g., [Ema | ||
| > | re.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spa | > | il Hiding Rules](https://attack.mitre.org/techniques/T1564/0 | ||
| > | m 2022)(Citation: Palo Alto Unit 42 VBA Infostealer 2014) An | > | 08)).(Citation: Microsoft OAuth Spam 2022)(Citation: Palo Al | ||
| > | other way to accomplish this is by [Email Spoofing](https:// | > | to Unit 42 VBA Infostealer 2014) Another way to accomplish t | ||
| > | attack.mitre.org/techniques/T1684/002)(Citation: Proofpoint- | > | his is by [Email Spoofing](https://attack.mitre.org/techniqu | ||
| > | spoof) the identity of the sender, which can be used to fool | > | es/T1684/002)(Citation: Proofpoint-spoof) the identity of th | ||
| > | both the human recipient as well as automated security tool | > | e sender, which can be used to fool both the human recipient | ||
| > | s,(Citation: cyberproof-double-bounce) or by including the i | > | as well as automated security tools,(Citation: cyberproof-d | ||
| > | ntended target as a party to an existing email thread that i | > | ouble-bounce) or by including the intended target as a party | ||
| > | ncludes malicious files or links (i.e., \"thread hijacking\"). | > | to an existing email thread that includes malicious files o | ||
| > | (Citation: phishing-krebs) Victims may also receive phishin | > | r links (i.e., \"thread hijacking\").(Citation: phishing-krebs | ||
| > | g messages that instruct them to call a phone number where t | > | ) Victims may also receive phishing messages that instruct | ||
| > | hey are directed to visit a malicious URL, download malware, | > | them to call a phone number where they are directed to visit | ||
| > | (Citation: sygnia Luna Month)(Citation: CISA Remote Monitori | > | a malicious URL, download malware,(Citation: sygnia Luna Mo | ||
| > | ng and Management Software) or install adversary-accessible | > | nth)(Citation: CISA Remote Monitoring and Management Softwar | ||
| > | remote management tools onto their computer (i.e., [User Exe | > | e) or install adversary-accessible remote management tools o | ||
| > | cution](https://attack.mitre.org/techniques/T1204)).(Citatio | > | nto their computer (i.e., [User Execution](https://attack.mi | ||
| > | n: Unit42 Luna Moth) | > | tre.org/techniques/T1204)).(Citation: Unit42 Luna Moth) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use [Valid Accounts](https://attack.mitre.or | t | 1 | Adversaries may use [Valid Accounts](https://attack.mitre.or |
| > | g/techniques/T1078) to log into remote machines using Secure | > | g/techniques/T1078) to log into remote machines using Secure | ||
| > | Shell (SSH). The adversary may then perform actions as the | > | Shell (SSH). The adversary may then perform actions as the | ||
| > | logged-on user. SSH is a protocol that allows authorized us | > | logged-on user. SSH is a protocol that allows authorized us | ||
| > | ers to open remote shells on other computers. Many Linux and | > | ers to open remote shells on other computers. Many Linux and | ||
| > | macOS versions come with SSH installed by default, although | > | macOS versions come with SSH installed by default, although | ||
| > | typically disabled until the user enables it. On ESXi, SSH | > | typically disabled until the user enables it. On ESXi, SSH | ||
| > | can be enabled either directly on the host (e.g., via `vim-c | > | can be enabled either directly on the host (e.g., via `vim-c | ||
| > | md hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESX | > | md hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESX | ||
| > | i Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Cit | > | i Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Cit | ||
| > | ation: Sygnia Abyss Locker 2025) The SSH server can be confi | > | ation: Sygnia Abyss Locker 2025) Modern versions of Windows | ||
| > | gured to use standard password authentication or public-priv | > | include a built-in SSH server and client.(Citation: Windows | ||
| > | ate keypairs in lieu of or in addition to a password. In thi | > | SSH) The SSH server can be configured to use standard passwo | ||
| > | s authentication scenario, the user\u2019s public key must be in | > | rd authentication or public-private keypairs in lieu of or i | ||
| > | a special file on the computer running the server that lists | > | n addition to a password. In this authentication scenario, t | ||
| > | which keypairs are allowed to login as that user (i.e., [SS | > | he user\u2019s public key must be in a special file on the comput | ||
| > | H Authorized Keys](https://attack.mitre.org/techniques/T1098 | > | er running the server that lists which keypairs are allowed | ||
| > | /004)). | > | to login as that user (i.e., [SSH Authorized Keys](https://a | ||
| > | ttack.mitre.org/techniques/T1098/004)). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may schedule data exfiltration to be performed o | t | 1 | Adversaries may schedule data exfiltration to be performed o |
| > | nly at certain times of day or at certain intervals. This co | > | nly at certain times of day or at certain intervals. This co | ||
| > | uld be done to blend traffic patterns with normal activity o | > | uld be done to blend traffic patterns with normal activity o | ||
| > | r availability. When scheduled exfiltration is used, other | > | r availability.(Citation: Delay Code Execution in Java) Whe | ||
| > | exfiltration techniques likely apply as well to transfer the | > | n scheduled exfiltration is used, other exfiltration techniq | ||
| > | information out of the network, such as [Exfiltration Over | > | ues likely apply as well to transfer the information out of | ||
| > | C2 Channel](https://attack.mitre.org/techniques/T1041) or [E | > | the network, such as [Exfiltration Over C2 Channel](https:// | ||
| > | xfiltration Over Alternative Protocol](https://attack.mitre. | > | attack.mitre.org/techniques/T1041) or [Exfiltration Over Alt | ||
| > | org/techniques/T1048). | > | ernative Protocol](https://attack.mitre.org/techniques/T1048 | ||
| > | ). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use an existing, legitimate external Web ser | t | 1 | Adversaries may use an existing, legitimate external Web ser |
| > | vice to host information that points to additional command a | > | vice to host information that points to additional command a | ||
| > | nd control (C2) infrastructure. Adversaries may post content | > | nd control (C2) infrastructure. Adversaries may post content | ||
| > | , known as a dead drop resolver, on Web services with embedd | > | , known as a dead drop resolver, on Web services with embedd | ||
| > | ed (and often obfuscated/encoded) domains or IP addresses. O | > | ed (and often obfuscated/encoded) domains or IP addresses. O | ||
| > | nce infected, victims will reach out to and be redirected by | > | nce infected, victims will reach out to and be redirected by | ||
| > | these resolvers. Popular websites and social media acting | > | these resolvers.(Citation: Dead Drop Resolver) Popular web | ||
| > | as a mechanism for C2 may give a significant amount of cover | > | sites and social media acting as a mechanism for C2 may give | ||
| > | due to the likelihood that hosts within a network are alrea | > | a significant amount of cover due to the likelihood that ho | ||
| > | dy communicating with them prior to a compromise. Using comm | > | sts within a network are already communicating with them pri | ||
| > | on services, such as those offered by Google or Twitter, mak | > | or to a compromise. Using common services, such as those off | ||
| > | es it easier for adversaries to hide in expected noise. Web | > | ered by Google or Twitter, makes it easier for adversaries t | ||
| > | service providers commonly use SSL/TLS encryption, giving ad | > | o hide in expected noise. Web service providers commonly use | ||
| > | versaries an added level of protection. Use of a dead drop | > | SSL/TLS encryption, giving adversaries an added level of pr | ||
| > | resolver may also protect back-end C2 infrastructure from di | > | otection. Use of a dead drop resolver may also protect back | ||
| > | scovery through malware binary analysis while also enabling | > | -end C2 infrastructure from discovery through malware binary | ||
| > | operational resiliency (since this infrastructure may be dyn | > | analysis while also enabling operational resiliency (since | ||
| > | amically changed). | > | this infrastructure may be dynamically changed). |
CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\n\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal\u2019s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \n\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account\u2019s API credentials are deactivated.\n(Citation: Crowdstrike AWS User Federation Persistence)\n\nIn Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42-untangling) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user\u2019s primary password is reset.(Citation: Microsoft Entra ID App Passwords)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1098/001",
"external_id": "T1098.001"
},
{
"source_name": "Crowdstrike AWS User Federation Persistence",
"description": " Vaishnav Murthy and Joel Eng. (2023, January 30). How Adversaries Can Persist with AWS User Federation. Retrieved March 10, 2023.",
"url": "https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/"
},
{
"source_name": "Expel IO Evil in AWS",
"description": "A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.",
"url": "https://expel.io/blog/finding-evil-in-aws/"
},
{
"source_name": "SpecterOps Azure Privilege Escalation",
"description": "Andy Robbins. (2021, October 12). Azure Privilege Escalation via Service Principal Abuse. Retrieved April 1, 2022.",
"url": "https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5"
},
{
"source_name": "Demystifying Azure AD Service Principals",
"description": "Bellavance, Ned. (2019, July 16). Demystifying Azure AD Service Principals. Retrieved January 19, 2020.",
"url": "https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/"
},
{
"source_name": "Lacework AI Resource Hijacking 2024",
"description": "Detecting AI resource-hijacking with Composite Alerts. (2024, June 6). Lacework Labs. Retrieved July 1, 2024.",
"url": "https://www.lacework.com/blog/detecting-ai-resource-hijacking-with-composite-alerts"
},
{
"source_name": "GCP SSH Key Add",
"description": "Google. (n.d.). gcloud compute os-login ssh-keys add. Retrieved October 1, 2020.",
"url": "https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add"
},
{
"source_name": "Permiso Scattered Spider 2023",
"description": "Ian Ahl. (2023, September 20). LUCR-3: SCATTERED SPIDER GETTING SAAS-Y IN THE CLOUD. Retrieved September 25, 2023.",
"url": "https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud"
},
{
"source_name": "Blue Cloud of Death Video",
"description": "Kunz, Bruce. (2018, October 14). Blue Cloud of Death: Red Teaming Azure. Retrieved November 21, 2019.",
"url": "https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815"
},
{
"source_name": "Blue Cloud of Death",
"description": "Kunz, Bryce. (2018, May 11). Blue Cloud of Death: Red Teaming Azure. Retrieved October 23, 2019.",
"url": "https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1"
},
{
"source_name": "Microsoft Entra ID App Passwords",
"description": "Microsoft. (2023, October 23). Enforce Microsoft Entra multifactor authentication with legacy applications using app passwords. Retrieved May 28, 2024.",
"url": "https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-app-passwords"
},
{
"source_name": "Microsoft SolarWinds Customer Guidance",
"description": "MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 17, 2020.",
"url": "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"
},
{
"source_name": "Mandiant APT42-untangling",
"description": "Rozmann, O., et al. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved October 9, 2024.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"
},
{
"source_name": "Expel Behind the Scenes",
"description": "S. Lipton, L. Easterly, A. Randazzo and J. Hencinski. (2020, July 28). Behind the scenes in the Expel SOC: Alert-to-fix in AWS. Retrieved October 1, 2020.",
"url": "https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/"
},
{
"source_name": "Sysdig ScarletEel 2.0",
"description": "SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto. (2023, July 11). SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto. Retrieved July 12, 2023.",
"url": "https://sysdig.com/blog/scarleteel-2-0/"
},
{
"source_name": "Rhino Security Labs AWS Privilege Escalation",
"description": "Spencer Gietzen. (n.d.). AWS IAM Privilege Escalation \u2013 Methods and Mitigation. Retrieved May 27, 2022.",
"url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Expel",
"Oleg Kolesnikov, Securonix",
"Jannie Li, Microsoft Threat Intelligence\u202fCenter\u202f(MSTIC)",
"Zur Ulianitzky, XM Cyber",
"Alex Soler, AttackIQ",
"Dylan Silva, AWS Security",
"Arad Inbar, Fidelis Security",
"Arun Seelagan, CISA"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"IaaS",
"Identity Provider",
"SaaS"
],
"x_mitre_version": "2.8",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-17 17:49:30.904000+00:00\", \"old_value\": \"2025-10-24 17:49:04.839000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\\n\\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\\n\\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\\n\\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal\\u2019s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \\n\\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account\\u2019s API credentials are deactivated.\\n(Citation: Crowdstrike AWS User Federation Persistence)\\n\\nIn Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42-untangling) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user\\u2019s primary password is reset.(Citation: Microsoft Entra ID App Passwords)\", \"old_value\": \"Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\\n\\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\\n\\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\\n\\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal\\u2019s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \\n\\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account\\u2019s API credentials are deactivated.\\n(Citation: Crowdstrike AWS User Federation Persistence)\\n\\nIn Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42 Operations 2024) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user\\u2019s primary password is reset.(Citation: Microsoft Entra ID App Passwords)\", \"diff\": \"--- \\n+++ \\n@@ -9,4 +9,4 @@\\n In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account\\u2019s API credentials are deactivated.\\n (Citation: Crowdstrike AWS User Federation Persistence)\\n \\n-In Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42 Operations 2024) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user\\u2019s primary password is reset.(Citation: Microsoft Entra ID App Passwords)\\n+In Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42-untangling) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user\\u2019s primary password is reset.(Citation: Microsoft Entra ID App Passwords)\"}, \"root['external_references'][12]['source_name']\": {\"new_value\": \"Mandiant APT42-untangling\", \"old_value\": \"Mandiant APT42 Operations 2024\"}, \"root['external_references'][12]['description']\": {\"new_value\": \"Rozmann, O., et al. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved October 9, 2024.\", \"old_value\": \"Ofir Rozmann, Asli Koksal, Adrian Hernandez, Sarah Bock, and Jonathan Leathery. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved May 28, 2024.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.8",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may add adversary-controlled credentials to a cl | t | 1 | Adversaries may add adversary-controlled credentials to a cl |
| > | oud account to maintain persistent access to victim accounts | > | oud account to maintain persistent access to victim accounts | ||
| > | and instances within the environment. For example, adversa | > | and instances within the environment. For example, adversa | ||
| > | ries may add credentials for Service Principals and Applicat | > | ries may add credentials for Service Principals and Applicat | ||
| > | ions in addition to existing legitimate credentials in Azure | > | ions in addition to existing legitimate credentials in Azure | ||
| > | / Entra ID.(Citation: Microsoft SolarWinds Customer Guidanc | > | / Entra ID.(Citation: Microsoft SolarWinds Customer Guidanc | ||
| > | e)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of De | > | e)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of De | ||
| > | ath Video) These credentials include both x509 keys and pass | > | ath Video) These credentials include both x509 keys and pass | ||
| > | words.(Citation: Microsoft SolarWinds Customer Guidance) Wit | > | words.(Citation: Microsoft SolarWinds Customer Guidance) Wit | ||
| > | h sufficient permissions, there are a variety of ways to add | > | h sufficient permissions, there are a variety of ways to add | ||
| > | credentials including the Azure Portal, Azure command line | > | credentials including the Azure Portal, Azure command line | ||
| > | interface, and Azure or Az PowerShell modules.(Citation: Dem | > | interface, and Azure or Az PowerShell modules.(Citation: Dem | ||
| > | ystifying Azure AD Service Principals) In infrastructure-as | > | ystifying Azure AD Service Principals) In infrastructure-as | ||
| > | -a-service (IaaS) environments, after gaining access through | > | -a-service (IaaS) environments, after gaining access through | ||
| > | [Cloud Accounts](https://attack.mitre.org/techniques/T1078/ | > | [Cloud Accounts](https://attack.mitre.org/techniques/T1078/ | ||
| > | 004), adversaries may generate or import their own SSH keys | > | 004), adversaries may generate or import their own SSH keys | ||
| > | using either the <code>CreateKeyPair</code> or <code>ImportK | > | using either the <code>CreateKeyPair</code> or <code>ImportK | ||
| > | eyPair</code> API in AWS or the <code>gcloud compute os-logi | > | eyPair</code> API in AWS or the <code>gcloud compute os-logi | ||
| > | n ssh-keys add</code> command in GCP.(Citation: GCP SSH Key | > | n ssh-keys add</code> command in GCP.(Citation: GCP SSH Key | ||
| > | Add) This allows persistent access to instances within the c | > | Add) This allows persistent access to instances within the c | ||
| > | loud environment without further usage of the compromised cl | > | loud environment without further usage of the compromised cl | ||
| > | oud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expe | > | oud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expe | ||
| > | l Behind the Scenes) Adversaries may also use the <code>Cre | > | l Behind the Scenes) Adversaries may also use the <code>Cre | ||
| > | ateAccessKey</code> API in AWS or the <code>gcloud iam servi | > | ateAccessKey</code> API in AWS or the <code>gcloud iam servi | ||
| > | ce-accounts keys create</code> command in GCP to add access | > | ce-accounts keys create</code> command in GCP to add access | ||
| > | keys to an account. Alternatively, they may use the <code>Cr | > | keys to an account. Alternatively, they may use the <code>Cr | ||
| > | eateLoginProfile</code> API in AWS to add a password that ca | > | eateLoginProfile</code> API in AWS to add a password that ca | ||
| > | n be used to log into the AWS Management Console for [Cloud | > | n be used to log into the AWS Management Console for [Cloud | ||
| > | Service Dashboard](https://attack.mitre.org/techniques/T1538 | > | Service Dashboard](https://attack.mitre.org/techniques/T1538 | ||
| > | ).(Citation: Permiso Scattered Spider 2023)(Citation: Lacewo | > | ).(Citation: Permiso Scattered Spider 2023)(Citation: Lacewo | ||
| > | rk AI Resource Hijacking 2024) If the target account has dif | > | rk AI Resource Hijacking 2024) If the target account has dif | ||
| > | ferent permissions from the requesting account, the adversar | > | ferent permissions from the requesting account, the adversar | ||
| > | y may also be able to escalate their privileges in the envir | > | y may also be able to escalate their privileges in the envir | ||
| > | onment (i.e. [Cloud Accounts](https://attack.mitre.org/techn | > | onment (i.e. [Cloud Accounts](https://attack.mitre.org/techn | ||
| > | iques/T1078/004)).(Citation: Rhino Security Labs AWS Privile | > | iques/T1078/004)).(Citation: Rhino Security Labs AWS Privile | ||
| > | ge Escalation)(Citation: Sysdig ScarletEel 2.0) For example, | > | ge Escalation)(Citation: Sysdig ScarletEel 2.0) For example, | ||
| > | in Entra ID environments, an adversary with the Application | > | in Entra ID environments, an adversary with the Application | ||
| > | Administrator role can add a new set of credentials to thei | > | Administrator role can add a new set of credentials to thei | ||
| > | r application's service principal. In doing so the adversary | > | r application's service principal. In doing so the adversary | ||
| > | would be able to access the service principal\u2019s roles and p | > | would be able to access the service principal\u2019s roles and p | ||
| > | ermissions, which may be different from those of the Applica | > | ermissions, which may be different from those of the Applica | ||
| > | tion Administrator.(Citation: SpecterOps Azure Privilege Esc | > | tion Administrator.(Citation: SpecterOps Azure Privilege Esc | ||
| > | alation) In AWS environments, adversaries with the appropr | > | alation) In AWS environments, adversaries with the appropr | ||
| > | iate permissions may also use the `sts:GetFederationToken` A | > | iate permissions may also use the `sts:GetFederationToken` A | ||
| > | PI call to create a temporary set of credentials to [Forge W | > | PI call to create a temporary set of credentials to [Forge W | ||
| > | eb Credentials](https://attack.mitre.org/techniques/T1606) t | > | eb Credentials](https://attack.mitre.org/techniques/T1606) t | ||
| > | ied to the permissions of the original user account. These t | > | ied to the permissions of the original user account. These t | ||
| > | emporary credentials may remain valid for the duration of th | > | emporary credentials may remain valid for the duration of th | ||
| > | eir lifetime even if the original account\u2019s API credentials | > | eir lifetime even if the original account\u2019s API credentials | ||
| > | are deactivated. (Citation: Crowdstrike AWS User Federation | > | are deactivated. (Citation: Crowdstrike AWS User Federation | ||
| > | Persistence) In Entra ID environments with the app password | > | Persistence) In Entra ID environments with the app password | ||
| > | feature enabled, adversaries may be able to add an app pass | > | feature enabled, adversaries may be able to add an app pass | ||
| > | word to a user account.(Citation: Mandiant APT42 Operations | > | word to a user account.(Citation: Mandiant APT42-untangling) | ||
| > | 2024) As app passwords are intended to be used with legacy d | > | As app passwords are intended to be used with legacy device | ||
| > | evices that do not support multi-factor authentication (MFA) | > | s that do not support multi-factor authentication (MFA), add | ||
| > | , adding an app password can allow an adversary to bypass MF | > | ing an app password can allow an adversary to bypass MFA req | ||
| > | A requirements. Additionally, app passwords may remain valid | > | uirements. Additionally, app passwords may remain valid even | ||
| > | even if the user\u2019s primary password is reset.(Citation: Mic | > | if the user\u2019s primary password is reset.(Citation: Microsof | ||
| > | rosoft Entra ID App Passwords) | > | t Entra ID App Passwords) |
build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image)\n\nAn adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they may utilize [Deploy Container](https://attack.mitre.org/techniques/T1610) using that custom image.(Citation: Aqua Build Images on Hosts)(Citation: Aqua Security Cloud Native Threat Report June 2021) If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it\u2019s a vanilla image. If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1612",
"external_id": "T1612"
},
{
"source_name": "Aqua Build Images on Hosts",
"description": "Assaf Morag. (2020, July 15). Threat Alert: Attackers Building Malicious Images on Your Hosts. Retrieved March 29, 2021.",
"url": "https://blog.aquasec.com/malicious-container-image-docker-container-host"
},
{
"source_name": "Docker Build Image",
"description": "Docker. ( null). Docker Engine API v1.41 Reference - Build an Image. Retrieved March 30, 2021.",
"url": "https://docs.docker.com/engine/api/v1.41/#operation/ImageBuild"
},
{
"source_name": "Aqua Security Cloud Native Threat Report June 2021",
"description": "Team Nautilus. (2021, June). Attacks in the Wild on the Container Supply Chain and Infrastructure. Retrieved October 7, 2026.",
"url": "https://web.archive.org/web/20220106180157/https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Assaf Morag, @MoragAssaf, Team Nautilus Aqua Security",
"Roi Kol, @roykol1, Team Nautilus Aqua Security",
"Michael Katchinskiy, @michael64194968, Team Nautilus Aqua Security",
"Vishwas Manral, McAfee"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Containers"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-10-07 17:57:15.222000+00:00\", \"old_value\": \"2026-05-12 15:12:00.662000+00:00\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"Team Nautilus. (2021, June). Attacks in the Wild on the Container Supply Chain and Infrastructure. Retrieved October 7, 2026.\", \"old_value\": \"Team Nautilus. (2021, June). Attacks in the Wild on the Container Supply Chain and Infrastructure. Retrieved August 26, 2021.\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://web.archive.org/web/20220106180157/https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf\", \"old_value\": \"https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf?utm_campaign=WP%20-%20Jun2021%20Nautilus%202021%20Threat%20Research%20Report&utm_medium=email&_hsmi=132931006&_hsenc=p2ANqtz-_8oopT5Uhqab8B7kE0l3iFo1koirxtyfTehxF7N-EdGYrwk30gfiwp5SiNlW3G0TNKZxUcDkYOtwQ9S6nNVNyEO-Dgrw&utm_content=132931006&utm_source=hs_automation\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [
"M1026: Privileged Account Management",
"M1030: Network Segmentation",
"M1035: Limit Access to Resource Over Network",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0459: Detection Strategy for Build Image on Host"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--7e3beebd-8bfe-4e7b-a892-e44ab06a75f9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 00:36:30.759000+00:00",
"modified": "2026-09-18 00:31:20.766000+00:00",
"name": "Compromise Infrastructure",
"description": "Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.\n\nUse of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Adversaries may also compromise numerous machines to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services or to form a botnet.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking) Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain [Initial Access](https://attack.mitre.org/tactics/TA0001) via [Wi-Fi Networks](https://attack.mitre.org/techniques/T1669).(Citation: Nearest Neighbor Volexity)\n\nBy using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1584",
"external_id": "T1584"
},
{
"source_name": "amnesty_nso_pegasus",
"description": "Amnesty International Security Lab. (2021, July 18). Forensic Methodology Report: How to catch NSO Group\u2019s Pegasus. Retrieved February 22, 2022.",
"url": "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/"
},
{
"source_name": "Sysdig Proxyjacking",
"description": "Crystal Morin. (2023, April 4). Proxyjacking has Entered the Chat. Retrieved July 6, 2023.",
"url": "https://sysdig.com/blog/proxyjacking-attackers-log4j-exploited/"
},
{
"source_name": "FireEye DNS Hijack 2019",
"description": "Hirani, M., Jones, S., Read, B. (2019, January 10). Global DNS Hijacking Campaign: DNS Record Manipulation at Scale. Retrieved October 9, 2020.",
"url": "https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html"
},
{
"source_name": "ICANNDomainNameHijacking",
"description": "ICANN Security and Stability Advisory Committee. (2005, July 12). Domain Name Hijacking: Incidents, Threats, Risks and Remediation. Retrieved November 17, 2024.",
"url": "https://www.icann.org/en/ssac/registration-services/documents/sac-007-domain-name-hijacking-incidents-threats-risks-and-remediation-12-07-2005-en"
},
{
"source_name": "Koczwara Beacon Hunting Sep 2021",
"description": "Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021.",
"url": "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"
},
{
"source_name": "Nearest Neighbor Volexity",
"description": "Koessel, Sean. Adair, Steven. Lancaster, Tom. (2024, November 22). The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access. Retrieved February 25, 2025.",
"url": "https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"
},
{
"source_name": "Mandiant APT1",
"description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
},
{
"source_name": "Talos DNSpionage Nov 2018",
"description": "Mercer, W., Rascagneres, P. (2018, November 27). DNSpionage Campaign Targets Middle East. Retrieved October 9, 2020.",
"url": "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"
},
{
"source_name": "NSA NCSC Turla OilRig",
"description": "NSA/NCSC. (2019, October 21). Cybersecurity Advisory: Turla Group Exploits Iranian APT To Expand Coverage Of Victims. Retrieved October 16, 2020.",
"url": "https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf"
},
{
"source_name": "Mandiant SCANdalous Jul 2020",
"description": "Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved November 17, 2024.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/"
},
{
"source_name": "ThreatConnect Infrastructure Dec 2020",
"description": "ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.",
"url": "https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"
},
{
"source_name": "FireEye EPS Awakens Part 2",
"description": "Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.",
"url": "https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Jeremy Galloway",
"Shailesh Tiwary (Indian Army)",
"Menachem Goldstein",
"Cian Heasley",
"Rouven Bissinger (SySS GmbH)"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.6",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-18 00:31:20.766000+00:00\", \"old_value\": \"2025-10-24 17:49:01.181000+00:00\"}, \"root['external_references'][11]['description']\": {\"new_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.\", \"old_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.\"}, \"root['external_references'][11]['url']\": {\"new_value\": \"https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/\", \"old_value\": \"https://threatconnect.com/blog/infrastructure-research-hunting/\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.6",
"changelog_mitigations": {
"shared": [
"M1056: Pre-compromise"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0885: Detection of Compromise Infrastructure"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--e196b5c5-8118-4a1c-ab8a-936586ce3db5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 00:56:25.135000+00:00",
"modified": "2026-09-18 00:31:18.340000+00:00",
"name": "Server",
"description": "Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.(Citation: TrendMicro EarthLusca 2022) Instead of purchasing a [Server](https://attack.mitre.org/techniques/T1583/004) or [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may compromise third-party servers in support of operations.\n\nAdversaries may also compromise web servers to support watering hole operations, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), or email servers to support [Phishing](https://attack.mitre.org/techniques/T1566) operations.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1584/004",
"external_id": "T1584.004"
},
{
"source_name": "TrendMicro EarthLusca 2022",
"description": "Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca\u2019s Operations. Retrieved July 1, 2022.",
"url": "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"
},
{
"source_name": "Koczwara Beacon Hunting Sep 2021",
"description": "Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021.",
"url": "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"
},
{
"source_name": "Mandiant SCANdalous Jul 2020",
"description": "Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved November 17, 2024.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/"
},
{
"source_name": "ThreatConnect Infrastructure Dec 2020",
"description": "ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.",
"url": "https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dor Edry, Microsoft"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-18 00:31:18.340000+00:00\", \"old_value\": \"2026-05-12 15:12:00.722000+00:00\"}, \"root['external_references'][4]['description']\": {\"new_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.\", \"old_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.\"}, \"root['external_references'][4]['url']\": {\"new_value\": \"https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/\", \"old_value\": \"https://threatconnect.com/blog/infrastructure-research-hunting/\"}}}",
"previous_version": "1.2",
"changelog_mitigations": {
"shared": [
"M1056: Pre-compromise"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0874: Detection of Server"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--39cc9f64-cf74-4a48-a4d8-fe98c54a02e0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 00:55:17.771000+00:00",
"modified": "2026-09-18 00:31:18.338000+00:00",
"name": "Virtual Private Server",
"description": "Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig)\n\nCompromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1584/003",
"external_id": "T1584.003"
},
{
"source_name": "Koczwara Beacon Hunting Sep 2021",
"description": "Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021.",
"url": "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"
},
{
"source_name": "NSA NCSC Turla OilRig",
"description": "NSA/NCSC. (2019, October 21). Cybersecurity Advisory: Turla Group Exploits Iranian APT To Expand Coverage Of Victims. Retrieved October 16, 2020.",
"url": "https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf"
},
{
"source_name": "Mandiant SCANdalous Jul 2020",
"description": "Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved November 17, 2024.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/"
},
{
"source_name": "ThreatConnect Infrastructure Dec 2020",
"description": "ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.",
"url": "https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-18 00:31:18.338000+00:00\", \"old_value\": \"2026-05-12 15:12:00.627000+00:00\"}, \"root['external_references'][4]['description']\": {\"new_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.\", \"old_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.\"}, \"root['external_references'][4]['url']\": {\"new_value\": \"https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/\", \"old_value\": \"https://threatconnect.com/blog/infrastructure-research-hunting/\"}}}",
"previous_version": "1.1",
"changelog_mitigations": {
"shared": [
"M1056: Pre-compromise"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0854: Detection of Virtual Private Server"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--ae797531-3219-49a4-bccf-324ad7a4c7b2",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:01:00.176000+00:00",
"modified": "2026-09-18 00:31:18.340000+00:00",
"name": "Web Services",
"description": "Adversaries may compromise access to third-party web services\u00a0that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Recorded Future Turla Infra 2020) Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1584/006",
"external_id": "T1584.006"
},
{
"source_name": "Recorded Future Turla Infra 2020",
"description": "Insikt Group. (2020, March 12). Swallowing the Snake\u2019s Tail: Tracking Turla Infrastructure. Retrieved September 16, 2024.",
"url": "https://www.recordedfuture.com/research/turla-apt-infrastructure"
},
{
"source_name": "ThreatConnect Infrastructure Dec 2020",
"description": "ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.",
"url": "https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Dor Edry, Microsoft"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-18 00:31:18.340000+00:00\", \"old_value\": \"2025-10-24 17:49:13.641000+00:00\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.\", \"old_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/\", \"old_value\": \"https://threatconnect.com/blog/infrastructure-research-hunting/\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2",
"changelog_mitigations": {
"shared": [
"M1056: Pre-compromise"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0882: Detection of Web Services"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--106c0cf6-bf73-4601-9aa8-0945c2715ec5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-10 16:03:18.865000+00:00",
"modified": "2026-09-11 19:43:15.046000+00:00",
"name": "Create or Modify System Process",
"description": "Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence. When operating systems boot up, they can start processes that perform background system functions. On Windows and Linux, these system processes are referred to as services.(Citation: TechNet Services) On macOS, launchd processes known as [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) are run to finish system initialization and load user specific parameters.(Citation: AppleDocs Launch Agent Daemons) \n\nAdversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence. Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect. \n\nServices, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges. Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.(Citation: OSX Malware Detection) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1543",
"external_id": "T1543"
},
{
"source_name": "AppleDocs Launch Agent Daemons",
"description": "Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved July 10, 2017.",
"url": "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html"
},
{
"source_name": "TechNet Services",
"description": "Microsoft. (n.d.). Services. Retrieved June 7, 2016.",
"url": "https://technet.microsoft.com/en-us/library/cc772408.aspx"
},
{
"source_name": "OSX Malware Detection",
"description": "Patrick Wardle. (2016, February 29). Let's Play Doctor: Practical OS X Malware Detection & Analysis. Retrieved November 17, 2024.",
"url": "https://papers.put.as/papers/macosx/2016/RSA_OSX_Malware.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Containers",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:43:15.046000+00:00\", \"old_value\": \"2026-05-12 15:12:00.621000+00:00\"}}}",
"previous_version": "1.2",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1022: Restrict File and Directory Permissions",
"M1026: Privileged Account Management",
"M1028: Operating System Configuration",
"M1033: Limit Software Installation",
"M1040: Behavior Prevention on Endpoint",
"M1045: Code Signing",
"M1047: Audit",
"M1054: Software Configuration"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0571: Detection of System Process Creation or Modification Across Platforms"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-12 18:57:36.041000+00:00",
"modified": "2026-09-11 19:22:47.433000+00:00",
"name": "Credentials from Web Browsers",
"description": "Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.\n\nFor example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim\u2019s cached logon credentials as the decryption key.(Citation: Microsoft CryptUnprotectData April 2018)\n \nAdversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.(Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017) Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the [Windows Credential Manager](https://attack.mitre.org/techniques/T1555/004).\n\nAdversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)\n\nAfter acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1555/003",
"external_id": "T1555.003"
},
{
"source_name": "GitHub Mimikittenz July 2016",
"description": "Jamieson O'Reilly (putterpanda). (2016, July 4). mimikittenz. Retrieved June 20, 2019.",
"url": "https://github.com/putterpanda/mimikittenz"
},
{
"source_name": "Talos Olympic Destroyer 2018",
"description": "Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.",
"url": "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
},
{
"source_name": "Microsoft CryptUnprotectData April 2018",
"description": "Microsoft. (2018, April 12). CryptUnprotectData function. Retrieved June 18, 2019.",
"url": "https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/nf-dpapi-cryptunprotectdata"
},
{
"source_name": "Proofpoint Vega Credential Stealer May 2018",
"description": "Proofpoint. (2018, May 10). New Vega Stealer shines brightly in targeted campaign . Retrieved June 18, 2019.",
"url": "https://www.proofpoint.com/us/threat-insight/post/new-vega-stealer-shines-brightly-targeted-campaign"
},
{
"source_name": "FireEye HawkEye Malware July 2017",
"description": "Swapnil Patil, Yogesh Londhe. (2017, July 25). HawkEye Credential Theft Malware Distributed in Recent Phishing Campaign. Retrieved June 18, 2019.",
"url": "https://www.fireeye.com/blog/threat-research/2017/07/hawkeye-malware-distributed-in-phishing-campaign.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Ryan Benson, Exabeam",
"Barry Shteiman, Exabeam",
"Sylvain Gil, Exabeam",
"RedHuntLabs, @redhuntlabs",
"Don Le, Stifel Financial"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:22:47.433000+00:00\", \"old_value\": \"2026-05-12 15:12:00.635000+00:00\"}}}",
"previous_version": "1.2",
"changelog_mitigations": {
"shared": [
"M1017: User Training",
"M1018: User Account Management",
"M1021: Restrict Web-Based Content",
"M1027: Password Policies",
"M1051: Update Software"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0037: Detect Suspicious Access to Browser Credential Stores"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:43.540000+00:00",
"modified": "2026-09-08 20:15:04.260000+00:00",
"name": "Data Encoding",
"description": "Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1132",
"external_id": "T1132"
},
{
"source_name": "Wikipedia Binary-to-text Encoding",
"description": "Wikipedia. (2016, December 26). Binary-to-text encoding. Retrieved March 1, 2017.",
"url": "https://en.wikipedia.org/wiki/Binary-to-text_encoding"
},
{
"source_name": "Wikipedia Character Encoding",
"description": "Wikipedia. (2017, February 19). Character Encoding. Retrieved March 1, 2017.",
"url": "https://en.wikipedia.org/wiki/Character_encoding"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Itzik Kotler, SafeBreach"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-08 20:15:04.260000+00:00\", \"old_value\": \"2026-05-12 15:12:00.717000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.\", \"old_value\": \"Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.\"}}, \"iterable_item_removed\": {\"root['external_references'][1]\": {\"source_name\": \"University of Birmingham C2\", \"description\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.\", \"url\": \"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf\"}}}",
"previous_version": "1.3",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may encode data to make the content of command a | t | 1 | Adversaries may encode data to make the content of command a |
| > | nd control traffic more difficult to detect. Command and con | > | nd control traffic more difficult to detect. Command and con | ||
| > | trol (C2) information can be encoded using a standard data e | > | trol (C2) information can be encoded using a standard data e | ||
| > | ncoding system. Use of data encoding may adhere to existing | > | ncoding system. Use of data encoding may adhere to existing | ||
| > | protocol specifications and includes use of ASCII, Unicode, | > | protocol specifications and includes use of ASCII, Unicode, | ||
| > | Base64, MIME, or other binary-to-text and character encoding | > | Base64, MIME, or other binary-to-text and character encoding | ||
| > | systems.(Citation: Wikipedia Binary-to-text Encoding) (Cita | > | systems.(Citation: Wikipedia Binary-to-text Encoding)(Citat | ||
| > | tion: Wikipedia Character Encoding) Some data encoding syste | > | ion: Wikipedia Character Encoding) Some data encoding system | ||
| > | ms may also result in data compression, such as gzip. | > | s may also result in data compression, such as gzip. |
IsDebuggerPresent() and NtQueryInformationProcess(), or manually checking the BeingDebugged flag of the Process Environment Block (PEB). On Linux, this may involve querying `/proc/self/status` for the `TracerPID` field, which indicates whether or not the process is being traced by dynamic analysis tools.(Citation: Cado Security P2PInfect 2023)(Citation: Positive Technologies Hellhounds 2023) Other checks for debugging artifacts may also seek to enumerate hardware breakpoints, interrupt assembly opcodes, time checks, or measurements if exceptions are raised in the current process (assuming a present debugger would \u201cswallow\u201d or handle the potential error).(Citation: hasherezade debug)(Citation: AlKhaser Debug)(Citation: vxunderground debug)\n\nMalware may also leverage Structured Exception Handling (SEH) to detect debuggers by throwing an exception and detecting whether the process is suspended. SEH handles both hardware and software expectations, providing control over the exceptions including support for debugging. If a debugger is present, the program\u2019s control will be transferred to the debugger, and the execution of the code will be suspended. If the debugger is not present, control will be transferred to the SEH handler, which will automatically handle the exception and allow the program\u2019s execution to continue.(Citation: Apriorit)\n\nAdversaries may use the information learned from these debugger checks during automated discovery to shape follow-on behaviors. Debuggers can also be evaded by detaching the process or flooding debug logs with meaningless data via messages produced by looping [Native API](https://attack.mitre.org/techniques/T1106) function calls such as OutputDebugStringW().(Citation: wardle evilquest partii)(Citation: Checkpoint Dridex Jan 2021)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1622",
"external_id": "T1622"
},
{
"source_name": "Apriorit",
"description": "Apriorit. (2024, June 4). Anti Debugging Protection Techniques with Examples. Retrieved March 4, 2025.",
"url": "https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software"
},
{
"source_name": "Checkpoint Dridex Jan 2021",
"description": "Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021.",
"url": "https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"
},
{
"source_name": "hasherezade debug",
"description": "hasherezade. (2021, June 30). Module 3 - Understanding and countering malware's evasion and self-defence. Retrieved April 1, 2022.",
"url": "https://github.com/hasherezade/malware_training_vol1/blob/main/slides/module3/Module3_2_fingerprinting.pdf"
},
{
"source_name": "Cado Security P2PInfect 2023",
"description": "jbowen. (2023, December 4). P2Pinfect - New Variant Targets MIPS Devices. Retrieved March 18, 2025.",
"url": "https://www.cadosecurity.com/blog/p2pinfect-new-variant-targets-mips-devices"
},
{
"source_name": "AlKhaser Debug",
"description": "Noteworthy. (2019, January 6). Al-Khaser. Retrieved April 1, 2022.",
"url": "https://github.com/LordNoteworthy/al-khaser/tree/master/al-khaser/AntiDebug"
},
{
"source_name": "wardle evilquest partii",
"description": "Patrick Wardle. (2020, July 3). OSX.EvilQuest Uncovered part ii: insidious capabilities. Retrieved March 21, 2021.",
"url": "https://objective-see.com/blog/blog_0x60.html"
},
{
"source_name": "ProcessHacker Github",
"description": "ProcessHacker. (2009, October 27). Process Hacker. Retrieved April 11, 2022.",
"url": "https://github.com/processhacker/processhacker"
},
{
"source_name": "Positive Technologies Hellhounds 2023",
"description": "PT Expert Security Center. (2023, November 29). Hellhounds: operation Lahat. Retrieved March 18, 2025.",
"url": "https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/hellhounds-operation-lahat"
},
{
"source_name": "vxunderground debug",
"description": "vxunderground. (2021, June 30). VX-API. Retrieved April 1, 2022.",
"url": "https://web.archive.org/web/20250904153443/https://github.com/vxunderground/VX-API/tree/main#anti-debug"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Joas Antonio dos Santos, @C0d3Cr4zy",
"TruKno"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:39:55.836000+00:00\", \"old_value\": \"2026-05-12 15:12:00.723000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0371: Detection Strategy for Debugger Evasion (T1622)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--a1df809c-7d0e-459f-8fe5-25474bab770b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2025-09-24 18:03:15.021000+00:00",
"modified": "2026-09-11 19:52:38.458000+00:00",
"name": "Delay Execution",
"description": "Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mechanisms to obscure malicious activity, blend in with benign activity, and avoid scrutiny. Adversaries can perform this behavior within virtualization/sandbox environments or natively on host systems. \n\nAdversaries may utilize programmatic `sleep` commands or native system scheduling functionality, for example [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053). Benign commands or other operations may also be used to delay malware execution or ensure prior commands have had time to execute properly. Loops or otherwise needless repetitions of commands, such as `ping`, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.(Citation: Revil Independence Day)(Citation: Netskope Nitol) Another variation, commonly referred to as API hammering, involves making various calls to Native API functions in order to delay execution (while also potentially overloading analysis environments with junk data).(Citation: Joe Sec Nymaim)(Citation: Joe Sec Trickbot)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1678",
"external_id": "T1678"
},
{
"source_name": "Joe Sec Nymaim",
"description": "Joe Security. (2016, April 21). Nymaim - evading Sandboxes with API hammering. Retrieved September 30, 2021.",
"url": "https://www.joesecurity.org/blog/3660886847485093803"
},
{
"source_name": "Joe Sec Trickbot",
"description": "Joe Security. (2020, July 13). TrickBot's new API-Hammering explained. Retrieved September 30, 2021.",
"url": "https://www.joesecurity.org/blog/498839998833561473"
},
{
"source_name": "Revil Independence Day",
"description": "Loman, M. et al. (2021, July 4). Independence Day: REvil uses supply chain exploit to attack hundreds of businesses. Retrieved September 30, 2021.",
"url": "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/"
},
{
"source_name": "Netskope Nitol",
"description": "Malik, A. (2016, October 14). Nitol Botnet makes a resurgence with evasive sandbox analysis technique. Retrieved September 30, 2021.",
"url": "https://www.netskope.com/blog/nitol-botnet-makes-resurgence-evasive-sandbox-analysis-technique"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Deloitte Threat Library Team",
"Jeff Felling, Red Canary",
"Jorge Orchilles, SCYTHE",
"Ruben Dodge, @shotgunner101"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:52:38.458000+00:00\", \"old_value\": \"2026-05-12 15:12:00.706000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0372: Multi-Platform Detection Strategy for T1678 - Delay Execution"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-12-14 16:46:06.044000+00:00",
"modified": "2026-09-11 19:42:55.679000+00:00",
"name": "Deobfuscate/Decode Files or Information",
"description": "Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.\n\nOne such example is the use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file.(Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload.(Citation: Carbon Black Obfuscation Sept 2016)(Citation: Sentinel One Tainted Love 2023)\n\nSometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.(Citation: Volexity PowerDuke November 2016)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1140",
"external_id": "T1140"
},
{
"source_name": "Volexity PowerDuke November 2016",
"description": "Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.",
"url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"
},
{
"source_name": "Sentinel One Tainted Love 2023",
"description": "Aleksandar Milenkoski, Juan Andres Guerrero-Saade, and Joey Chen. (2023, March 23). Operation Tainted Love | Chinese APTs Target Telcos in New Attacks. Retrieved March 18, 2025.",
"url": "https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/"
},
{
"source_name": "Malwarebytes Targeted Attack against Saudi Arabia",
"description": "Malwarebytes Labs. (2017, March 27). New targeted attack against Saudi Arabia Government. Retrieved July 3, 2017.",
"url": "https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/"
},
{
"source_name": "Carbon Black Obfuscation Sept 2016",
"description": "Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018.",
"url": "https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Crist\u00f3bal Mart\u00ednez Mart\u00edn",
"Matthew Demaske, Adaptforward",
"Red Canary"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:42:55.679000+00:00\", \"old_value\": \"2026-05-12 15:12:00.628000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0275: Detect Adversary Deobfuscation or Decoding of Files and Payloads"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--bbde9781-60aa-4b8a-a911-895b0c1b3872",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-14 22:53:26.949000+00:00",
"modified": "2026-09-11 19:52:16.657000+00:00",
"name": "Disable or Modify Tools",
"description": "Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.(Citation: SCADAfence_ransomware) \n\nIn addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion).(Citation: Microsoft Lamin Sept 2017)(Citation: ETW Palantir)\n\nMore advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization\u2019s ability to detect and respond to malicious activity.(Citation: Cocomazzi FIN7 Reboot)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-impairment"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1685",
"external_id": "T1685"
},
{
"source_name": "Cocomazzi FIN7 Reboot",
"description": "Cocomazzi, Antonio. (2024, July 17). FIN7 Reboot | Cybercrime Gang Enhances Ops with New EDR Bypasses and Automated Attacks. Retrieved September 24, 2025.",
"url": "https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/"
},
{
"source_name": "Microsoft Lamin Sept 2017",
"description": "Microsoft. (2009, May 17). Backdoor:Win32/Lamin.A. Retrieved September 6, 2018.",
"url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Backdoor:Win32/Lamin.A"
},
{
"source_name": "ETW Palantir",
"description": "Palantir. (2018, December 24). Tampering with Windows Event Tracing: Background, Offense, and Defense. Retrieved April 15, 2026.",
"url": "https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63"
},
{
"source_name": "SCADAfence_ransomware",
"description": "Shaked, O. (2020, January 20). Anatomy of a Targeted Ransomware Attack. Retrieved June 18, 2022.",
"url": "https://cdn.logic-control.com/docs/scadafence/Anatomy-Of-A-Targeted-Ransomware-Attack-WP.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Alex Soler, AttackIQ",
"Cian Heasley",
"Daniel Feichter, @VirtualAllocEx, Infosec Tirol",
"Gal Singer, @galsinger29, Team Nautilus Aqua Security",
"Gordon Long, LegioX/Zoom, asaurusrex",
"Lucas Heiligenstein",
"Menachem Goldstein",
"Nathaniel Quist, Palo Alto Networks",
"Nay Myo Hlaing (Ethan), DBS Bank",
"Rob Smith",
"Sarathkumar Rajendran, Microsoft Defender365",
"Ziv Karliner, @ziv_kr, Team Nautilus Aqua Security"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Containers",
"ESXi",
"IaaS",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:52:16.657000+00:00\", \"old_value\": \"2026-05-12 15:12:00.712000+00:00\"}}}",
"previous_version": "1.0",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1022: Restrict File and Directory Permissions",
"M1024: Restrict Registry Permissions",
"M1038: Execution Prevention",
"M1042: Disable or Remove Feature or Program",
"M1047: Audit",
"M1054: Software Configuration"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0497: Detection of Defense Impairment through Disabled or Modified Tools across OS Platforms."
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--b8902400-e6c5-4ba2-95aa-2d35b442b118",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-16 15:33:01.739000+00:00",
"modified": "2026-09-03 19:46:48.529000+00:00",
"name": "Encrypted Channel",
"description": "Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1573",
"external_id": "T1573"
},
{
"source_name": "SANS Decrypting SSL",
"description": "Butler, M. (2013, November). Finding Hidden Threats by Decrypting SSL. Retrieved April 5, 2016.",
"url": "http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840"
},
{
"source_name": "SEI SSL Inspection Risks",
"description": "Dormann, W. (2015, March 13). The Risks of SSL Inspection. Retrieved April 5, 2016.",
"url": "https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.",
"url": "https://arxiv.org/pdf/1408.1136"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-03 19:46:48.529000+00:00\", \"old_value\": \"2025-10-24 17:49:17.042000+00:00\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.\", \"old_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://arxiv.org/pdf/1408.1136\", \"old_value\": \"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2",
"changelog_mitigations": {
"shared": [
"M1020: SSL/TLS Inspection",
"M1031: Network Intrusion Prevention"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0273: Detection Strategy for Encrypted Channel across OS Platforms"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--65013dd2-bc61-43e3-afb5-a14c4fa7437a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 01:09:53.217000+00:00",
"modified": "2026-09-11 19:22:11.810000+00:00",
"name": "Email Accounts",
"description": "Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Establishing email accounts may also allow adversaries to abuse free services \u2013 such as trial periods \u2013 to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for follow-on purposes.(Citation: Free Trial PurpleUrchin)\n\nAdversaries may also take steps to cultivate a persona around the email account, such as through use of [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001), to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).(Citation: Mandiant APT1)\n\nTo decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.(Citation: Trend Micro R980 2016) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1585/002",
"external_id": "T1585.002"
},
{
"source_name": "Trend Micro R980 2016",
"description": "Antazo, F. and Yambao, M. (2016, August 10). R980 Ransomware Found Abusing Disposable Email Address Service. Retrieved October 13, 2020.",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/r980-ransomware-disposable-email-service/"
},
{
"source_name": "Free Trial PurpleUrchin",
"description": "Gamazo, William. Quist, Nathaniel.. (2023, January 5). PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources. Retrieved February 28, 2024.",
"url": "https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/"
},
{
"source_name": "Mandiant APT1",
"description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:22:11.810000+00:00\", \"old_value\": \"2026-05-12 15:12:00.636000+00:00\"}}}",
"previous_version": "1.1",
"changelog_mitigations": {
"shared": [
"M1056: Pre-compromise"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0835: Detection of Email Accounts"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--a19e86f8-1c0a-4fea-8407-23b73d615776",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:30:44.720000+00:00",
"modified": "2026-09-03 19:46:48.106000+00:00",
"name": "Exfiltration Over Alternative Protocol",
"description": "Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. \n\nAlternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. \n\n[Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques)\n\nMany IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "exfiltration"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1048",
"external_id": "T1048"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.",
"url": "https://arxiv.org/pdf/1408.1136"
},
{
"source_name": "Palo Alto OilRig Oct 2016",
"description": "Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.",
"url": "http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/"
},
{
"source_name": "20 macOS Common Tools and Techniques",
"description": "Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.",
"url": "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"William Cain",
"Alfredo Abarca"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"IaaS",
"Linux",
"macOS",
"Network Devices",
"Office Suite",
"SaaS",
"Windows"
],
"x_mitre_version": "1.6",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-03 19:46:48.106000+00:00\", \"old_value\": \"2025-10-24 17:49:10.460000+00:00\"}, \"root['external_references'][1]['description']\": {\"new_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.\", \"old_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://arxiv.org/pdf/1408.1136\", \"old_value\": \"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.6",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1022: Restrict File and Directory Permissions",
"M1030: Network Segmentation",
"M1031: Network Intrusion Prevention",
"M1037: Filter Network Traffic",
"M1057: Data Loss Prevention"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0131: Behavioral Detection Strategy for Exfiltration Over Alternative Protocol"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--fb8d023d-45be-47e9-bc51-f56bcae6435b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-15 15:37:47.583000+00:00",
"modified": "2026-09-03 19:46:40.087000+00:00",
"name": "Exfiltration Over Unencrypted Non-C2 Protocol",
"description": "Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco)\n\nAdversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "exfiltration"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1048/003",
"external_id": "T1048.003"
},
{
"source_name": "copy_cmd_cisco",
"description": "Cisco. (2022, August 16). copy - Cisco IOS Configuration Fundamentals Command Reference . Retrieved July 13, 2022.",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/C_commands.html#wp1068167689"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.",
"url": "https://arxiv.org/pdf/1408.1136"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"William Cain",
"Austin Clark, @c2defense"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "2.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-03 19:46:40.087000+00:00\", \"old_value\": \"2026-05-12 15:12:00.726000+00:00\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.\", \"old_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://arxiv.org/pdf/1408.1136\", \"old_value\": \"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf\"}}}",
"previous_version": "2.2",
"changelog_mitigations": {
"shared": [
"M1030: Network Segmentation",
"M1031: Network Intrusion Prevention",
"M1037: Filter Network Traffic",
"M1057: Data Loss Prevention"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0149: Detection of Exfiltration Over Unencrypted Non-C2 Protocol"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--f24faf46-3b26-4dbb-98f2-63460498e433",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:30:21.689000+00:00",
"modified": "2026-09-09 18:39:15.900000+00:00",
"name": "Fallback Channels",
"description": "Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1008",
"external_id": "T1008"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-09 18:39:15.900000+00:00\", \"old_value\": \"2026-05-12 15:12:00.724000+00:00\"}}, \"iterable_item_removed\": {\"root['external_references'][1]\": {\"source_name\": \"University of Birmingham C2\", \"description\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.\", \"url\": \"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf\"}}}",
"previous_version": "1.1",
"changelog_mitigations": {
"shared": [
"M1031: Network Intrusion Prevention"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0499: Behavioral Detection of Fallback or Alternate C2 Channels"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:04.710000+00:00",
"modified": "2026-09-11 19:45:35.899000+00:00",
"name": "File and Directory Discovery",
"description": "Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nMany command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).(Citation: US-CERT-TA18-106A)\n\nSome files and directories may require elevated or specific user permissions to access.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1083",
"external_id": "T1083"
},
{
"source_name": "Windows Commands JPCERT",
"description": "Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.",
"url": "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"
},
{
"source_name": "US-CERT-TA18-106A",
"description": "US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Austin Clark, @c2defense"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "1.7",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:45:35.899000+00:00\", \"old_value\": \"2026-05-12 15:12:00.644000+00:00\"}}}",
"previous_version": "1.7",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0370: Recursive Enumeration of Files and Directories Across Privilege Contexts"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--34e793de-0274-4982-9c1a-246ed1c19dee",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-04 19:17:41.767000+00:00",
"modified": "2026-09-11 19:58:37.542000+00:00",
"name": "Windows Permissions",
"description": "Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).\n\nWindows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).(Citation: Microsoft DACL May 2018) Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object. When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. If a matching entry is found, access to the object is granted. Otherwise, access is denied.(Citation: Microsoft Access Control Lists May 2018)\n\nAdversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `cacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders. Further, [PowerShell](https://attack.mitre.org/techniques/T1059/001) provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-impairment"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1222/001",
"external_id": "T1222.001"
},
{
"source_name": "Hybrid Analysis Icacls1 June 2018",
"description": "Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe. Retrieved August 19, 2018.",
"url": "https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100"
},
{
"source_name": "Hybrid Analysis Icacls2 May 2018",
"description": "Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll. Retrieved August 19, 2018.",
"url": "https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110"
},
{
"source_name": "Microsoft Access Control Lists May 2018",
"description": "M. Satran, M. Jacobs. (2018, May 30). Access Control Lists. Retrieved February 4, 2020.",
"url": "https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists"
},
{
"source_name": "Microsoft DACL May 2018",
"description": "Microsoft. (2018, May 30). DACLs and ACEs. Retrieved August 19, 2018.",
"url": "https://docs.microsoft.com/windows/desktop/secauthz/dacls-and-aces"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:58:37.542000+00:00\", \"old_value\": \"2026-05-12 15:12:00.625000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [
"M1022: Restrict File and Directory Permissions",
"M1026: Privileged Account Management"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0418: Windows DACL Manipulation Behavioral Chain Detection Strategy"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--09312b1a-c3c6-4b45-9844-3ccc78e5d82f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:39:33.966000+00:00",
"modified": "2026-09-18 00:31:20.607000+00:00",
"name": "Gather Victim Host Information",
"description": "Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).\n\nAdversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary\u2019s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.(Citation: TrellixQakbot)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1592",
"external_id": "T1592"
},
{
"source_name": "ATT ScanBox",
"description": "Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020.",
"url": "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
},
{
"source_name": "TrellixQakbot",
"description": "Pham Duy Phuc, John Fokker J.E., Alejandro Houspanossian and Mathanraj Thangaraju. (2023, March 7). Qakbot Evolves to OneNote Malware Distribution. Retrieved August 1, 2024.",
"url": "https://www.trellix.com/blogs/research/qakbot-evolves-to-onenote-malware-distribution/"
},
{
"source_name": "ThreatConnect Infrastructure Dec 2020",
"description": "ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.",
"url": "https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Sam Seabrook, Duke Energy"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-18 00:31:20.607000+00:00\", \"old_value\": \"2025-10-24 17:48:21.583000+00:00\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.\", \"old_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/\", \"old_value\": \"https://threatconnect.com/blog/infrastructure-research-hunting/\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2",
"changelog_mitigations": {
"shared": [
"M1056: Pre-compromise"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0826: Detection of Gather Victim Host Information"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--774ad5bb-2366-4c13-a8a9-65e50b292e7c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:47:16.719000+00:00",
"modified": "2026-09-18 00:31:18.339000+00:00",
"name": "Client Configurations",
"description": "Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone.\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: listening ports, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the client configurations may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1592/004",
"external_id": "T1592.004"
},
{
"source_name": "ATT ScanBox",
"description": "Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020.",
"url": "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
},
{
"source_name": "ThreatConnect Infrastructure Dec 2020",
"description": "ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.",
"url": "https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-18 00:31:18.339000+00:00\", \"old_value\": \"2026-05-12 15:12:00.642000+00:00\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.\", \"old_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/\", \"old_value\": \"https://threatconnect.com/blog/infrastructure-research-hunting/\"}}}",
"previous_version": "1.1",
"changelog_mitigations": {
"shared": [
"M1056: Pre-compromise"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0820: Detection of Client Configurations"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--24286c33-d4a4-4419-85c2-1d094a896c26",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:40:47.488000+00:00",
"modified": "2026-09-18 00:31:18.338000+00:00",
"name": "Hardware",
"description": "Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.).\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: hostnames, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Compromise Hardware Supply Chain](https://attack.mitre.org/techniques/T1195/003) or [Hardware Additions](https://attack.mitre.org/techniques/T1200)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1592/001",
"external_id": "T1592.001"
},
{
"source_name": "ATT ScanBox",
"description": "Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020.",
"url": "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
},
{
"source_name": "ThreatConnect Infrastructure Dec 2020",
"description": "ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.",
"url": "https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-18 00:31:18.338000+00:00\", \"old_value\": \"2025-10-24 17:48:32.066000+00:00\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.\", \"old_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/\", \"old_value\": \"https://threatconnect.com/blog/infrastructure-research-hunting/\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1",
"changelog_mitigations": {
"shared": [
"M1056: Pre-compromise"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0887: Detection of Hardware"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--baf60e1a-afe5-4d31-830f-1b1ba2351884",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 16:42:17.482000+00:00",
"modified": "2026-09-18 00:31:18.340000+00:00",
"name": "Software",
"description": "Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: listening ports, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the installed software may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Additionally, adversaries may analyze metadata from victim-owned files (e.g., PDFs, DOCs, images, and sound files hosted on victim-owned websites) to extract information about the software and hardware used to create or process those files. Metadata may reveal software versions, configurations, or timestamps that indicate outdated or vulnerable software. This information can be cross-referenced with known CVEs to identify potential vectors for exploitation in future operations.(Citation: Outpost24)\n\nGathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or for initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1592/002",
"external_id": "T1592.002"
},
{
"source_name": "ATT ScanBox",
"description": "Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020.",
"url": "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
},
{
"source_name": "Outpost24",
"description": "Stijn Vande Casteele. (2025, March 31). How to analyze metadata and hide it from hackers. Retrieved July 2, 2025.",
"url": "https://outpost24.com/blog/metadata-hackers-best-friend/"
},
{
"source_name": "ThreatConnect Infrastructure Dec 2020",
"description": "ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.",
"url": "https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Michal Biesiada"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-18 00:31:18.340000+00:00\", \"old_value\": \"2026-05-12 15:12:00.710000+00:00\"}, \"root['external_references'][3]['description']\": {\"new_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.\", \"old_value\": \"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.\"}, \"root['external_references'][3]['url']\": {\"new_value\": \"https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/\", \"old_value\": \"https://threatconnect.com/blog/infrastructure-research-hunting/\"}}}",
"previous_version": "1.2",
"changelog_mitigations": {
"shared": [
"M1056: Pre-compromise"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0888: Detection of Software"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-13 18:11:08.357000+00:00",
"modified": "2026-09-11 19:32:27.370000+00:00",
"name": "DLL",
"description": "Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.(Citation: unit 42)\n\nSpecific ways DLLs are abused by adversaries include:\n\n### DLL Sideloading\nAdversaries may execute their own malicious payloads by side-loading DLLs. Side-loading involves hijacking which DLL a program loads by planting and then invoking a legitimate application that executes their payload(s).\n\nSide-loading positions both the victim application and malicious payload(s) alongside each other. Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. Benign executables used to side-load payloads may not be flagged during delivery and/or execution. Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process.\n\nAdversaries may also side-load other packages, such as BPLs (Borland Package Library).(Citation: kroll bpl)\n\nAdversaries may chain DLL sideloading multiple times to fragment functionality hindering analysis. Adversaries using multiple DLL files can split the loader functions across different DLLs, with a main DLL loading the separated export functions. (Citation: Virus Bulletin) Spreading loader functions across multiple DLLs makes analysis harder, since all files must be collected to fully understand the malware\u2019s behavior. Another method implements a \u201cloader-for-a-loader\u201d, where a malicious DLL\u2019s sole role is to load a second DLL (or a chain of DLLs) that contain the real payload. (Citation: Sophos)\n\n### DLL Search Order Hijacking\nAdversaries may execute their own malicious payloads by hijacking the search order that Windows uses to load DLLs. This search order is a sequence of special and standard search locations that a program checks when loading a DLL. An adversary can plant a trojan DLL in a directory that will be prioritized by the DLL search order over the location of a legitimate library. This will cause Windows to load the malicious DLL when it is called for by the victim program.(Citation: unit 42)\n\n### DLL Redirection\nAdversaries may directly modify the search order via DLL redirection, which after being enabled (in the Registry or via the creation of a redirection file) may cause a program to load a DLL from a different location.(Citation: Microsoft redirection)(Citation: Microsoft - manifests/assembly)\n\n### Phantom DLL Hijacking\nAdversaries may leverage phantom DLL hijacking by targeting references to non-existent DLL files. They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.(Citation: Hexacorn DLL Hijacking)(Citation: Hijack DLLs CrowdStrike)\n\n### DLL Substitution\nAdversaries may target existing, valid DLL files and substitute them with their own malicious DLLs, planting them with the same name and in the same location as the valid DLL file.(Citation: Wietze Beukema DLL Hijacking)\n\nPrograms that fall victim to DLL hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace, evading defenses.\n\nRemote DLL hijacking can occur when a program sets its current directory to a remote location, such as a Web share, before loading a DLL.(Citation: dll pre load owasp)(Citation: microsoft remote preloading)\n\nIf a valid DLL is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/001",
"external_id": "T1574.001"
},
{
"source_name": "Hijack DLLs CrowdStrike",
"description": " falcon.overwatch.team. (2022, December 30). 4 Ways Adversaries Hijack DLLs \u2014 and How CrowdStrike Falcon OverWatch Fights Back. Retrieved January 30, 2025.",
"url": "https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/"
},
{
"source_name": "kroll bpl",
"description": "Dave Truman. (2024, June 24). Novel Technique Combination Used In IDATLOADER Distribution. Retrieved January 30, 2025.",
"url": "https://www.kroll.com/en/insights/publications/cyber/idatloader-distribution"
},
{
"source_name": "Sophos",
"description": "Gabor Szappanos. (2023, May 3). A doubled \u201cDragon Breath\u201d adds new air to DLL sideloading attacks. Retrieved October 3, 2025.",
"url": "https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/"
},
{
"source_name": "Hexacorn DLL Hijacking",
"description": "Hexacorn. (2013, December 8). Beyond good ol\u2019 Run key, Part 5. Retrieved August 14, 2024.",
"url": "https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/"
},
{
"source_name": "microsoft remote preloading",
"description": "Microsoft. (2014, May 13). Microsoft Security Advisory 2269637: Insecure Library Loading Could Allow Remote Code Execution. Retrieved January 30, 2025.",
"url": "https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/2269637"
},
{
"source_name": "Microsoft - manifests/assembly",
"description": "Microsoft. (2021, January 7). Manifests. Retrieved January 30, 2025.",
"url": "https://learn.microsoft.com/en-us/windows/win32/sbscs/manifests?redirectedfrom=MSDN"
},
{
"source_name": "Microsoft redirection",
"description": "Microsoft. (2023, October 12). Dynamic-link library redirection. Retrieved January 30, 2025.",
"url": "https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection?redirectedfrom=MSDN"
},
{
"source_name": "dll pre load owasp",
"description": "OWASP. (n.d.). Binary Planting. Retrieved January 30, 2025.",
"url": "https://owasp.org/www-community/attacks/Binary_planting"
},
{
"source_name": "Virus Bulletin",
"description": "Suguru Ishimaru, Hajime Yanagishita, Yusuke Niwa. (2023, October 5). Unveiling activities of Tropic Trooper 2023: deep analysis of Xiangoop Loader and EntryShell payload. Retrieved October 3, 2025.",
"url": "https://www.virusbulletin.com/conference/vb2023/abstracts/unveiling-activities-tropic-trooper-2023-deep-analysis-xiangoop-loader-and-entryshell-payload/"
},
{
"source_name": "unit 42",
"description": "Tom Fakterman, Chen Erlich, & Assaf Dahan. (2024, February 22). Intruders in the Library: Exploring DLL Hijacking. Retrieved January 30, 2025.",
"url": "https://unit42.paloaltonetworks.com/dll-hijacking-techniques/"
},
{
"source_name": "Wietze Beukema DLL Hijacking",
"description": "Wietze Beukema. (2020, June 22). Hijacking DLLs in Windows. Retrieved April 8, 2025.",
"url": "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Ami Holeston, CrowdStrike",
"Hajime Yanagishita, Macnica, Inc.",
"Marina Liang",
"Stefan Kanthak",
"Suguru Ishimaru, ITOCHU Cyber & Intelligence Inc.",
"Travis Smith, Tripwire",
"Wietze Beukema @Wietze",
"Will Alexander, CrowdStrike",
"Yusuke Niwa, ITOCHU Cyber & Intelligence Inc."
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_remote_support": false,
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:32:27.370000+00:00\", \"old_value\": \"2026-05-12 15:12:00.624000+00:00\"}}}",
"previous_version": "3.0",
"changelog_mitigations": {
"shared": [
"M1013: Application Developer Guidance",
"M1038: Execution Prevention",
"M1044: Restrict Library Loading",
"M1047: Audit",
"M1051: Update Software"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0201: Detection Strategy for Hijack Execution Flow for DLLs"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-31 12:35:36.479000+00:00",
"modified": "2026-09-11 19:53:31.010000+00:00",
"name": "File Deletion",
"description": "Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.\n\nThere are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) functions include del on Windows, rm or unlink on Linux and macOS, and `rm` on ESXi.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1070/004",
"external_id": "T1070.004"
},
{
"source_name": "Microsoft SDelete July 2016",
"description": "Russinovich, M. (2016, July 4). SDelete v2.0. Retrieved February 8, 2018.",
"url": "https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Walker Johnson"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:53:31.010000+00:00\", \"old_value\": \"2026-05-12 15:12:00.718000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0140: Behavioral Detection of Malicious File Deletion"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--e6919abc-99f9-4c6c-95a5-14761e7b2add",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:16.408000+00:00",
"modified": "2026-09-11 19:48:23.794000+00:00",
"name": "Ingress Tool Transfer",
"description": "Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as [ftp](https://attack.mitre.org/software/S0095). Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570)). \n\nOn Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, [certutil](https://attack.mitre.org/software/S0160), and [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas) A number of these tools, such as `wget`, `curl`, and `scp`, also exist on ESXi. After downloading a file, a threat actor may attempt to verify its integrity by checking its hash value (e.g., via `certutil -hashfile`).(Citation: Google Cloud Threat Intelligence COSCMICENERGY 2023)\n\nAdversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by [User Execution](https://attack.mitre.org/techniques/T1204) (typically after interacting with [Phishing](https://attack.mitre.org/techniques/T1566) lures).(Citation: T1105: Trellix_search-ms)\n\nFiles can also be transferred using various [Web Service](https://attack.mitre.org/techniques/T1102)s as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016) In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.(Citation: Dropbox Malware Sync)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1105",
"external_id": "T1105"
},
{
"source_name": "T1105: Trellix_search-ms",
"description": " Mathanraj Thangaraju, Sijo Jacob. (2023, July 26). Beyond File Search: A Novel Method for Exploiting the \"search-ms\" URI Protocol Handler. Retrieved March 15, 2024.",
"url": "https://www.trellix.com/blogs/research/beyond-file-search-a-novel-method/"
},
{
"source_name": "Google Cloud Threat Intelligence COSCMICENERGY 2023",
"description": "COSMICENERGY: New OT Malware Possibly Related To Russian Emergency Response Exercises. (2023, May 25). Ken Proska, Daniel Kapellmann Zafra, Keith Lunden, Corey Hildebrandt, Rushikesh Nandedkar, Nathan Brubaker. Retrieved March 18, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/cosmicenergy-ot-malware-russian-response/"
},
{
"source_name": "Dropbox Malware Sync",
"description": "David Talbot. (2013, August 21). Dropbox and Similar Services Can Sync Malware. Retrieved May 31, 2023.",
"url": "https://www.technologyreview.com/2013/08/21/83143/dropbox-and-similar-services-can-sync-malware/"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.",
"url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"
},
{
"source_name": "t1105_lolbas",
"description": "LOLBAS. (n.d.). LOLBAS Mapped to T1105. Retrieved March 11, 2022.",
"url": "https://lolbas-project.github.io/#t1105"
},
{
"source_name": "PTSecurity Cobalt Dec 2016",
"description": "Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.",
"url": "https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Alain Homewood",
"Jeremy Hedges",
"Joe Wise",
"John Page (aka hyp3rlinx), ApparitionSec",
"Mark Wee",
"Peter Oakes",
"Selena Larson, @selenalarson",
"Shailesh Tiwary (Indian Army)",
"The DFIR Report",
"Don Le, Stifel Financial"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "2.6",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:48:23.794000+00:00\", \"old_value\": \"2026-05-12 15:12:00.723000+00:00\"}}}",
"previous_version": "2.6",
"changelog_mitigations": {
"shared": [
"M1031: Network Intrusion Prevention",
"M1037: Filter Network Traffic"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0060: Detect Ingress Tool Transfers via Behavioral Chain"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--bf90d72c-c00b-45e3-b3aa-68560560d4c5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-11 21:01:00.959000+00:00",
"modified": "2026-09-03 19:46:52.112000+00:00",
"name": "Lateral Tool Transfer",
"description": "Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.\n\nAdversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) to connected network shares or with authenticated connections via [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001).(Citation: Unit42 LockerGoga 2019)\n\nFiles can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and [ftp](https://attack.mitre.org/software/S0095). In some cases, adversaries may be able to leverage [Web Service](https://attack.mitre.org/techniques/T1102)s such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.(Citation: Dropbox Malware Sync)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "lateral-movement"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1570",
"external_id": "T1570"
},
{
"source_name": "Dropbox Malware Sync",
"description": "David Talbot. (2013, August 21). Dropbox and Similar Services Can Sync Malware. Retrieved May 31, 2023.",
"url": "https://www.technologyreview.com/2013/08/21/83143/dropbox-and-similar-services-can-sync-malware/"
},
{
"source_name": "Unit42 LockerGoga 2019",
"description": "Harbison, M. (2019, March 26). Born This Way? Origins of LockerGoga. Retrieved April 16, 2019.",
"url": "https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Shailesh Tiwary (Indian Army)"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-03 19:46:52.112000+00:00\", \"old_value\": \"2026-05-12 15:12:00.713000+00:00\"}}}",
"previous_version": "1.4",
"changelog_mitigations": {
"shared": [
"M1031: Network Intrusion Prevention",
"M1037: Filter Network Traffic"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0183: Detection Strategy for Lateral Tool Transfer across OS platforms"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--b4b7458f-81f2-4d38-84be-1c5ba0167a52",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-10 19:49:46.752000+00:00",
"modified": "2026-09-11 19:55:56.428000+00:00",
"name": "Invalid Code Signature",
"description": "Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017)\n\nUnlike [Code Signing](https://attack.mitre.org/techniques/T1553/002), this activity will not result in a valid signature.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1036/001",
"external_id": "T1036.001"
},
{
"source_name": "Threatexpress MetaTwin 2017",
"description": "Vest, J. (2017, October 9). Borrowing Microsoft MetaData and Signatures to Hide Binary Payloads. Retrieved September 10, 2019.",
"url": "https://threatexpress.com/blogs/2017/metatwin-borrowing-microsoft-metadata-and-digital-signatures-to-hide-binaries/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:55:56.428000+00:00\", \"old_value\": \"2026-05-12 15:12:00.709000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [
"M1045: Code Signing"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0031: Invalid Code Signature Execution Detection via Metadata and Behavioral Context"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-10 20:43:10.239000+00:00",
"modified": "2026-09-11 19:59:49.678000+00:00",
"name": "Match Legitimate Resource Name or Location",
"description": "Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. \n\nThis may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.(Citation: Aquasec Kubernetes Backdoor 2023)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1036/005",
"external_id": "T1036.005"
},
{
"source_name": "Aquasec Kubernetes Backdoor 2023",
"description": "Michael Katchinskiy and Assaf Morag. (2023, April 21). First-Ever Attack Leveraging Kubernetes RBAC to Backdoor Clusters. Retrieved March 24, 2025.",
"url": "https://www.aquasec.com/blog/leveraging-kubernetes-rbac-to-backdoor-clusters/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Vishwas Manral, McAfee",
"Yossi Weizman, Azure Defender Research Team"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Containers",
"ESXi",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:59:49.678000+00:00\", \"old_value\": \"2026-05-12 15:12:00.622000+00:00\"}}}",
"previous_version": "3.0",
"changelog_mitigations": {
"shared": [
"M1022: Restrict File and Directory Permissions",
"M1038: Execution Prevention",
"M1045: Code Signing"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0347: Detection Strategy for Masquerading via Legitimate Resource Name or Location"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--57340c81-c025-4189-8fa0-fc7ede51bae4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:23.587000+00:00",
"modified": "2026-09-11 19:48:51.536000+00:00",
"name": "Modify Registry",
"description": "Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.\n\nAccess to specific areas of the Registry depends on account permissions, with some keys requiring administrator-level access. The built-in Windows command-line utility [Reg](https://attack.mitre.org/software/S0075) may be used for local or remote Registry modification.(Citation: Microsoft Reg) Other tools, such as remote access tools, may also contain functionality to interact with the Registry through the Windows API.\n\nThe Registry may be modified in order to hide configuration information or malicious payloads via [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).(Citation: Unit42 BabyShark Feb 2019)(Citation: Avaddon Ransomware 2021)(Citation: Microsoft BlackCat Jun 2022)(Citation: CISA Russian Gov Critical Infra 2018) The Registry may also be modified to impair defenses, such as by enabling macros for all Microsoft Office products, allowing privilege escalation without alerting the user, increasing the maximum number of allowed outbound requests, and/or modifying systems to store plaintext credentials in memory.(Citation: CISA LockBit 2023)(Citation: Unit42 BabyShark Feb 2019)\n\nThe Registry of a remote system may be modified to aid in execution of files as part of lateral movement. It requires the remote Registry service to be running on the target system.(Citation: Microsoft Remote) Often [Valid Accounts](https://attack.mitre.org/techniques/T1078) are required, along with access to the remote system's [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) for RPC communication.\n\nFinally, Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via [Reg](https://attack.mitre.org/software/S0075) or other utilities using the Win32 API.(Citation: Microsoft Reghide NOV 2006) Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence.(Citation: TrendMicro POWELIKS AUG 2014)(Citation: SpectorOps Hiding Reg Jul 2017)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-impairment"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1112",
"external_id": "T1112"
},
{
"source_name": "CISA Russian Gov Critical Infra 2018",
"description": "CISA. (2018, March 16). Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved March 24, 2025.",
"url": "https://www.cisa.gov/news-events/alerts/2018/03/15/russian-government-cyber-activity-targeting-energy-and-other-critical-infrastructure-sectors"
},
{
"source_name": "CISA LockBit 2023",
"description": "CISA. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved March 24, 2025.",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a"
},
{
"source_name": "Avaddon Ransomware 2021",
"description": "Javier Yuste and Sergio Pastrana. (2021). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved March 24, 2025.",
"url": "https://arxiv.org/pdf/2102.04796"
},
{
"source_name": "Microsoft BlackCat Jun 2022",
"description": "Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.",
"url": "https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"
},
{
"source_name": "Microsoft Reg",
"description": "Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015.",
"url": "https://technet.microsoft.com/en-us/library/cc732643.aspx"
},
{
"source_name": "Microsoft Remote",
"description": "Microsoft. (n.d.). Enable the Remote Registry Service. Retrieved May 1, 2015.",
"url": "https://technet.microsoft.com/en-us/library/cc754820.aspx"
},
{
"source_name": "SpectorOps Hiding Reg Jul 2017",
"description": "Reitz, B. (2017, July 14). Hiding Registry keys with PSReflect. Retrieved August 9, 2018.",
"url": "https://posts.specterops.io/hiding-registry-keys-with-psreflect-b18ec5ac8353"
},
{
"source_name": "Microsoft Reghide NOV 2006",
"description": "Russinovich, M. & Sharkey, K. (2006, January 10). Reghide. Retrieved August 9, 2018.",
"url": "https://docs.microsoft.com/sysinternals/downloads/reghide"
},
{
"source_name": "TrendMicro POWELIKS AUG 2014",
"description": "Santos, R. (2014, August 1). POWELIKS: Malware Hides In Windows Registry. Retrieved August 9, 2018.",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-malware-hides-in-windows-registry/"
},
{
"source_name": "Unit42 BabyShark Feb 2019",
"description": "Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.",
"url": "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Bartosz Jerzman",
"David Lu, Tripwire",
"Gerardo Santos",
"Travis Smith, Tripwire"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:48:51.536000+00:00\", \"old_value\": \"2026-05-12 15:12:00.634000+00:00\"}}}",
"previous_version": "3.0",
"changelog_mitigations": {
"shared": [
"M1024: Restrict Registry Permissions"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0280: Behavior-Based Registry Modification Detection on Windows"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--391d824f-0ef1-47a0-b0ee-c59a75e27670",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:17.472000+00:00",
"modified": "2026-09-11 19:38:58.040000+00:00",
"name": "Native API",
"description": "Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.\n\nAdversaries may abuse these OS API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.\n\nNative API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)\n\nHigher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)\n\nAdversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.(Citation: Redops Syscalls) Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1106",
"external_id": "T1106"
},
{
"source_name": "MACOS Cocoa",
"description": "Apple. (2015, September 16). Cocoa Application Layer. Retrieved June 25, 2020.",
"url": "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/OSX_Technology_Overview/CocoaApplicationLayer/CocoaApplicationLayer.html#//apple_ref/doc/uid/TP40001067-CH274-SW1"
},
{
"source_name": "Apple Core Services",
"description": "Apple. (n.d.). Core Services. Retrieved June 25, 2020.",
"url": "https://developer.apple.com/documentation/coreservices"
},
{
"source_name": "macOS Foundation",
"description": "Apple. (n.d.). Foundation. Retrieved July 1, 2020.",
"url": "https://developer.apple.com/documentation/foundation"
},
{
"source_name": "OutFlank System Calls",
"description": "de Plaa, C. (2019, June 19). Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR. Retrieved September 29, 2021.",
"url": "https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/"
},
{
"source_name": "Redops Syscalls",
"description": "Feichter, D. (2023, June 30). Direct Syscalls vs Indirect Syscalls. Retrieved September 27, 2023.",
"url": "https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls"
},
{
"source_name": "GNU Fork",
"description": "Free Software Foundation, Inc.. (2020, June 18). Creating a Process. Retrieved June 25, 2020.",
"url": "https://www.gnu.org/software/libc/manual/html_node/Creating-a-Process.html"
},
{
"source_name": "CyberBit System Calls",
"description": "Gavriel, H. (2018, November 27). Malware Mitigation when Direct System Calls are Used. Retrieved September 29, 2021.",
"url": "https://www.cyberbit.com/blog/endpoint-security/malware-mitigation-when-direct-system-calls-are-used/"
},
{
"source_name": "GLIBC",
"description": "glibc developer community. (2020, February 1). The GNU C Library (glibc). Retrieved June 25, 2020.",
"url": "https://www.gnu.org/software/libc/"
},
{
"source_name": "LIBC",
"description": "Kerrisk, M. (2016, December 12). libc(7) \u2014 Linux manual page. Retrieved June 25, 2020.",
"url": "https://man7.org/linux/man-pages//man7/libc.7.html"
},
{
"source_name": "Linux Kernel API",
"description": "Linux Kernel Organization, Inc. (n.d.). The Linux Kernel API. Retrieved June 25, 2020.",
"url": "https://www.kernel.org/doc/html/v4.12/core-api/kernel-api.html"
},
{
"source_name": "MDSec System Calls",
"description": "MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021.",
"url": "https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/"
},
{
"source_name": "Microsoft CreateProcess",
"description": "Microsoft. (n.d.). CreateProcess function. Retrieved September 12, 2024.",
"url": "https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa"
},
{
"source_name": "Microsoft Win32",
"description": "Microsoft. (n.d.). Programming reference for the Win32 API. Retrieved March 15, 2020.",
"url": "https://docs.microsoft.com/en-us/windows/win32/api/"
},
{
"source_name": "Microsoft NET",
"description": "Microsoft. (n.d.). What is .NET Framework?. Retrieved March 15, 2020.",
"url": "https://dotnet.microsoft.com/learn/dotnet/what-is-dotnet-framework"
},
{
"source_name": "NT API Windows",
"description": "The NTinterlnals.net team. (n.d.). Nowak, T. Retrieved June 25, 2020.",
"url": "https://undocumented.ntinternals.net/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Gordon Long, LegioX/Zoom, asaurusrex",
"Stefan Kanthak",
"Tristan Madani (Cybereason)"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_remote_support": false,
"x_mitre_version": "2.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:38:58.040000+00:00\", \"old_value\": \"2026-05-12 15:12:00.627000+00:00\"}}}",
"previous_version": "2.3",
"changelog_mitigations": {
"shared": [
"M1038: Execution Prevention",
"M1040: Behavior Prevention on Endpoint"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0529: Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--c21d5a77-d422-4a69-acd7-2c53c1faa34b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:10.728000+00:00",
"modified": "2026-09-03 19:46:48.129000+00:00",
"name": "Non-Application Layer Protocol",
"description": "Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).\n\nICMP communication between hosts is one example.(Citation: Cisco Synful Knock Evolution) Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts.(Citation: Microsoft ICMP) However, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.\n\nIn ESXi environments, adversaries may leverage the Virtual Machine Communication Interface (VMCI) for communication between guest virtual machines and the ESXi host. This traffic is similar to client-server communications on traditional network sockets but is localized to the physical machine running the ESXi host, meaning it does not traverse external networks (routers, switches). This results in communications that are invisible to external monitoring and standard networking tools like tcpdump, netstat, nmap, and Wireshark. By adding a VMCI backdoor to a compromised ESXi host, adversaries may persistently regain access from any guest VM to the compromised ESXi host\u2019s backdoor, regardless of network segmentation or firewall rules in place.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1095",
"external_id": "T1095"
},
{
"source_name": "Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023",
"description": "Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown. (2023, June 13). VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors. Retrieved March 26, 2025.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.",
"url": "https://arxiv.org/pdf/1408.1136"
},
{
"source_name": "Cisco Synful Knock Evolution",
"description": "Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.",
"url": "https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices"
},
{
"source_name": "Microsoft ICMP",
"description": "Microsoft. (n.d.). Internet Control Message Protocol (ICMP) Basics. Retrieved December 1, 2014.",
"url": "http://support.microsoft.com/KB/170292"
},
{
"source_name": "Cisco Blog Legacy Device Attacks",
"description": "Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.",
"url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
},
{
"source_name": "Wikipedia OSI",
"description": "Wikipedia. (n.d.). List of network protocols (OSI model). Retrieved December 4, 2014.",
"url": "http://en.wikipedia.org/wiki/List_of_network_protocols_%28OSI_model%29"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Ryan Becwar",
"Duane Michael"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "2.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-03 19:46:48.129000+00:00\", \"old_value\": \"2026-05-12 15:12:00.713000+00:00\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.\", \"old_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://arxiv.org/pdf/1408.1136\", \"old_value\": \"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf\"}}}",
"previous_version": "2.4",
"changelog_mitigations": {
"shared": [
"M1030: Network Segmentation",
"M1031: Network Intrusion Prevention",
"M1037: Filter Network Traffic",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0457: Detection of Non-Application Layer Protocols for C2"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--b18eae87-b469-4e14-b454-b171b416bc18",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-14 18:18:32.443000+00:00",
"modified": "2026-09-03 19:46:48.006000+00:00",
"name": "Non-Standard Port",
"description": "Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.\n\nAdversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1571",
"external_id": "T1571"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.",
"url": "https://arxiv.org/pdf/1408.1136"
},
{
"source_name": "Symantec Elfin Mar 2019",
"description": "Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.",
"url": "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"
},
{
"source_name": "change_rdp_port_conti",
"description": "The DFIR Report. (2022, March 1). \"Change RDP port\" #ContiLeaks. Retrieved September 12, 2024.",
"url": "https://x.com/TheDFIRReport/status/1498657772254240768"
},
{
"source_name": "Fortinet Agent Tesla April 2018",
"description": "Zhang, X. (2018, April 05). Analysis of New Agent Tesla Spyware Variant. Retrieved November 5, 2018.",
"url": "https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-03 19:46:48.006000+00:00\", \"old_value\": \"2026-05-12 15:12:00.707000+00:00\"}, \"root['external_references'][1]['description']\": {\"new_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.\", \"old_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://arxiv.org/pdf/1408.1136\", \"old_value\": \"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf\"}}}",
"previous_version": "1.3",
"changelog_mitigations": {
"shared": [
"M1030: Network Segmentation",
"M1031: Network Intrusion Prevention"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0227: Detection Strategy for Non-Standard Ports"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:30:32.662000+00:00",
"modified": "2026-09-11 19:32:58.098000+00:00",
"name": "Obfuscated Files or Information",
"description": "Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. \n\nPayloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.(Citation: Volexity PowerDuke November 2016) Adversaries may also use compressed or archived scripts, such as JavaScript. \n\nPortions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.(Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.(Citation: Carbon Black Obfuscation Sept 2016)\n\nAdversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1027",
"external_id": "T1027"
},
{
"source_name": "Volexity PowerDuke November 2016",
"description": "Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.",
"url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"
},
{
"source_name": "FireEye Obfuscation June 2017",
"description": "Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.",
"url": "https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"
},
{
"source_name": "FireEye Revoke-Obfuscation July 2017",
"description": "Bohannon, D. & Holmes, L. (2017, July 27). Revoke-Obfuscation: PowerShell Obfuscation Detection Using Science. Retrieved November 17, 2024.",
"url": "https://www.blackhat.com/docs/us-17/thursday/us-17-Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And%20Evasion-Using-Science-wp.pdf"
},
{
"source_name": "Linux/Cdorked.A We Live Security Analysis",
"description": "Pierre-Marc Bureau. (2013, April 26). Linux/Cdorked.A: New Apache backdoor being used in the wild to serve Blackhole. Retrieved September 10, 2017.",
"url": "https://www.welivesecurity.com/2013/04/26/linuxcdorked-new-apache-backdoor-in-the-wild-serves-blackhole/"
},
{
"source_name": "Carbon Black Obfuscation Sept 2016",
"description": "Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018.",
"url": "https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/"
},
{
"source_name": "PaloAlto EncodedCommand March 2017",
"description": "White, J. (2017, March 10). Pulling Back the Curtains on EncodedCommand PowerShell Attacks. Retrieved February 12, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Christiaan Beek, @ChristiaanBeek",
"Red Canary"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:32:58.098000+00:00\", \"old_value\": \"2026-05-12 15:12:00.708000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [
"M1017: User Training",
"M1040: Behavior Prevention on Endpoint",
"M1047: Audit",
"M1049: Antivirus/Antimalware"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0378: Behavioral Detection of Obfuscated Files or Information"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--5bfccc3f-2326-4112-86cc-c1ece9d8a2b5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-05 14:04:25.865000+00:00",
"modified": "2026-09-11 20:00:19.155000+00:00",
"name": "Binary Padding",
"description": "Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. \n\nBinary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.(Citation: ESET OceanLotus) The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1027/001",
"external_id": "T1027.001"
},
{
"source_name": "ESET OceanLotus",
"description": "Folt\u00fdn, T. (2018, March 13). OceanLotus ships new backdoor using old tricks. Retrieved May 22, 2018.",
"url": "https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"
},
{
"source_name": "Securelist Malware Tricks April 2017",
"description": "Ishimaru, S.. (2017, April 13). Old Malware Tricks To Bypass Detection in the Age of Big Data. Retrieved May 30, 2019.",
"url": "https://securelist.com/old-malware-tricks-to-bypass-detection-in-the-age-of-big-data/78010/"
},
{
"source_name": "VirusTotal FAQ",
"description": "VirusTotal. (n.d.). VirusTotal FAQ. Retrieved May 23, 2019.",
"url": "https://www.virustotal.com/en/faq/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Martin Jirkal, ESET"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 20:00:19.155000+00:00\", \"old_value\": \"2026-05-12 15:12:00.635000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0553: Detection Strategy for Obfuscated Files or Information: Binary Padding"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--0d91b3c0-5e50-47c3-949a-2a796f04d144",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-29 12:38:17.135000+00:00",
"modified": "2026-09-11 19:42:10.060000+00:00",
"name": "Encrypted/Encoded File",
"description": "Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Steganography](https://attack.mitre.org/techniques/T1027/003), and [Embedded Payloads](https://attack.mitre.org/techniques/T1027/009), share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)) at the time of execution/use.\n\nThis type of file obfuscation can be applied to many file artifacts present on victim hosts, such as malware log/configuration and payload files.(Citation: File obfuscation) Files can be encrypted with a hardcoded or user-supplied key, as well as otherwise obfuscated using standard encoding schemes such as Base64.\n\nThe entire content of a file may be obfuscated, or just specific functions or values (such as C2 addresses). Encryption and encoding may also be applied in redundant layers for additional protection.\n\nFor example, adversaries may abuse password-protected Word documents or self-extracting (SFX) archives as a method of encrypting/encoding a file such as a [Phishing](https://attack.mitre.org/techniques/T1566) payload. These files typically function by attaching the intended archived content to a decompressor stub that is executed when the file is invoked (e.g., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: SFX - Encrypted/Encoded File) \n\nAdversaries may also abuse file-specific as well as custom encoding schemes. For example, Byte Order Mark (BOM) headers in text files may be abused to manipulate and obfuscate file content until [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) execution.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1027/013",
"external_id": "T1027.013"
},
{
"source_name": "File obfuscation",
"description": "Aspen Lindblom, Joseph Goodwin, and Chris Sheldon. (2021, July 19). Shlayer Malvertising Campaigns Still Using Flash Update Disguise. Retrieved March 29, 2024.",
"url": "https://www.crowdstrike.com/blog/shlayer-malvertising-campaigns-still-using-flash-update-disguise/"
},
{
"source_name": "SFX - Encrypted/Encoded File",
"description": "Jai Minton. (2023, March 31). How Falcon OverWatch Investigates Malicious Self-Extracting Archives, Decoy Files and Their Hidden Payloads. Retrieved March 29, 2024.",
"url": "https://www.crowdstrike.com/blog/self-extracting-archives-decoy-files-and-their-hidden-payloads/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Andrew Northern, @ex_raritas",
"David Galazin @themalwareman1",
"Jai Minton, @Cyberraiju"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:42:10.060000+00:00\", \"old_value\": \"2026-05-12 15:12:00.620000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [
"M1040: Behavior Prevention on Endpoint",
"M1049: Antivirus/Antimalware"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0087: Encrypted or Encoded File Payload Detection Strategy"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--deb98323-e13f-4b0c-8d94-175379069062",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-05 14:17:46.686000+00:00",
"modified": "2026-09-11 19:21:13.428000+00:00",
"name": "Software Packing",
"description": "Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018) \n\nUtilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.(Citation: Awesome Executable Packing) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1027/002",
"external_id": "T1027.002"
},
{
"source_name": "Awesome Executable Packing",
"description": "Alexandre D'Hondt. (n.d.). Awesome Executable Packing. Retrieved March 11, 2022.",
"url": "https://github.com/dhondta/awesome-executable-packing"
},
{
"source_name": "ESET FinFisher Jan 2018",
"description": "Kafka, F. (2018, January). ESET's Guide to Deobfuscating and Devirtualizing FinFisher. Retrieved August 12, 2019.",
"url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/WP-FinFisher.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Filip Kafka, ESET"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:21:13.428000+00:00\", \"old_value\": \"2026-05-12 15:12:00.722000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [
"M1049: Antivirus/Antimalware"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0023: Obfuscated Binary Unpacking Detection via Behavioral Patterns"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--2e34237d-8574-43f6-aace-ae2915de8597",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-02 19:05:18.137000+00:00",
"modified": "2026-09-11 19:55:20.273000+00:00",
"name": "Spearphishing Attachment",
"description": "Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.(Citation: Unit 42 DarkHydrus July 2018) Spearphishing may also involve social engineering techniques, such as posing as a trusted source.\n\nThere are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "initial-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1566/001",
"external_id": "T1566.001"
},
{
"source_name": "ACSC Email Spoofing",
"description": "Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"
},
{
"source_name": "Unit 42 DarkHydrus July 2018",
"description": "Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
},
{
"source_name": "Microsoft Anti Spoofing",
"description": "Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.",
"url": "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"
},
{
"source_name": "Elastic - Koadiac Detection with EQL",
"description": "Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 17, 2024.",
"url": "https://www.elastic.co/security-labs/embracing-offensive-tooling-building-detections-against-koadic-using-eql"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Philip Winther"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:55:20.273000+00:00\", \"old_value\": \"2026-05-12 15:12:00.624000+00:00\"}}}",
"previous_version": "2.2",
"changelog_mitigations": {
"shared": [
"M1017: User Training",
"M1018: User Account Management",
"M1021: Restrict Web-Based Content",
"M1031: Network Intrusion Prevention",
"M1047: Audit",
"M1049: Antivirus/Antimalware",
"M1054: Software Configuration"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0236: Detection Strategy for Spearphishing Attachment across OS Platforms"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--2b742742-28c3-4e1b-bab7-8350d6300fa7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-02 19:15:44.182000+00:00",
"modified": "2026-09-11 19:55:38.427000+00:00",
"name": "Spearphishing Link",
"description": "Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.\n\nAll forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place.\n\nAdversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\").(Citation: CISA IDN ST05-016) URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an \u201c@\u201d symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023)\n\nAdversaries may also utilize links to perform consent phishing/spearphishing campaigns to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications.(Citation: Trend Micro Pawn Storm OAuth 2017)(Citation: Microsoft OAuth 2.0 Consent Phishing 2021) These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls.(Citation: Microsoft OAuth 2.0 Consent Phishing 2021)\n\nSimilarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as \u201cdevice code phishing,\u201d an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.(Citation: SecureWorks Device Code Phishing 2021)(Citation: Netskope Device Code Phishing 2021)(Citation: Optiv Device Code Phishing 2021)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "initial-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1566/002",
"external_id": "T1566.002"
},
{
"source_name": "ACSC Email Spoofing",
"description": "Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.",
"url": "https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"
},
{
"source_name": "CISA IDN ST05-016",
"description": "CISA. (2019, September 27). Security Tip (ST05-016): Understanding Internationalized Domain Names. Retrieved October 20, 2020.",
"url": "https://us-cert.cisa.gov/ncas/tips/ST05-016"
},
{
"source_name": "Trend Micro Pawn Storm OAuth 2017",
"description": "Hacquebord, F.. (2017, April 25). Pawn Storm Abuses Open Authentication in Advanced Social Engineering Attacks. Retrieved October 4, 2019.",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks"
},
{
"source_name": "Netskope Device Code Phishing 2021",
"description": "Jenko Hwong. (2021, August 10). New Phishing Attacks Exploiting OAuth Authorization Flows (Part 1). Retrieved March 19, 2024.",
"url": "https://www.netskope.com/blog/new-phishing-attacks-exploiting-oauth-authorization-flows-part-1"
},
{
"source_name": "Microsoft OAuth 2.0 Consent Phishing 2021",
"description": "Microsoft 365 Defender Threat Intelligence Team. (2021, June 14). Microsoft delivers comprehensive solution to battle rise in consent phishing emails. Retrieved December 13, 2021.",
"url": "https://www.microsoft.com/security/blog/2021/07/14/microsoft-delivers-comprehensive-solution-to-battle-rise-in-consent-phishing-emails/"
},
{
"source_name": "Microsoft Anti Spoofing",
"description": "Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.",
"url": "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"
},
{
"source_name": "Mandiant URL Obfuscation 2023",
"description": "Nick Simonian. (2023, May 22). Don't @ Me: URL Obfuscation Through Schema Abuse. Retrieved August 4, 2023.",
"url": "https://www.mandiant.com/resources/blog/url-obfuscation-schema-abuse"
},
{
"source_name": "Optiv Device Code Phishing 2021",
"description": "Optiv. (2021, August 17). Microsoft 365 OAuth Device Code Flow and Phishing. Retrieved March 19, 2024.",
"url": "https://www.optiv.com/insights/source-zero/blog/microsoft-365-oauth-device-code-flow-and-phishing"
},
{
"source_name": "SecureWorks Device Code Phishing 2021",
"description": "SecureWorks Counter Threat Unit Research Team. (2021, June 3). OAuth\u2019S Device Code Flow Abused in Phishing Attacks. Retrieved March 19, 2024.",
"url": "https://www.secureworks.com/blog/oauths-device-code-flow-abused-in-phishing-attacks"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Philip Winther",
"Shailesh Tiwary (Indian Army)",
"Mark Wee",
"Jeff Sakowicz, Microsoft Identity Developer Platform Services (IDPM Services)",
"Saisha Agrawal, Microsoft Threat Intelligent Center (MSTIC)",
"Kobi Haimovich, CardinalOps",
"Menachem Goldstein"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Identity Provider",
"Linux",
"macOS",
"Office Suite",
"SaaS",
"Windows"
],
"x_mitre_version": "2.8",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:55:38.427000+00:00\", \"old_value\": \"2026-05-12 15:12:00.623000+00:00\"}}}",
"previous_version": "2.8",
"changelog_mitigations": {
"shared": [
"M1017: User Training",
"M1018: User Account Management",
"M1021: Restrict Web-Based Content",
"M1047: Audit",
"M1054: Software Configuration"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0107: Detection Strategy for Spearphishing Links"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:30:48.728000+00:00",
"modified": "2026-09-11 19:40:13.112000+00:00",
"name": "Process Discovery",
"description": "Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nIn Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or Get-Process via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via `/proc`. ESXi also supports use of the `ps` command, as well as `esxcli system process list`.(Citation: Sygnia ESXi Ransomware 2025)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)\n\nOn network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1057",
"external_id": "T1057"
},
{
"source_name": "show_processes_cisco_cmd",
"description": "Cisco. (2022, August 16). show processes - . Retrieved July 13, 2022.",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/show_monitor_permit_list_through_show_process_memory.html#wp3599497760"
},
{
"source_name": "Crowdstrike Hypervisor Jackpotting Pt 2 2021",
"description": "Michael Dawson. (2021, August 30). Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware. Retrieved March 26, 2025.",
"url": "https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"
},
{
"source_name": "US-CERT-TA18-106A",
"description": "US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
},
{
"source_name": "Sygnia ESXi Ransomware 2025",
"description": "Zhongyuan Hau (Aaron), Ren Jie Yow, and Yoav Mazor. (2025, January 21). ESXi Ransomware Attacks: Stealthy Persistence through. Retrieved March 27, 2025.",
"url": "https://www.sygnia.co/blog/esxi-ransomware-ssh-tunneling-defense-strategies/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Austin Clark, @c2defense"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "1.6",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:40:13.112000+00:00\", \"old_value\": \"2026-05-12 15:12:00.705000+00:00\"}}}",
"previous_version": "1.6",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0034: Detection of Adversarial Process Discovery Behavior"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:30:47.843000+00:00",
"modified": "2026-09-11 20:00:48.048000+00:00",
"name": "Process Injection",
"description": "Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process. \n\nThere are many different ways to inject code into a process, many of which abuse legitimate functionalities. These implementations exist for every major OS but are typically platform specific. \n\nMore sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1055",
"external_id": "T1055"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Anastasios Pingios",
"Christiaan Beek, @ChristiaanBeek",
"Ryan Becwar"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 20:00:48.048000+00:00\", \"old_value\": \"2026-05-12 15:12:00.629000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [
"M1026: Privileged Account Management",
"M1040: Behavior Prevention on Endpoint"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0508: Behavioral Detection of Process Injection Across Platforms"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--b200542e-e877-4395-875b-cf1a44537ca4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-14 17:21:54.470000+00:00",
"modified": "2026-09-11 19:54:27.078000+00:00",
"name": "Process Hollowing",
"description": "Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process. \n\nProcess hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code. A victim process can be created with native Windows API calls such as CreateProcess, which includes a flag to suspend the processes primary thread. At this point the process can be unmapped using APIs calls such as ZwUnmapViewOfSection or NtUnmapViewOfSection before being written to, realigned to the injected code, and resumed via VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively.(Citation: Leitch Hollowing)(Citation: Elastic Process Injection July 2017)\n\nThis is very similar to [Thread Local Storage](https://attack.mitre.org/techniques/T1055/005) but creates a new process rather than targeting an existing process. This behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process hollowing may also evade detection from security products since the execution is masked under a legitimate process. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1055/012",
"external_id": "T1055.012"
},
{
"source_name": "Elastic Process Injection July 2017",
"description": "Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.",
"url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
},
{
"source_name": "Leitch Hollowing",
"description": "Leitch, J. (n.d.). Process Hollowing. Retrieved September 12, 2024.",
"url": "https://new.dc414.org/wp-content/uploads/2011/01/Process-Hollowing.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:54:27.078000+00:00\", \"old_value\": \"2026-05-12 15:12:00.708000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [
"M1040: Behavior Prevention on Endpoint"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0382: Detection Strategy for Process Hollowing on Windows"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--41d9846c-f6af-4302-a654-24bba2729bc6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-14 01:28:32.166000+00:00",
"modified": "2026-09-11 19:43:31.571000+00:00",
"name": "Thread Execution Hijacking",
"description": "Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process. \n\nThread Execution Hijacking is commonly performed by suspending an existing process then unmapping/hollowing its memory, which can then be replaced with malicious code or the path to a DLL. A handle to an existing victim process is first created with native Windows API calls such as OpenThread. At this point the process can be suspended then written to, realigned to the injected code, and resumed via SuspendThread , VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively.(Citation: Elastic Process Injection July 2017)\n\nThis is very similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012) but targets an existing process rather than creating a process in a suspended state. \n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via Thread Execution Hijacking may also evade detection from security products since the execution is masked under a legitimate process. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1055/003",
"external_id": "T1055.003"
},
{
"source_name": "Elastic Process Injection July 2017",
"description": "Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.",
"url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:43:31.571000+00:00\", \"old_value\": \"2026-05-12 15:12:00.629000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [
"M1040: Behavior Prevention on Endpoint"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0295: Behavioral Detection of Thread Execution Hijacking via Thread Suspension and Context Switching"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--4fe28b27-b13c-453e-a386-c2ef362a573b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-15 16:03:39.082000+00:00",
"modified": "2026-09-03 19:46:46.553000+00:00",
"name": "Protocol Tunneling",
"description": "Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet. \n\nThere are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel.(Citation: SSH Tunneling)(Citation: Sygnia Abyss Locker 2025) \n\n[Protocol Tunneling](https://attack.mitre.org/techniques/T1572) may also be abused by adversaries during [Dynamic Resolution](https://attack.mitre.org/techniques/T1568). Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.(Citation: BleepingComp Godlua JUL19) \n\nAdversaries may also leverage [Protocol Tunneling](https://attack.mitre.org/techniques/T1572) in conjunction with [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Protocol or Service Impersonation](https://attack.mitre.org/techniques/T1001/003) to further conceal C2 communications and infrastructure. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1572",
"external_id": "T1572"
},
{
"source_name": "Sygnia Abyss Locker 2025",
"description": "Abigail See, Zhongyuan (Aaron) Hau, Ren Jie Yow, Yoav Mazor, Omer Kidron, and Oren Biderman. (2025, February 4). The Anatomy of Abyss Locker Ransomware Attack. Retrieved April 4, 2025.",
"url": "https://www.sygnia.co/blog/abyss-locker-ransomware-attack-analysis/"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.",
"url": "https://arxiv.org/pdf/1408.1136"
},
{
"source_name": "BleepingComp Godlua JUL19",
"description": "Gatlan, S. (2019, July 3). New Godlua Malware Evades Traffic Monitoring via DNS over HTTPS. Retrieved March 15, 2020.",
"url": "https://www.bleepingcomputer.com/news/security/new-godlua-malware-evades-traffic-monitoring-via-dns-over-https/"
},
{
"source_name": "SSH Tunneling",
"description": "SSH.COM. (n.d.). SSH tunnel. Retrieved March 15, 2020.",
"url": "https://www.ssh.com/ssh/tunneling"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-03 19:46:46.553000+00:00\", \"old_value\": \"2026-05-12 15:12:00.632000+00:00\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.\", \"old_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://arxiv.org/pdf/1408.1136\", \"old_value\": \"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf\"}}}",
"previous_version": "1.1",
"changelog_mitigations": {
"shared": [
"M1031: Network Intrusion Prevention",
"M1037: Filter Network Traffic"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0538: Detection Strategy for Protocol Tunneling accross OS platforms."
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--731f4f55-b6d0-41d1-a7a9-072a66389aea",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:08.479000+00:00",
"modified": "2026-09-08 20:28:07.390000+00:00",
"name": "Proxy",
"description": "Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap.(Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.\n\nAdversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1090",
"external_id": "T1090"
},
{
"source_name": "Trend Micro APT Attack Tools",
"description": "Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015.",
"url": "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Jon Sheedy",
"Heather Linn",
"Walker Johnson"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "3.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-08 20:28:07.390000+00:00\", \"old_value\": \"2026-05-12 15:12:00.641000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap.(Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.\\n\\nAdversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\", \"old_value\": \"Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.\\n\\nAdversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.\\n+Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap.(Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.\\n \\n Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.\"}}, \"iterable_item_removed\": {\"root['external_references'][1]\": {\"source_name\": \"University of Birmingham C2\", \"description\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.\", \"url\": \"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf\"}}}",
"previous_version": "3.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use a connection proxy to direct network tra | t | 1 | Adversaries may use a connection proxy to direct network tra |
| > | ffic between systems or act as an intermediary for network c | > | ffic between systems or act as an intermediary for network c | ||
| > | ommunications to a command and control server to avoid direc | > | ommunications to a command and control server to avoid direc | ||
| > | t connections to their infrastructure. Many tools exist that | > | t connections to their infrastructure. Many tools exist that | ||
| > | enable traffic redirection through proxies or port redirect | > | enable traffic redirection through proxies or port redirect | ||
| > | ion, including [HTRAN](https://attack.mitre.org/software/S00 | > | ion, including [HTRAN](https://attack.mitre.org/software/S00 | ||
| > | 40), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Atta | > | 40), ZXProxy, and ZXPortMap.(Citation: Trend Micro APT Attac | ||
| > | ck Tools) Adversaries use these types of proxies to manage c | > | k Tools) Adversaries use these types of proxies to manage co | ||
| > | ommand and control communications, reduce the number of simu | > | mmand and control communications, reduce the number of simul | ||
| > | ltaneous outbound network connections, provide resiliency in | > | taneous outbound network connections, provide resiliency in | ||
| > | the face of connection loss, or to ride over existing trust | > | the face of connection loss, or to ride over existing truste | ||
| > | ed communications paths between victims to avoid suspicion. | > | d communications paths between victims to avoid suspicion. A | ||
| > | Adversaries may chain together multiple proxies to further d | > | dversaries may chain together multiple proxies to further di | ||
| > | isguise the source of malicious traffic. Adversaries can al | > | sguise the source of malicious traffic. Adversaries can als | ||
| > | so take advantage of routing schemes in Content Delivery Net | > | o take advantage of routing schemes in Content Delivery Netw | ||
| > | works (CDNs) to proxy command and control traffic. | > | orks (CDNs) to proxy command and control traffic. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use an external proxy to act as an intermedi | t | 1 | Adversaries may use an external proxy to act as an intermedi |
| > | ary for network communications to a command and control serv | > | ary for network communications to a command and control serv | ||
| > | er to avoid direct connections to their infrastructure. Many | > | er to avoid direct connections to their infrastructure. Many | ||
| > | tools exist that enable traffic redirection through proxies | > | tools exist that enable traffic redirection through proxies | ||
| > | or port redirection, including [HTRAN](https://attack.mitre | > | or port redirection, including [HTRAN](https://attack.mitre | ||
| > | .org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Tre | > | .org/software/S0040), ZXProxy, and ZXPortMap.(Citation: Tren | ||
| > | nd Micro APT Attack Tools) Adversaries use these types of pr | > | d Micro APT Attack Tools) Adversaries use these types of pro | ||
| > | oxies to manage command and control communications, to provi | > | xies to manage command and control communications, to provid | ||
| > | de resiliency in the face of connection loss, or to ride ove | > | e resiliency in the face of connection loss, or to ride over | ||
| > | r existing trusted communications paths to avoid suspicion. | > | existing trusted communications paths to avoid suspicion. | ||
| > | External connection proxies are used to mask the destinatio | > | External connection proxies are used to mask the destination | ||
| > | n of C2 traffic and are typically implemented with port redi | > | of C2 traffic and are typically implemented with port redir | ||
| > | rectors. Compromised systems outside of the victim environme | > | ectors. Compromised systems outside of the victim environmen | ||
| > | nt may be used for these purposes, as well as purchased infr | > | t may be used for these purposes, as well as purchased infra | ||
| > | astructure such as cloud-based resources or virtual private | > | structure such as cloud-based resources or virtual private s | ||
| > | servers. Proxies may be chosen based on the low likelihood t | > | ervers. Proxies may be chosen based on the low likelihood th | ||
| > | hat a connection to them from a compromised system would be | > | at a connection to them from a compromised system would be i | ||
| > | investigated. Victim systems would communicate directly with | > | nvestigated. Victim systems would communicate directly with | ||
| > | the external proxy on the Internet and then the proxy would | > | the external proxy on the Internet and then the proxy would | ||
| > | forward communications to the C2 server. | > | forward communications to the C2 server. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use an internal proxy to direct command and | t | 1 | Adversaries may use an internal proxy to direct command and |
| > | control traffic between two or more systems in a compromised | > | control traffic between two or more systems in a compromised | ||
| > | environment. Many tools exist that enable traffic redirecti | > | environment. Many tools exist that enable traffic redirecti | ||
| > | on through proxies or port redirection, including [HTRAN](ht | > | on through proxies or port redirection, including [HTRAN](ht | ||
| > | tps://attack.mitre.org/software/S0040), ZXProxy, and ZXPortM | > | tps://attack.mitre.org/software/S0040), ZXProxy, and ZXPortM | ||
| > | ap. (Citation: Trend Micro APT Attack Tools) Adversaries use | > | ap.(Citation: Trend Micro APT Attack Tools) Adversaries use | ||
| > | internal proxies to manage command and control communicatio | > | internal proxies to manage command and control communication | ||
| > | ns inside a compromised environment, to reduce the number of | > | s inside a compromised environment, to reduce the number of | ||
| > | simultaneous outbound network connections, to provide resil | > | simultaneous outbound network connections, to provide resili | ||
| > | iency in the face of connection loss, or to ride over existi | > | ency in the face of connection loss, or to ride over existin | ||
| > | ng trusted communications paths between infected systems to | > | g trusted communications paths between infected systems to a | ||
| > | avoid suspicion. Internal proxy connections may use common p | > | void suspicion. Internal proxy connections may use common pe | ||
| > | eer-to-peer (p2p) networking protocols, such as SMB, to bett | > | er-to-peer (p2p) networking protocols, such as SMB, to bette | ||
| > | er blend in with the environment. By using a compromised in | > | r blend in with the environment. By using a compromised int | ||
| > | ternal system as a proxy, adversaries may conceal the true d | > | ernal system as a proxy, adversaries may conceal the true de | ||
| > | estination of C2 traffic while reducing the need for numerou | > | stination of C2 traffic while reducing the need for numerous | ||
| > | s connections to external systems. | > | connections to external systems. |
MSExchangeIS, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server, or on virtual machines hosted on ESXi infrastructure.(Citation: SecureWorks WannaCry Analysis)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)\n\nThreat actors may also disable or stop service in cloud environments. For example, by leveraging the `DisableAPIServiceAccess` API in AWS, a threat actor may prevent the service from creating service-linked roles on new accounts in the AWS Organization.(Citation: Datadog Security Labs Cloud Persistence 2025)(Citation: AWS DisableAWSServiceAccess)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "impact"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1489",
"external_id": "T1489"
},
{
"source_name": "AWS DisableAWSServiceAccess",
"description": "AWS. (n.d.). DisableAWSServiceAccess. Retrieved May 22, 2025.",
"url": "https://docs.aws.amazon.com/organizations/latest/APIReference/API_DisableAWSServiceAccess.html"
},
{
"source_name": "SecureWorks WannaCry Analysis",
"description": "Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019.",
"url": "https://www.secureworks.com/research/wcry-ransomware-analysis"
},
{
"source_name": "Datadog Security Labs Cloud Persistence 2025",
"description": "Martin McCloskey. (2025, May 13). Tales from the cloud trenches: The Attacker doth persist too much, methinks. Retrieved May 22, 2025.",
"url": "https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-the-attacker-doth-persist-too-much/"
},
{
"source_name": "Talos Olympic Destroyer 2018",
"description": "Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.",
"url": "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
},
{
"source_name": "Crowdstrike Hypervisor Jackpotting Pt 2 2021",
"description": "Michael Dawson. (2021, August 30). Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware. Retrieved March 26, 2025.",
"url": "https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"
},
{
"source_name": "Novetta Blockbuster",
"description": "Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.",
"url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Liran Ravich, CardinalOps"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_impact_type": [
"Availability"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"IaaS",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:41:40.954000+00:00\", \"old_value\": \"2026-05-12 15:12:00.622000+00:00\"}}}",
"previous_version": "1.4",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1022: Restrict File and Directory Permissions",
"M1024: Restrict Registry Permissions",
"M1030: Network Segmentation",
"M1060: Out-of-Band Communications Channel"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0021: Behavioral Detection for Service Stop across Platforms"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--0a5231ec-41af-4a35-83d0-6bdf11f28c65",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:40.542000+00:00",
"modified": "2026-09-11 19:58:20.992000+00:00",
"name": "Shared Modules",
"description": "Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., [Native API](https://attack.mitre.org/techniques/T1106)).\n\nAdversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective.\n\nThe Linux & macOS module loader can load and execute shared objects from arbitrary local paths. This functionality resides in `dlfcn.h` in functions such as `dlopen` and `dlsym`. Although macOS can execute `.so` files, common practice uses `.dylib` files.(Citation: Apple Dev Dynamic Libraries)(Citation: Linux Shared Libraries)(Citation: RotaJakiro 2021 netlab360 analysis)(Citation: Unit42 OceanLotus 2017)\n\nThe Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in `NTDLL.dll` and is part of the Windows [Native API](https://attack.mitre.org/techniques/T1106) which is called from functions like `LoadLibrary` at run time.(Citation: Microsoft DLL)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1129",
"external_id": "T1129"
},
{
"source_name": "RotaJakiro 2021 netlab360 analysis",
"description": " Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023.",
"url": "https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/"
},
{
"source_name": "Apple Dev Dynamic Libraries",
"description": "Apple. (2012, July 23). Overview of Dynamic Libraries. Retrieved September 7, 2023.",
"url": "https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/OverviewOfDynamicLibraries.html"
},
{
"source_name": "Unit42 OceanLotus 2017",
"description": "Erye Hernandez and Danny Tsechansky. (2017, June 22). The New and Improved macOS Backdoor from OceanLotus. Retrieved September 8, 2023.",
"url": "https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/"
},
{
"source_name": "Microsoft DLL",
"description": "Microsoft. (2023, April 28). What is a DLL. Retrieved September 7, 2023.",
"url": "https://learn.microsoft.com/troubleshoot/windows-client/deployment/dynamic-link-library"
},
{
"source_name": "Linux Shared Libraries",
"description": "Wheeler, D. (2003, April 11). Shared Libraries. Retrieved September 7, 2023.",
"url": "https://tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Stefan Kanthak"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_remote_support": false,
"x_mitre_version": "2.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:58:20.992000+00:00\", \"old_value\": \"2025-10-24 17:48:22.302000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "2.3",
"changelog_mitigations": {
"shared": [
"M1038: Execution Prevention"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0018: Behavior-chain, platform-aware detection strategy for T1129 Shared Modules"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--354a7f88-63fb-41b5-a801-ce3b377b36f1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:04.307000+00:00",
"modified": "2026-09-11 19:56:24.154000+00:00",
"name": "System Information Discovery",
"description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from [Local Storage Discovery](https://attack.mitre.org/techniques/T1680) which is an adversary's discovery of local drive, disks and/or volumes.\n\nTools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. Adversaries may leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. show version).(Citation: US-CERT-TA18-106A) On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: Varonis)\n\nInfrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)\n\n[System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1082",
"external_id": "T1082"
},
{
"source_name": "Amazon Describe Instance",
"description": "Amazon. (n.d.). describe-instance-information. Retrieved March 3, 2020.",
"url": "https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html"
},
{
"source_name": "Google Instances Resource",
"description": "Google. (n.d.). Rest Resource: instance. Retrieved March 3, 2020.",
"url": "https://cloud.google.com/compute/docs/reference/rest/v1/instances"
},
{
"source_name": "Varonis",
"description": "Jason Hill. (2023, February 8). VMware ESXi in the Line of Ransomware Fire. Retrieved March 26, 2025.",
"url": "https://www.varonis.com/blog/vmware-esxi-in-the-line-of-ransomware-fire"
},
{
"source_name": "Crowdstrike Hypervisor Jackpotting Pt 2 2021",
"description": "Michael Dawson. (2021, August 30). Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware. Retrieved March 26, 2025.",
"url": "https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"
},
{
"source_name": "Microsoft Virutal Machine API",
"description": "Microsoft. (2019, March 1). Virtual Machines - Get. Retrieved October 8, 2019.",
"url": "https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/get"
},
{
"source_name": "20 macOS Common Tools and Techniques",
"description": "Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.",
"url": "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
},
{
"source_name": "OSX.FairyTale",
"description": "Phile Stokes. (2018, September 20). On the Trail of OSX.FairyTale | Adware Playing at Malware. Retrieved August 24, 2021.",
"url": "https://www.sentinelone.com/blog/trail-osx-fairytale-adware-playing-malware/"
},
{
"source_name": "US-CERT-TA18-106A",
"description": "US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Maril Vernon @shewhohacks",
"Praetorian",
"Austin Clark, @c2defense"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"IaaS",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:56:24.154000+00:00\", \"old_value\": \"2026-05-12 15:12:00.625000+00:00\"}}}",
"previous_version": "3.0",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0525: System Discovery via Native and Remote Utilities"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--c877e33f-1df6-40d6-b1e7-ce70f16f4979",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-04-01 16:42:08.735000+00:00",
"modified": "2026-09-11 19:39:19.101000+00:00",
"name": "System Location Discovery",
"description": "\nAdversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nAdversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021)\n\nAdversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1614",
"external_id": "T1614"
},
{
"source_name": "Bleepingcomputer RAT malware 2020",
"description": "Abrams, L. (2020, October 23). New RAT malware gets commands via Discord, has ransomware feature. Retrieved April 1, 2021.",
"url": "https://www.bleepingcomputer.com/news/security/new-rat-malware-gets-commands-via-discord-has-ransomware-feature/"
},
{
"source_name": "AWS Instance Identity Documents",
"description": "Amazon. (n.d.). Instance identity documents. Retrieved April 2, 2021.",
"url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html"
},
{
"source_name": "Securelist Trasparent Tribe 2020",
"description": "Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved April 1, 2021.",
"url": "https://securelist.com/transparent-tribe-part-1/98127/"
},
{
"source_name": "FBI Ragnar Locker 2020",
"description": "FBI. (2020, November 19). Indicators of Compromise Associated with Ragnar Locker Ransomware. Retrieved September 12, 2024.",
"url": "https://s3.documentcloud.org/documents/20413525/fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc.pdf"
},
{
"source_name": "Microsoft Azure Instance Metadata 2021",
"description": "Microsoft. (2021, February 21). Azure Instance Metadata Service (Windows). Retrieved April 2, 2021.",
"url": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service?tabs=windows"
},
{
"source_name": "Sophos Geolocation 2016",
"description": "Wisniewski, C. (2016, May 3). Location-based threats: How cybercriminals target you based on where you live. Retrieved April 1, 2021.",
"url": "https://news.sophos.com/en-us/2016/05/03/location-based-ransomware-threat-research/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Pooja Natarajan, NEC Corporation India",
"Hiroki Nagahama, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India",
"Wes Hurd",
"Katie Nickels, Red Canary"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"IaaS",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:39:19.101000+00:00\", \"old_value\": \"2026-05-12 15:12:00.716000+00:00\"}}}",
"previous_version": "1.1",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0043: Detection Strategy for System Location Discovery"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--f1951e8a-500e-4a26-8803-76d95c4554b4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-10 18:33:36.159000+00:00",
"modified": "2026-09-11 19:43:47.298000+00:00",
"name": "Service Execution",
"description": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and [Net](https://attack.mitre.org/software/S0039).\n\n[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) and sc.exe can accept remote servers as arguments and may be used to conduct remote execution.\n\nAdversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1569/002",
"external_id": "T1569.002"
},
{
"source_name": "Microsoft Service Control Manager",
"description": "Microsoft. (2018, May 31). Service Control Manager. Retrieved March 28, 2020.",
"url": "https://docs.microsoft.com/windows/win32/services/service-control-manager"
},
{
"source_name": "Russinovich Sysinternals",
"description": "Russinovich, M. (2014, May 2). Windows Sysinternals PsExec v2.11. Retrieved May 13, 2015.",
"url": "https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_remote_support": false,
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:43:47.298000+00:00\", \"old_value\": \"2026-05-12 15:12:00.723000+00:00\"}}}",
"previous_version": "1.3",
"changelog_mitigations": {
"shared": [
"M1022: Restrict File and Directory Permissions",
"M1026: Privileged Account Management",
"M1040: Behavior Prevention on Endpoint"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0421: Detection Strategy for System Services Service Execution"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--f3c544dc-673c-4ef3-accb-53229f1ae077",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:37.450000+00:00",
"modified": "2026-09-11 19:39:36.116000+00:00",
"name": "System Time Discovery",
"description": "An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.(Citation: MSDN System Time)(Citation: Technet Windows Time Service)(Citation: systemsetup mac time) These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.(Citation: Mac Time Sync)(Citation: linux system time)\n\nSystem time information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing net time \\\\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz.(Citation: Technet Windows Time Service) In addition, adversaries can discover device uptime through functions such as GetTickCount() to determine how long it has been since the system booted up.(Citation: Virtualization/Sandbox Evasion)\n\nOn network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show clock detail` can be used to see the current time configuration.(Citation: show_clock_detail_cisco_cmd) On ESXi servers, `esxcli system clock get` can be used for the same purpose.\n\nIn addition, system calls \u2013 such as time() \u2013 have been used to collect the current time on Linux devices.(Citation: MAGNET GOBLIN) On macOS systems, adversaries may use commands such as systemsetup -gettimezone or timeIntervalSinceNow to gather current time zone information or current date and time.(Citation: System Information Discovery Technique)(Citation: ESET DazzleSpy Jan 2022)\n\nThis information could be useful for performing other techniques, such as executing a file with a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)(Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting (i.e. [System Location Discovery](https://attack.mitre.org/techniques/T1614)). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.(Citation: AnyRun TimeBomb)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1124",
"external_id": "T1124"
},
{
"source_name": "systemsetup mac time",
"description": "Apple Support. (n.d.). About systemsetup in Remote Desktop. Retrieved March 27, 2024.",
"url": "https://support.apple.com/en-gb/guide/remote-desktop/apd95406b8d/mac"
},
{
"source_name": "linux system time",
"description": "ArchLinux. (2024, February 1). System Time. Retrieved March 27, 2024.",
"url": "https://wiki.archlinux.org/title/System_time"
},
{
"source_name": "MAGNET GOBLIN",
"description": "Check Point Research. (2024, March 8). MAGNET GOBLIN TARGETS PUBLICLY FACING SERVERS USING 1-DAY VULNERABILITIES. Retrieved March 27, 2024.",
"url": "https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/"
},
{
"source_name": "show_clock_detail_cisco_cmd",
"description": "Cisco. (2023, March 6). show clock detail - Cisco IOS Security Command Reference: Commands S to Z . Retrieved July 13, 2022.",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-s2.html#wp1896741674"
},
{
"source_name": "Mac Time Sync",
"description": "Cone, Matt. (2021, January 14). Synchronize your Mac's Clock with a Time Server. Retrieved March 27, 2024.",
"url": "https://www.macinstruct.com/tutorials/synchronize-your-macs-clock-with-a-time-server/"
},
{
"source_name": "ESET DazzleSpy Jan 2022",
"description": "M.L\u00e9veill\u00e9, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.",
"url": "https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"
},
{
"source_name": "AnyRun TimeBomb",
"description": "Malicious History. (2020, September 17). Time Bombs: Malware With Delayed Execution. Retrieved April 22, 2021.",
"url": "https://any.run/cybersecurity-blog/time-bombs-malware-with-delayed-execution/"
},
{
"source_name": "Technet Windows Time Service",
"description": "Mathers, B. (2016, September 30). Windows Time Service Tools and Settings. Retrieved November 25, 2016.",
"url": "https://technet.microsoft.com/windows-server-docs/identity/ad-ds/get-started/windows-time-service/windows-time-service-tools-and-settings"
},
{
"source_name": "MSDN System Time",
"description": "Microsoft. (n.d.). System Time. Retrieved November 25, 2016.",
"url": "https://msdn.microsoft.com/ms724961.aspx"
},
{
"source_name": "RSA EU12 They're Inside",
"description": "Rivner, U., Schwartz, E. (2012). They\u2019re Inside\u2026 Now What?. Retrieved November 25, 2016.",
"url": "https://www.rsaconference.com/writable/presentations/file_upload/ht-209_rivner_schwartz.pdf"
},
{
"source_name": "System Information Discovery Technique",
"description": "YUCEEL, Huseyin Can. Picus Labs. (2022, June 9). The System Information Discovery Technique Explained - MITRE ATT&CK T1082. Retrieved March 27, 2024.",
"url": "https://www.picussecurity.com/resource/the-system-information-discovery-technique-explained-mitre-attack-t1082"
},
{
"source_name": "Virtualization/Sandbox Evasion",
"description": "YUCEEL, Huseyin Can. Picus Labs. (2022, June 9). Virtualization/Sandbox Evasion - How Attackers Avoid Malware Analysis. Retrieved December 26, 2023.",
"url": "https://www.picussecurity.com/resource/virtualization/sandbox-evasion-how-attackers-avoid-malware-analysis"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"FIRST.ORG's Cyber Threat Intelligence SIG",
"Austin Clark, @c2defense"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"x_mitre_version": "1.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:39:36.116000+00:00\", \"old_value\": \"2026-05-12 15:12:00.724000+00:00\"}}}",
"previous_version": "1.5",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0151: Behavior-chain, platform-aware detection strategy for T1124 System Time Discovery"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--837f9164-50af-4ac0-8219-379d8a74cefc",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-04 12:52:13.006000+00:00",
"modified": "2026-09-11 19:22:30.399000+00:00",
"name": "Credentials In Files",
"description": "Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.\n\nIt is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).(Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.(Citation: SRD GPP)\n\nIn cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware) They may also be found as parameters to deployment commands in container logs.(Citation: Unit 42 Unsecured Docker Daemons) In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1552/001",
"external_id": "T1552.001"
},
{
"source_name": "CG 2014",
"description": "CG. (2014, May 20). Mimikatz Against Virtual Machine Memory Part 1. Retrieved November 12, 2014.",
"url": "http://carnal0wnage.attackresearch.com/2014/05/mimikatz-against-virtual-machine-memory.html"
},
{
"source_name": "Unit 42 Hildegard Malware",
"description": "Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.",
"url": "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"
},
{
"source_name": "Unit 42 Unsecured Docker Daemons",
"description": "Chen, J.. (2020, January 29). Attacker's Tactics and Techniques in Unsecured Docker Daemons Revealed. Retrieved March 31, 2021.",
"url": "https://unit42.paloaltonetworks.com/attackers-tactics-and-techniques-in-unsecured-docker-daemons-revealed/"
},
{
"source_name": "Specter Ops - Cloud Credential Storage",
"description": "Maddalena, C.. (2018, September 12). Head in the Clouds. Retrieved October 4, 2019.",
"url": "https://posts.specterops.io/head-in-the-clouds-bd038bb69e48"
},
{
"source_name": "SRD GPP",
"description": "Security Research and Defense. (2014, May 13). MS14-025: An Update for Group Policy Preferences. Retrieved January 28, 2015.",
"url": "http://blogs.technet.com/b/srd/archive/2014/05/13/ms14-025-an-update-for-group-policy-preferences.aspx"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Rory McCune, Aqua Security",
"Jay Chen, Palo Alto Networks",
"Yossi Weizman, Azure Defender Research Team",
"Vishwas Manral, McAfee",
"Microsoft Threat Intelligence Center (MSTIC)"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Containers",
"IaaS",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:22:30.399000+00:00\", \"old_value\": \"2026-05-12 15:12:00.672000+00:00\"}}}",
"previous_version": "1.3",
"changelog_mitigations": {
"shared": [
"M1017: User Training",
"M1022: Restrict File and Directory Permissions",
"M1027: Password Policies",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0307: Detect Access to Unsecured Credential Files Across Platforms"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--b0c74ef9-c61e-4986-88cb-78da98a355ec",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-03-30 17:20:05.789000+00:00",
"modified": "2026-10-07 17:57:14.703000+00:00",
"name": "Malicious Image",
"description": "Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs)\n\nAdversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: Aqua Security Cloud Native Threat Report June 2021)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1204/003",
"external_id": "T1204.003"
},
{
"source_name": "Summit Route Malicious AMIs",
"description": "Piper, S.. (2018, September 24). Investigating Malicious AMIs. Retrieved March 30, 2021.",
"url": "https://summitroute.com/blog/2018/09/24/investigating_malicious_amis/"
},
{
"source_name": "Aqua Security Cloud Native Threat Report June 2021",
"description": "Team Nautilus. (2021, June). Attacks in the Wild on the Container Supply Chain and Infrastructure. Retrieved October 7, 2026.",
"url": "https://web.archive.org/web/20220106180157/https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Center for Threat-Informed Defense (CTID)",
"Vishwas Manral, McAfee"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"IaaS",
"Containers"
],
"x_mitre_remote_support": false,
"x_mitre_version": "1.2",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_remote_support']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-10-07 17:57:14.703000+00:00\", \"old_value\": \"2025-10-24 17:49:13.999000+00:00\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"Team Nautilus. (2021, June). Attacks in the Wild on the Container Supply Chain and Infrastructure. Retrieved October 7, 2026.\", \"old_value\": \"Team Nautilus. (2021, June). Attacks in the Wild on the Container Supply Chain and Infrastructure. Retrieved August 26, 2021.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://web.archive.org/web/20220106180157/https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf\", \"old_value\": \"https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf?utm_campaign=WP%20-%20Jun2021%20Nautilus%202021%20Threat%20Research%20Report&utm_medium=email&_hsmi=132931006&_hsenc=p2ANqtz-_8oopT5Uhqab8B7kE0l3iFo1koirxtyfTehxF7N-EdGYrwk30gfiwp5SiNlW3G0TNKZxUcDkYOtwQ9S6nNVNyEO-Dgrw&utm_content=132931006&utm_source=hs_automation\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.2",
"changelog_mitigations": {
"shared": [
"M1017: User Training",
"M1031: Network Intrusion Prevention",
"M1045: Code Signing",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0248: User Execution \u2013 Malicious Image (containers & IaaS) \u2013 pull/run \u2192 start \u2192 anomalous behavior (T1204.003)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--ef67e13e-5598-4adc-bdb2-998225874fa9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-11 14:43:31.706000+00:00",
"modified": "2026-09-11 19:19:57.658000+00:00",
"name": "Malicious Link",
"description": "An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1204/001",
"external_id": "T1204.001"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_remote_support": false,
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:19:57.658000+00:00\", \"old_value\": \"2026-05-12 15:12:00.723000+00:00\"}}}",
"previous_version": "1.2",
"changelog_mitigations": {
"shared": [
"M1017: User Training",
"M1021: Restrict Web-Based Content",
"M1031: Network Intrusion Prevention"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0066: User Execution \u2013 Malicious Link (click \u2192 suspicious egress \u2192 download/write \u2192 follow-on activity)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--82caa33e-d11a-433a-94ea-9b5a5fbef81d",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-04-17 22:22:24.505000+00:00",
"modified": "2026-09-11 19:27:14.200000+00:00",
"name": "Virtualization/Sandbox Evasion",
"description": "Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)\n\nAdversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)\n\n",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1497",
"external_id": "T1497"
},
{
"source_name": "Unit 42 Pirpi July 2015",
"description": "Falcone, R., Wartell, R.. (2015, July 27). UPS: Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved April 23, 2019.",
"url": "https://unit42.paloaltonetworks.com/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/"
},
{
"source_name": "Deloitte Environment Awareness",
"description": "Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved September 13, 2024.",
"url": "https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc/edit"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Deloitte Threat Library Team",
"Sunny Neo"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:27:14.200000+00:00\", \"old_value\": \"2026-05-12 15:12:00.672000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0046: Detection Strategy for T1497 Virtualization/Sandbox Evasion"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--29be378d-262d-4e99-b00d-852d573628e6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-06 20:57:37.959000+00:00",
"modified": "2026-09-11 19:25:59.519000+00:00",
"name": "System Checks",
"description": "Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)\n\nSpecific checks will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001), [System Information Discovery](https://attack.mitre.org/techniques/T1082), and [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. Adversaries may use scripting to automate these checks into one script and then have the program exit if it determines the system to be a virtual environment. \n\nChecks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. Once executed, malware may also use [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) to check if it was saved in a folder or file with unexpected or even analysis-related naming artifacts such as `malware`, `sample`, or `hash`.\n\nOther common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017) In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output. \n \nHardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices.(Citation: Unit 42 OilRig Sept 2018)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "stealth"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1497/001",
"external_id": "T1497.001"
},
{
"source_name": "Unit 42 OilRig Sept 2018",
"description": "Falcone, R., et al. (2018, September 04). OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September 24, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/"
},
{
"source_name": "McAfee Virtual Jan 2017",
"description": "Roccia, T. (2017, January 19). Stopping Malware With a Fake Virtual Machine. Retrieved April 17, 2019.",
"url": "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/stopping-malware-fake-virtual-machine/"
},
{
"source_name": "Deloitte Environment Awareness",
"description": "Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved September 13, 2024.",
"url": "https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc/edit"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Deloitte Threat Library Team",
"Kostya Vasilkov"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "3.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-11 19:25:59.519000+00:00\", \"old_value\": \"2026-05-12 15:12:00.623000+00:00\"}}}",
"previous_version": "3.0",
"changelog_mitigations": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0168: Virtualization/Sandbox Evasion via System Checks across Windows, Linux, macOS"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--830c9528-df21-472c-8c14-a036bf17d665",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:13.915000+00:00",
"modified": "2026-09-03 19:46:46.483000+00:00",
"name": "Web Service",
"description": "Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.\n\nUse of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1102",
"external_id": "T1102"
},
{
"source_name": "Broadcom BirdyClient Microsoft Graph API 2024",
"description": "Broadcom. (2024, May 2). BirdyClient malware leverages Microsoft Graph API for C&C communication. Retrieved July 1, 2024.",
"url": "https://www.broadcom.com/support/security-center/protection-bulletin/birdyclient-malware-leverages-microsoft-graph-api-for-c-c-communication"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.",
"url": "https://arxiv.org/pdf/1408.1136"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Anastasios Pingios",
"Sarathkumar Rajendran, Microsoft Defender365"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-03 19:46:46.483000+00:00\", \"old_value\": \"2026-05-12 15:12:00.672000+00:00\"}, \"root['external_references'][2]['description']\": {\"new_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.\", \"old_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://arxiv.org/pdf/1408.1136\", \"old_value\": \"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf\"}}}",
"previous_version": "1.3",
"changelog_mitigations": {
"shared": [
"M1021: Restrict Web-Based Content",
"M1031: Network Intrusion Prevention"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0425: Suspicious Use of Web Services for C2"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--be055942-6e63-49d7-9fa1-9cb7d8a8f3f4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-14 22:34:03.024000+00:00",
"modified": "2026-09-03 19:46:40.085000+00:00",
"name": "Bidirectional Communication",
"description": "Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet. \n\nPopular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1102/002",
"external_id": "T1102.002"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.",
"url": "https://arxiv.org/pdf/1408.1136"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"ESXi",
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-03 19:46:40.085000+00:00\", \"old_value\": \"2026-05-12 15:12:00.713000+00:00\"}, \"root['external_references'][1]['description']\": {\"new_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.\", \"old_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://arxiv.org/pdf/1408.1136\", \"old_value\": \"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf\"}}}",
"previous_version": "1.1",
"changelog_mitigations": {
"shared": [
"M1021: Restrict Web-Based Content",
"M1031: Network Intrusion Prevention"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0035: Detect Bidirectional Web Service C2 Channels via Process & Network Correlation"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--9c99724c-a483-4d60-ad9d-7f004e42e8e8",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-14 22:45:52.963000+00:00",
"modified": "2026-09-03 19:46:40.085000+00:00",
"name": "One-Way Communication",
"description": "Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.\n\nPopular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1102/003",
"external_id": "T1102.003"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.",
"url": "https://arxiv.org/pdf/1408.1136"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"ESXi"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-03 19:46:40.085000+00:00\", \"old_value\": \"2025-10-24 17:49:08.849000+00:00\"}, \"root['external_references'][1]['description']\": {\"new_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.\", \"old_value\": \"Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.\"}, \"root['external_references'][1]['url']\": {\"new_value\": \"https://arxiv.org/pdf/1408.1136\", \"old_value\": \"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}}}",
"previous_version": "1.1",
"changelog_mitigations": {
"shared": [
"M1021: Restrict Web-Based Content",
"M1031: Network Intrusion Prevention"
],
"new": [],
"dropped": []
},
"changelog_datacomponent_detections": {
"shared": [],
"new": [],
"dropped": []
},
"changelog_detectionstrategy_detections": {
"shared": [
"DET0581: Detect One-Way Web Service Command Channels"
],
"new": [],
"dropped": []
}
}
],
"revocations": [],
"deprecations": [],
"deletions": []
},
"software": {
"additions": [
{
"type": "malware",
"id": "malware--ab183324-4634-45bc-98af-9458bb94bcef",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-02 20:19:46.450000+00:00",
"modified": "2026-10-09 00:56:40.966000+00:00",
"name": "BACKUPOSINT v9.0 APEX PREDATOR",
"description": "[BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) is a 49-module Python malware developed entirely by Anthropic\u2019s Claude Code as part of the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064) campaign. [BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) leverages publicly available techniques for network enumeration, credential harvesting, Active Directory interrogation, database access, privilege escalation, cloud metadata extraction, and lateral movement (Citation: AI-Mexico-Govt-Compromise). ",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9045",
"external_id": "S9045"
},
{
"source_name": "AI-Mexico-Govt-Compromise",
"description": "Jay Deen. (2026, May). AI-Assisted Compromise of Mexican Water Utility with OT Implications. Retrieved September 2, 2026.",
"url": "https://5943619.hs-sites.com/hubfs/116-Whitepapers/dragos-2026-ai-mexico-water-attack-intel-brief.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"BACKUPOSINT v9.0 APEX PREDATOR"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"Windows",
"IaaS",
"Containers"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--b7c4047f-d56b-43b7-a0c8-65088a70d0cc",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-28 16:01:35.123000+00:00",
"modified": "2026-10-01 21:38:53.171000+00:00",
"name": "CRASHPAD",
"description": "[CRASHPAD](https://attack.mitre.org/software/S9057) is a Windows executable written in C++ that gathers data from web browsers.(Citation: Mandiant_UNC1549_Nov2025) [CRASHPAD](https://attack.mitre.org/software/S9057) \u202fwas\u202ffirst\u202fobserved in 2025 and has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: Mandiant_UNC1549_Nov2025) ",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9057",
"external_id": "S9057"
},
{
"source_name": "Mandiant_UNC1549_Nov2025",
"description": "El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"CRASHPAD"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--e6de8db2-092a-476c-a683-ad6e042a3265",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-10-01 21:18:08.255000+00:00",
"modified": "2026-10-02 12:11:29.664000+00:00",
"name": "DCSYNCER.SLICK",
"description": "[DCSYNCER.SLICK](https://attack.mitre.org/software/S9065) is a Windows executable that is designed to gather credentials from victim devices.(Citation: Mandiant_UNC1549_Nov2025) [DCSYNCER.SLICK](https://attack.mitre.org/software/S9065) was first observed in 2025 and has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: Mandiant_UNC1549_Nov2025)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9065",
"external_id": "S9065"
},
{
"source_name": "Mandiant_UNC1549_Nov2025",
"description": "El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"DCSYNCER.SLICK"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--8460166d-ba74-405b-9944-c6f0365bc085",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-10-01 18:01:41.908000+00:00",
"modified": "2026-10-01 21:33:55.245000+00:00",
"name": "DEEPROOT",
"description": "[DEEPROOT](https://attack.mitre.org/software/S9063) is a Linux backdoor written in Golang.(Citation: Mandiant_UNC1549_Nov2025) [DEEPROOT](https://attack.mitre.org/software/S9063) is able to execute commands via a shell, enumerate systems, delete or download files, and exfiltrate data.(Citation: Mandiant_UNC1549_Nov2025) [DEEPROOT](https://attack.mitre.org/software/S9063) was first observed in 2025.(Citation: Mandiant_UNC1549_Nov2025) [DEEPROOT](https://attack.mitre.org/software/S9063) has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: Mandiant_UNC1549_Nov2025)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9063",
"external_id": "S9063"
},
{
"source_name": "Mandiant_UNC1549_Nov2025",
"description": "El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"DEEPROOT"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--bcd0f2cd-0b21-4109-8310-8a90be320514",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-02 20:33:19.300000+00:00",
"modified": "2026-10-12 16:09:31.637000+00:00",
"name": "IOControl",
"description": "IOControl is a malware that targeted Linux ARM-based IoT/OT devices including Hikvision IP cameras, D-Link firewalls and routers, Unitronics PLCs and HMIs, Orpak and Gasboy fuel management systems, and Baicells LTE controllers across the United States and Israel. The malware has been attributed to [CyberAv3ngers](https://attack.mitre.org/groups/G1027) which is suspected to be affiliated with the Iranian Government Islamic Revolutionary Guard Corps (IRGC).(Citation: Claroty-IOCONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9046",
"external_id": "S9046"
},
{
"source_name": "Claroty-IOCONTROL",
"description": "Claroty Team82. (2024, December 10). Inside a New OT/IoT Cyberweapon: IOCONTROL. Retrieved September 2, 2026.",
"url": "https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"
},
{
"source_name": "Dragos 2025 Year in Review",
"description": "Dragos. (2026, February). 9TH ANNUAL YEAR IN REVIEW | OT/ICS CYBERSECURITY REPORT . Retrieved April 26, 2026.",
"url": "https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf?hsCtaAttrib=205683189348"
},
{
"source_name": "Armis-IOCONTROL",
"description": "Michael Freeman. (2024, December 16). IOControl Malware: What's New, What's Not?. Retrieved September 2, 2026.",
"url": "https://www.armis.com/blog/iocontrol-malware-whats-new-whats-not/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"IOControl"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack",
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--0bbfc4cf-818d-4ef0-97e0-15b423c85b08",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-30 16:19:28.930000+00:00",
"modified": "2026-10-01 21:28:13.399000+00:00",
"name": "LIGHTRAIL",
"description": "[LIGHTRAIL](https://attack.mitre.org/software/S9061) is a tunneler malware.(Citation: Mandiant_UNC1549_Feb2024) [LIGHTRAIL](https://attack.mitre.org/software/S9061) has been known to communicate with C2 SOCKS4A Websocket communications.(Citation: Mandiant_UNC1549_Feb2024) [LIGHTRAIL](https://attack.mitre.org/software/S9061) was\u202ffirst\u202fobserved in 2022. [LIGHTRAIL](https://attack.mitre.org/software/S9061) has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: Mandiant_UNC1549_Feb2024)(Citation: Mandiant_UNC1549TTPsTools_Nov2025) ",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9061",
"external_id": "S9061"
},
{
"source_name": "Mandiant_UNC1549TTPsTools_Nov2025",
"description": "El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
},
{
"source_name": "Mandiant_UNC1549_Feb2024",
"description": "Rozmann, O., et al. (2024, February 27). When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors. Retrieved September 28, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"LIGHTRAIL"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--1cf09c8f-32e1-404c-bb1e-4ac9ee7c5191",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-28 18:35:48.220000+00:00",
"modified": "2026-10-01 21:23:13.768000+00:00",
"name": "MiniBike",
"description": "[MiniBike](https://attack.mitre.org/software/S9059) is a custom backdoor written in C++ designed for command execution, data discovery, gathering, and exfiltration.(Citation: Mandiant_UNC1549_Feb2024) [MiniBike](https://attack.mitre.org/software/S9059) has been known to communicate with the C2 using Azure Cloud Infrastructure. [MiniBike](https://attack.mitre.org/software/S9059)\u202fwas\u202ffirst\u202fobserved in 2022.(Citation: Mandiant_UNC1549_Feb2024) [MiniBike](https://attack.mitre.org/software/S9059) has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: Mandiant_UNC1549_Feb2024) ",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9059",
"external_id": "S9059"
},
{
"source_name": "Mandiant_UNC1549_Feb2024",
"description": "Rozmann, O., et al. (2024, February 27). When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors. Retrieved September 28, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"MiniBike"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--8c8b765a-fba0-4551-ae83-b12e2a8b8937",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-10-01 12:59:07.184000+00:00",
"modified": "2026-10-01 20:13:07.752000+00:00",
"name": "MiniBrowse",
"description": "[MiniBrowse](https://attack.mitre.org/software/S9062) is a custom stealer designed for the theft of credentials in browsers and passwords stores. [MiniBrowse](https://attack.mitre.org/software/S9062) was first observed in late-2025.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) [MiniBrowse](https://attack.mitre.org/software/S9062) has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9062",
"external_id": "S9062"
},
{
"source_name": "CheckPoint_NimbusManticoreEurope_Sept2025",
"description": "Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.",
"url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"MiniBrowse"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--8b325e28-6ea1-4094-929b-966d5db4ee4c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-28 21:33:08.238000+00:00",
"modified": "2026-10-01 21:15:12.857000+00:00",
"name": "MiniBus",
"description": "[MiniBus](https://attack.mitre.org/software/S9060) is a custom backdoor used for command execution, data discovery, gathering, and exfiltration. [MiniBus](https://attack.mitre.org/software/S9060) has utilized Azure Cloud Infrastructure and unique adversary-controlled domains for command and control. [MiniBus](https://attack.mitre.org/software/S9060) is an updated platform to its predecessor [MiniBike](https://attack.mitre.org/software/S9059) and was\u202ffirst\u202fobserved in August 2023. [MiniBus](https://attack.mitre.org/software/S9060) has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: Mandiant_UNC1549_Feb2024) ",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9060",
"external_id": "S9060"
},
{
"source_name": "Mandiant_UNC1549_Feb2024",
"description": "Rozmann, O., et al. (2024, February 27). When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors. Retrieved September 28, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"MiniBus"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--363bc9c0-6e9b-4815-a072-1a92d0ad7502",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-24 18:08:39.049000+00:00",
"modified": "2026-10-01 20:46:23.748000+00:00",
"name": "MiniFast",
"description": "[MiniFast](https://attack.mitre.org/software/S9052) is a custom malware designed for long-term persistence and remote code execution. [MiniFast](https://attack.mitre.org/software/S9052) is a modular malware suspected of being generated using artificial intelligence (AI). [MiniFast](https://attack.mitre.org/software/S9052) was\u202ffirst\u202fobserved in early-2026 and is a modified version of the [MiniJunk](https://attack.mitre.org/software/S9053) framework. [MiniFast](https://attack.mitre.org/software/S9052) has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: CheckPoint_NimbusManticore_May2026) ",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9052",
"external_id": "S9052"
},
{
"source_name": "CheckPoint_NimbusManticore_May2026",
"description": "Check Point. (2026, May 22). Fast and Furious \u2013 Nimbus Manticore Operations During the Iranian Conflict. Retrieved September 23, 2026.",
"url": "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"MiniFast"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--7eaf437c-cde7-475b-87dd-d8573ca5406b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-24 19:00:14.300000+00:00",
"modified": "2026-10-01 20:58:58.010000+00:00",
"name": "MiniJunk",
"description": "[MiniJunk](https://attack.mitre.org/software/S9053) is a custom malware designed for long-term persistence and remote code execution.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) [MiniJunk](https://attack.mitre.org/software/S9053) \u202fwas\u202ffirst\u202fobserved in 2025 and is a modified version of the [MiniBike](https://attack.mitre.org/software/S9059) framework that was first observed in June 2022.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) [MiniJunk](https://attack.mitre.org/software/S9053) has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9053",
"external_id": "S9053"
},
{
"source_name": "CheckPoint_NimbusManticoreEurope_Sept2025",
"description": "Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.",
"url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"MiniJunk"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--fa6cfe4c-e83b-4e19-b687-bd26e2b656e5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-10-01 21:28:47.232000+00:00",
"modified": "2026-10-01 21:29:24.896000+00:00",
"name": "POLLBLEND",
"description": "[POLLBLEND](https://attack.mitre.org/software/S9066) is a Windows tunneler written C++ that has utilized hardcoded C2 servers and leveraged hardcoded URI parameters for follow-on actions.(Citation: Mandiant_UNC1549_Nov2025) [POLLBLEND](https://attack.mitre.org/software/S9066) was first observed in 2025 and has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: Mandiant_UNC1549_Nov2025)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9066",
"external_id": "S9066"
},
{
"source_name": "Mandiant_UNC1549_Nov2025",
"description": "El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"POLLBLEND"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--53450019-1b2f-4912-bb3a-004bb1d7f177",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-28 16:25:08.301000+00:00",
"modified": "2026-10-01 22:15:12.580000+00:00",
"name": "SIGHTGRAB",
"description": "[SIGHTGRAB](https://attack.mitre.org/software/S9058) is a Windows executable written in C that captures and stages stolen data on victim devices.(Citation: Mandiant_UNC1549_Nov2025) [SIGHTGRAB](https://attack.mitre.org/software/S9058)\u202fwas\u202ffirst\u202fobserved in 2025 and has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: Mandiant_UNC1549_Nov2025) ",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9058",
"external_id": "S9058"
},
{
"source_name": "Mandiant_UNC1549_Nov2025",
"description": "El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"SIGHTGRAB"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--e60b857a-afe6-4f3a-b308-664d51768610",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-10-01 20:58:43.749000+00:00",
"modified": "2026-10-01 21:36:37.212000+00:00",
"name": "TRUSTTRAP",
"description": "[TRUSTTRAP](https://attack.mitre.org/software/S9064) is a malware that uses a fictitious prompt to trick users to submit their credentials.(Citation: Mandiant_UNC1549_Nov2025) [TRUSTTRAP](https://attack.mitre.org/software/S9064) was first observed in 2023 and has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: Mandiant_UNC1549_Nov2025)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9064",
"external_id": "S9064"
},
{
"source_name": "Mandiant_UNC1549_Nov2025",
"description": "El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"TRUSTTRAP"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--86adfd9a-6092-4714-9c5a-a05c5e3f63b5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-10-01 21:41:24.357000+00:00",
"modified": "2026-10-01 21:42:36.830000+00:00",
"name": "TWOSTROKE",
"description": "[TWOSTROKE](https://attack.mitre.org/software/S9067) is malicious backdoor written in C++ that is capable of discovery actions, executing payloads and exfiltrating data.(Citation: Mandiant_UNC1549_Nov2025) [TWOSTROKE](https://attack.mitre.org/software/S9067) was first observed in 2025 and has been affiliated with the cyber espionage threat group [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059).(Citation: Mandiant_UNC1549_Nov2025)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9067",
"external_id": "S9067"
},
{
"source_name": "Mandiant_UNC1549_Nov2025",
"description": "El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"TWOSTROKE"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--73526d60-8813-4895-88ac-915c68dfe8dd",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-22 22:53:37.482000+00:00",
"modified": "2026-09-30 20:43:14.935000+00:00",
"name": "The Gentlemen Ransomware",
"description": "[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) is a ransomware-as-a-service (RaaS). [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has been written in Go programming language and has utilized Garble to obfuscate its code to target Windows environments. [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) is capable of executing its\u2019 OS lockers in Windows, Linux, NAS, BSD and ESXi environments. [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051)\u202fwas\u202ffirst\u202fobserved in mid-2025 as a closed ransomware and shortly later emerged as a RaaS to affiliates in September 2025. [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has been affiliated with the threat group [The Gentlemen](https://attack.mitre.org/groups/G1058).(Citation: MSTI_GentelmenRansomware_May2026)(Citation: TrendAI_TheGentlemen_Sept2025)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)(Citation: CheckPointResearch_TheGentlemen_April2026)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9051",
"external_id": "S9051"
},
{
"source_name": "CarveyODonnellWelchHuntress_TheGentlemen_May2026",
"description": "Carvey, H., O'Donnell-Welch, L. (2026, May 21). The Gentlemen (Ransomware) in Disguise: Defense Evasion and other TTPs. Retrieved September 18, 2026.",
"url": "https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps"
},
{
"source_name": "CheckPointResearch_TheGentlemen_April2026",
"description": "Check Point Research. (2026, April 20). DFIR Report \u2013 The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy. Retrieved September 18, 2026.",
"url": "https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"
},
{
"source_name": "MSTI_GentelmenRansomware_May2026",
"description": "Microsoft Threat Intelligence. (2026, May 28). The Gentlemen ransomware: Dissecting a self-propagating Go encryptor . Retrieved September 18, 2026.",
"url": "https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"
},
{
"source_name": "TrendAI_TheGentlemen_Sept2025",
"description": "Santos, J., et al. (2025, September 9). Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed . Retrieved September 18, 2026.",
"url": "https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"The Gentlemen Ransomware"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"macOS",
"Linux",
"Windows",
"IaaS",
"ESXi",
"Network Devices"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--947119be-4875-49aa-8247-776c34233063",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-11 19:05:30.171000+00:00",
"modified": "2026-09-23 18:54:28.219000+00:00",
"name": "Vidar",
"description": "[Vidar](https://attack.mitre.org/software/S9050) is a Windows infostealer that was first advertised in November 2018. Written in C++, [Vidar](https://attack.mitre.org/software/S9050) collects PII, cryptocurrency wallets, documents and other data within the compromised machine. Version 2 of [Vidar](https://attack.mitre.org/software/S9050) was published in October 2025, and has been used in numerous operations since its release. [Vidar](https://attack.mitre.org/software/S9050) has been observed alongside other malware strains, including STOP/Djvu ransomware, Mina.exe (an XMRIG miner), and Clip1.exe (a Laplas Clipper sample).(Citation: Intrinsec_Vidar_April2026)(Citation: LevelBlue_Vidar_May2026)(Citation: CyberAus_Vidar_May2026)(Citation: Unit42_Vidar_July2026)(Citation: Cyfirma_Vidar_June2024)(Citation: Logpoint_StealerMalwareFamilies_2024)(Citation: CISA Scattered Spider Advisory November 2023)(Citation: QuorumCyber_Vidar_March2023)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S9050",
"external_id": "S9050"
},
{
"source_name": "CyberAus_Vidar_May2026",
"description": "Australian Signals Directorate\u2019s Australian Cyber Security Centre. (2026, May 7). ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure. Retrieved May 8, 2026.",
"url": "https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/clickfix-distributing-vidar-stealer-via-wordpress-targeting-australian-infrastructure"
},
{
"source_name": "CISA Scattered Spider Advisory November 2023",
"description": "CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"
},
{
"source_name": "Cyfirma_Vidar_June2024",
"description": "CYFIRMA. (2024, June 3). Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware. Retrieved August 13, 2026.",
"url": "https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"
},
{
"source_name": "Intrinsec_Vidar_April2026",
"description": "Intrinsec. (2026, April). \"Chaos is a ladder\": Vidar's recent rise to the top. Retrieved April 27, 2026.",
"url": "https://www.intrinsec.com/wp-content/uploads/2026/04/TLP_CLEAR-20260424-New_Vidar.pdf"
},
{
"source_name": "LevelBlue_Vidar_May2026",
"description": "Joshi, M. (2026, May 7). Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication. Retrieved May 8, 2026.",
"url": "https://www.levelblue.com/blogs/spiderlabs-blog/unmasking-a-multi-stage-loader-autoit-abuse-leading-to-vidar-stealer-command-and-control-communication"
},
{
"source_name": "Logpoint_StealerMalwareFamilies_2024",
"description": "Khadgi, N. (n.d.). A Comprehensive Overview on Stealer Malware Families. Retrieved August 25, 2026.",
"url": "https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"
},
{
"source_name": "Unit42_Vidar_July2026",
"description": "Nannaka, B., Chhaparwal, P. (2026, July 7). Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation. Retrieved July 8, 2026.",
"url": "https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/"
},
{
"source_name": "QuorumCyber_Vidar_March2023",
"description": "Quorum Cyber. (n.d.). Malware Analysis Report Vidar - Stealerware. Retrieved August 28, 2026.",
"url": "https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Vidar"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Jeremy Ang"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
}
],
"major_version_changes": [
{
"type": "malware",
"id": "malware--20945359-3b39-4542-85ef-08ecb4e1c174",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-07-20 17:41:19.690000+00:00",
"modified": "2026-09-03 14:50:23.272000+00:00",
"name": "StrongPity",
"description": "[StrongPity](https://attack.mitre.org/software/S0491) is an information stealing malware used by [PROMETHIUM](https://attack.mitre.org/groups/G0056).(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0491",
"external_id": "S0491"
},
{
"source_name": "Talos Promethium June 2020",
"description": "Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.",
"url": "https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"
},
{
"source_name": "Bitdefender StrongPity June 2020",
"description": "Tudorica, R. et al. (2020, June 30). StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure. Retrieved July 20, 2020.",
"url": "https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"StrongPity"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"mobile-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Android"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-09-03 14:50:23.272000+00:00\", \"old_value\": \"2024-04-10 23:47:16.416000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.3.0\", \"old_value\": \"3.2.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.0\", \"old_value\": \"1.1\"}}, \"iterable_item_added\": {\"root['x_mitre_domains'][1]\": \"mobile-attack\", \"root['x_mitre_platforms'][1]\": \"Android\"}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 2.0"
}
],
"minor_version_changes": [],
"other_version_changes": [],
"patches": [],
"revocations": [],
"deprecations": [],
"deletions": []
},
"groups": {
"additions": [
{
"type": "intrusion-set",
"id": "intrusion-set--318cf2c8-160b-4de7-be51-ecc3ded2705f",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-10-01 14:35:26.754000+00:00",
"modified": "2026-10-05 14:45:56.927000+00:00",
"name": "NIMBUS MANTICORE",
"description": "[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059)\u202fis a State Sponsored cyber espionage group associated with the Iranian Regime specifically the Iranian Revolutionary Guard Corps (IRGC). [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has employed social engineering attacks to include HR related themes and has leveraged custom malware against its victims. [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has sought sensitive information in victims\u2019 environments to include network/IT documentation, intellectual property and emails. [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has also leveraged compromised organizations as pivot points to access other organizations of interest. [NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has been active since 2021 and has targeted critical infrastructure organizations to include aviation, aerospace, telecommunications and defense and information technology related organizations within the United States, Australia, Midde East and Europe.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)(Citation: CheckPoint_NimbusManticore_May2026)(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)(Citation: Mandiant_UNC1549_Feb2024)",
"aliases": [
"NIMBUS MANTICORE",
"UNC1549",
"TA455",
"COBALT SMOKEY"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1059",
"external_id": "G1059"
},
{
"source_name": "UNC1549",
"description": "(Citation: Mandiant_UNC1549TTPsTools_Nov2025)(Citation: Mandiant_UNC1549_Feb2024) "
},
{
"source_name": "TA455",
"description": "(Citation: Proofpoint NIMBUS MANTICORE TA455 TA453 TA450 November 2025)"
},
{
"source_name": "COBALT SMOKEY",
"description": "(Citation: Sophos Iran Cobalt Smokey Nimbus Manticore October 2026)"
},
{
"source_name": "CheckPoint_NimbusManticoreEurope_Sept2025",
"description": "Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.",
"url": "https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"
},
{
"source_name": "CheckPoint_NimbusManticore_May2026",
"description": "Check Point. (2026, May 22). Fast and Furious \u2013 Nimbus Manticore Operations During the Iranian Conflict. Retrieved September 23, 2026.",
"url": "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"
},
{
"source_name": "Mandiant_UNC1549TTPsTools_Nov2025",
"description": "El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
},
{
"source_name": "Mandiant_UNC1549_Feb2024",
"description": "Rozmann, O., et al. (2024, February 27). When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors. Retrieved September 28, 2026.",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"
},
{
"source_name": "Proofpoint NIMBUS MANTICORE TA455 TA453 TA450 November 2025",
"description": "Saher Naumaan and The Proofpoint Threat Research Team. (2025, November 5). Crossed wires: a case study of Iranian espionage and attribution. Retrieved October 5, 2026.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution"
},
{
"source_name": "Sophos Iran Cobalt Smokey Nimbus Manticore October 2026",
"description": "Sophos. (2026, October 5). Iran COBALT SMOKEY. Retrieved October 5, 2026.",
"url": "https://www.sophos.com/en-us/threat-profiles/cobalt-smokey"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0"
},
{
"type": "intrusion-set",
"id": "intrusion-set--973abd91-322f-4756-94b6-67381c4089b3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-18 19:02:39.017000+00:00",
"modified": "2026-09-30 17:41:50.958000+00:00",
"name": "The Gentlemen",
"description": "[The Gentlemen](https://attack.mitre.org/groups/G1058) is a group that maintains the [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051)-as-a-service (RaaS). [The Gentlemen](https://attack.mitre.org/groups/G1058) was\u202ffirst\u202fobserved in mid-2025 who had posed [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. [The Gentlemen](https://attack.mitre.org/groups/G1058) has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.(Citation: MSTI_GentelmenRansomware_May2026)(Citation: Intel471_TheGentlemen_Aug2026)(Citation: Sophos_TheGentlemen_Sept2026)(Citation: Sou\u010dekESET_Gentlemen_Jun2026)(Citation: CheckPointResearch_TheGentlemen_April2026)(Citation: BradyUnit42_TheGentlemen_July2026)(Citation: CarveyODonnellWelchHuntress_TheGentlemen_May2026)(Citation: TrendAI_TheGentlemen_Sept2025) ",
"aliases": [
"The Gentlemen",
"Storm-2697",
"GOLD SHERWOOD"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G1058",
"external_id": "G1058"
},
{
"source_name": "Storm-2697",
"description": "(Citation: MSTI_GentelmenRansomware_May2026)"
},
{
"source_name": "GOLD SHERWOOD",
"description": "(Citation: Sophos_TheGentlemen_Sept2026)"
},
{
"source_name": "BradyUnit42_TheGentlemen_July2026",
"description": "Brady, M. (2026, July 10). No Manners Here: The Ruthless Rise of The Gentlemen Ransomware. Retrieved September 18, 2026.",
"url": "https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/"
},
{
"source_name": "CarveyODonnellWelchHuntress_TheGentlemen_May2026",
"description": "Carvey, H., O'Donnell-Welch, L. (2026, May 21). The Gentlemen (Ransomware) in Disguise: Defense Evasion and other TTPs. Retrieved September 18, 2026.",
"url": "https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps"
},
{
"source_name": "CheckPointResearch_TheGentlemen_April2026",
"description": "Check Point Research. (2026, April 20). DFIR Report \u2013 The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy. Retrieved September 18, 2026.",
"url": "https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"
},
{
"source_name": "Intel471_TheGentlemen_Aug2026",
"description": "Intel 471. (2026, August 11). Threat Hunting Case Study: The Gentlemen. Retrieved September 18, 2026.",
"url": "https://www.intel471.com/blog/threat-hunting-case-study-the-gentlemen"
},
{
"source_name": "MSTI_GentelmenRansomware_May2026",
"description": "Microsoft Threat Intelligence. (2026, May 28). The Gentlemen ransomware: Dissecting a self-propagating Go encryptor . Retrieved September 18, 2026.",
"url": "https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"
},
{
"source_name": "TrendAI_TheGentlemen_Sept2025",
"description": "Santos, J., et al. (2025, September 9). Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed . Retrieved September 18, 2026.",
"url": "https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"
},
{
"source_name": "Sophos_TheGentlemen_Sept2026",
"description": "Sophos Counter Threat Unit Research Team. (2026, September 1). Ungentlemanly behavior: Insights into a ransomware operation. Retrieved September 18, 2026.",
"url": "https://www.sophos.com/en-gb/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation"
},
{
"source_name": "Sou\u010dekESET_Gentlemen_Jun2026",
"description": "Sou\u010dek, J. (2026, June 18). Killing me gently: Inside Gentlemen\u2019s EDR killer framework. Retrieved September 18, 2026.",
"url": "https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0"
}
],
"major_version_changes": [
{
"type": "intrusion-set",
"id": "intrusion-set--00f67a77-86a4-4adf-be26-1a54fc713340",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-01-29 21:27:24.793000+00:00",
"modified": "2026-10-09 03:56:03.463000+00:00",
"name": "APT38",
"description": "[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018), along with software supply chain compromises and destructive malware attacks.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)(Citation: Microsoft Axios Compromise APR 2026)(Citation: Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastra npm Compromise JUN 2026)\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.",
"aliases": [
"APT38",
"NICKEL GLADSTONE",
"BeagleBoyz",
"Bluenoroff",
"Stardust Chollima",
"Sapphire Sleet",
"COPERNICIUM"
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/groups/G0082",
"external_id": "G0082"
},
{
"source_name": "BeagleBoyz",
"description": "(Citation: CISA AA20-239A BeagleBoyz August 2020)"
},
{
"source_name": "Stardust Chollima",
"description": "(Citation: CrowdStrike Stardust Chollima Profile April 2018)(Citation: CrowdStrike GTR 2021 June 2021)"
},
{
"source_name": "APT38",
"description": "(Citation: FireEye APT38 Oct 2018)"
},
{
"source_name": "Bluenoroff",
"description": "(Citation: Kaspersky Lazarus Under The Hood Blog 2017)"
},
{
"source_name": "Sapphire Sleet",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "COPERNICIUM",
"description": "(Citation: Microsoft Threat Actor Naming July 2023)"
},
{
"source_name": "NICKEL GLADSTONE",
"description": "(Citation: SecureWorks NICKEL GLADSTONE profile Sept 2021)"
},
{
"source_name": "CrowdStrike GTR 2021 June 2021",
"description": "CrowdStrike. (2021, June 7). CrowdStrike 2021 Global Threat Report. Retrieved September 29, 2021.",
"url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf"
},
{
"source_name": "DOJ North Korea Indictment Feb 2021",
"description": "Department of Justice. (2021, February 17). Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe. Retrieved June 9, 2021.",
"url": "https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and"
},
{
"source_name": "CISA AA20-239A BeagleBoyz August 2020",
"description": "DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.",
"url": "https://us-cert.cisa.gov/ncas/alerts/aa20-239a"
},
{
"source_name": "FireEye APT38 Oct 2018",
"description": "FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.",
"url": "https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"
},
{
"source_name": "Kaspersky Lazarus Under The Hood Blog 2017",
"description": "GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved April 17, 2019.",
"url": "https://securelist.com/lazarus-under-the-hood/77908/"
},
{
"source_name": "CrowdStrike Stardust Chollima Profile April 2018",
"description": "Meyers, Adam. (2018, April 6). Meet CrowdStrike\u2019s Adversary of the Month for April: STARDUST CHOLLIMA. Retrieved September 29, 2021.",
"url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-april-stardust-chollima/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"description": "Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Axios Compromise APR 2026",
"description": "Microsoft Threat Intelligence. (2026, April 1). Mitigating the Axios npm supply chain compromise. Retrieved September 30, 2026.",
"url": "https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"
},
{
"source_name": "Microsoft Sapphire Sleet APR 2026",
"description": "Microsoft Threat Intelligence. (2026, April 16). Dissecting Sapphire Sleet\u2019s macOS intrusion from lure to compromise. Retrieved September 30, 2026.",
"url": "https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"
},
{
"source_name": "MIcrosoft Mastra npm Compromise JUN 2026",
"description": "Microsoft Threat Intelligence. (2026, June 17). From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet. Retrieved September 30, 2026.",
"url": "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"
},
{
"source_name": "SecureWorks NICKEL GLADSTONE profile Sept 2021",
"description": "SecureWorks. (2021, September 29). NICKEL GLADSTONE Threat Profile. Retrieved September 29, 2021.",
"url": "https://www.secureworks.com/research/threat-profiles/nickel-gladstone"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_contributors": [
"Hiroki Nagahama, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India",
"Pooja Natarajan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "4.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-10-09 03:56:03.463000+00:00\", \"old_value\": \"2026-07-31 20:48:22.752000+00:00\"}, \"root['description']\": {\"new_value\": \"[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018), along with software supply chain compromises and destructive malware attacks.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)(Citation: Microsoft Axios Compromise APR 2026)(Citation: Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastra npm Compromise JUN 2026)\\n\\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.\", \"old_value\": \"[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which [APT38](https://attack.mitre.org/groups/G0082) stole $81 million, as well as attacks against Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018); some of their attacks have been destructive.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)\\n\\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which [APT38](https://attack.mitre.org/groups/G0082) stole $81 million, as well as attacks against Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018); some of their attacks have been destructive.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)\\n+[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018), along with software supply chain compromises and destructive malware attacks.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)(Citation: Microsoft Axios Compromise APR 2026)(Citation: Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastra npm Compromise JUN 2026)\\n \\n North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.\"}, \"root['x_mitre_version']\": {\"new_value\": \"4.0\", \"old_value\": \"3.1\"}}, \"iterable_item_added\": {\"root['external_references'][15]\": {\"source_name\": \"Microsoft Axios Compromise APR 2026\", \"description\": \"Microsoft Threat Intelligence. (2026, April 1). Mitigating the Axios npm supply chain compromise. Retrieved September 30, 2026.\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/\"}, \"root['external_references'][16]\": {\"source_name\": \"Microsoft Sapphire Sleet APR 2026\", \"description\": \"Microsoft Threat Intelligence. (2026, April 16). Dissecting Sapphire Sleet\\u2019s macOS intrusion from lure to compromise. Retrieved September 30, 2026.\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/\"}, \"root['external_references'][17]\": {\"source_name\": \"MIcrosoft Mastra npm Compromise JUN 2026\", \"description\": \"Microsoft Threat Intelligence. (2026, June 17). From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet. Retrieved September 30, 2026.\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/\"}}}",
"previous_version": "3.1",
"version_change": "3.1 \u2192 4.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [APT38](https://attack.mitre.org/groups/G0082) is a North Ko | t | 1 | [APT38](https://attack.mitre.org/groups/G0082) is a North Ko |
| > | rean state-sponsored threat group that specializes in financ | > | rean state-sponsored threat group that specializes in financ | ||
| > | ial cyber operations; it has been attributed to the Reconnai | > | ial cyber operations; it has been attributed to the Reconnai | ||
| > | ssance General Bureau.(Citation: CISA AA20-239A BeagleBoyz A | > | ssance General Bureau.(Citation: CISA AA20-239A BeagleBoyz A | ||
| > | ugust 2020) Active since at least 2014, [APT38](https://atta | > | ugust 2020) Active since at least 2014, [APT38](https://atta | ||
| > | ck.mitre.org/groups/G0082) has targeted banks, financial ins | > | ck.mitre.org/groups/G0082) has targeted banks, financial ins | ||
| > | titutions, casinos, cryptocurrency exchanges, SWIFT system e | > | titutions, casinos, cryptocurrency exchanges, SWIFT system e | ||
| > | ndpoints, and ATMs in at least 38 countries worldwide. Signi | > | ndpoints, and ATMs in at least 38 countries worldwide. Signi | ||
| > | ficant operations include the 2016 Bank of Bangladesh heist, | > | ficant operations include the 2016 Bank of Bangladesh heist, | ||
| > | during which [APT38](https://attack.mitre.org/groups/G0082) | > | Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de C | ||
| > | stole $81 million, as well as attacks against Bancomext (Ci | > | hile (Citation: FireEye APT38 Oct 2018), along with software | ||
| > | tation: FireEye APT38 Oct 2018) and Banco de Chile (Citation | > | supply chain compromises and destructive malware attacks.(C | ||
| > | : FireEye APT38 Oct 2018); some of their attacks have been d | > | itation: CISA AA20-239A BeagleBoyz August 2020)(Citation: Fi | ||
| > | estructive.(Citation: CISA AA20-239A BeagleBoyz August 2020) | > | reEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment F | ||
| > | (Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea | > | eb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 201 | ||
| > | Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The | > | 7)(Citation: Microsoft Axios Compromise APR 2026)(Citation: | ||
| > | Hood Blog 2017) North Korean group definitions are known to | > | Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastr | ||
| > | have significant overlap, and some security researchers rep | > | a npm Compromise JUN 2026) North Korean group definitions a | ||
| > | ort all North Korean state-sponsored cyber activity under th | > | re known to have significant overlap, and some security rese | ||
| > | e name [Lazarus Group](https://attack.mitre.org/groups/G0032 | > | archers report all North Korean state-sponsored cyber activi | ||
| > | ) instead of tracking clusters or subgroups. | > | ty under the name [Lazarus Group](https://attack.mitre.org/g | ||
| > | roups/G0032) instead of tracking clusters or subgroups. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Salt Typhoon](https://attack.mitre.org/groups/G1045) is a P | t | 1 | [Salt Typhoon](https://attack.mitre.org/groups/G1045) is a P |
| > | eople's Republic of China (PRC) state-backed actor that has | > | eople's Republic of China (PRC) state-backed actor that has | ||
| > | been active since at least 2019 and responsible for numerous | > | been active since at least 2019 and responsible for numerous | ||
| > | compromises of network infrastructure at major U.S. telecom | > | compromises of network infrastructure at major U.S. telecom | ||
| > | munication and internet service providers (ISP).(Citation: U | > | munication and internet service providers (ISP). [Salt Typho | ||
| > | S Dept. of Treasury Salt Typhoon JAN 2025)(Citation: Cisco S | > | on](https://attack.mitre.org/groups/G1045) has targeted and | ||
| > | alt Typhoon FEB 2025) | > | leveraged public facing network edge devices to gain access | ||
| > | to victim environments. [Salt Typhoon](https://attack.mitre. | ||||
| > | org/groups/G1045) has been publicly associated with activiti | ||||
| > | es resembling other security industry reported activity grou | ||||
| > | ps to include OPERATOR PANDA, RedMike, GhostEmperor, and UNC | ||||
| > | 5807.(Citation: US Dept. of Treasury Salt Typhoon JAN 2025)( | ||||
| > | Citation: Cisco Salt Typhoon FEB 2025)(Citation: CISA_AA25-2 | ||||
| > | 39ASaltTyphoon_Sept2025)(Citation: CarySentinelLabs_CiscoSal | ||||
| > | tTyphoon_Dec2025)(Citation: CrowdStrike_OperatorPanda_NoDate | ||||
| > | )(Citation: RF_SaltTyphoon_Feb2025)(Citation: Microsoft_Thre | ||||
| > | atActorNaming_NoDate)(Citation: Mandiant_M-Trends2026_Mar202 | ||||
| > | 6) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Deletion or disablement of user accounts in platforms like O | t | 1 | Deletion or disablement of user accounts in SaaS platforms s |
| > | kta, Salesforce, or Zoom with anomalies in admin session att | > | uch as Okta, Salesforce, or Zoom, correlated with anomalous | ||
| > | ributes or mass actions within short duration. | > | administrative session attributes or multiple account-remova | ||
| > | l actions within a short duration. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Malicious applications are a common attack vector used by ad | t | 1 | Adversaries may direct victims to download malicious applica |
| > | versaries to gain a presence on mobile devices. This techniq | > | tions via ways that avoid an authorized application store (e | ||
| > | ue describes installing a malicious application on targeted | > | .g. Google Play Store or Apple App Store). For example, vict | ||
| > | mobile devices without involving an authorized app store (e. | > | ims may be directed to downloading a malicious APK directly | ||
| > | g., Google Play Store or Apple App Store). Adversaries may w | > | from a domain. Adversaries may wish to avoid placing malici | ||
| > | ish to avoid placing malicious applications in an authorized | > | ous applications in an authorized application store due to i | ||
| > | app store due to increased potential risk of detection or o | > | ncreased potential risk of detection or other reasons. Deli | ||
| > | ther reasons. However, mobile devices often are configured t | > | very methods for malicious applications include: * Spearphi | ||
| > | o allow application installation only from an authorized app | > | shing Attachment: including the mobile application package a | ||
| > | store which would prevent this technique from working. Del | > | s an attachment to an email * Spearphishing Link: including | ||
| > | ivery methods for the malicious application include: * [Spe | > | a link to the mobile application package within an email, te | ||
| > | arphishing Attachment](https://attack.mitre.org/techniques/T | > | xt message (e.g. SMS, iMessage, WhatsApp, etc.), web site, Q | ||
| > | 1566/001) - Including the mobile app package as an attachmen | > | R code, or other means. * Third-Party Application Store: ins | ||
| > | t to an email message. * [Spearphishing Link](https://attack | > | talling the mobile application package from a third-party ap | ||
| > | .mitre.org/techniques/T1566/002) - Including a link to the m | > | plication store, as opposed to an authorized app store that | ||
| > | obile app package within an email, text message (e.g. SMS, i | > | the device implicitly trusts as part of its default behavior | ||
| > | Message, Hangouts, WhatsApp, etc.), web site, QR code, or ot | > | . Third-party application stores may not apply the same leve | ||
| > | her means. * Third-Party App Store - Installed from a third- | > | l of scrutiny to applications as enforced by an authorized a | ||
| > | party app store (as opposed to an authorized app store that | > | pplication store.(Citation: IBTimes-ThirdParty)(Citation: Tr | ||
| > | the device implicitly trusts as part of its default behavior | > | endMicro-RootingMalware)(Citation: TrendMicro-FlappyBird) | ||
| > | ), which may not apply the same level of scrutiny to apps as | > | Some Android malware comes with functionality to install add | ||
| > | applied by an authorized app store.(Citation: IBTimes-Third | > | itional applications, either automatically or when the adver | ||
| > | Party)(Citation: TrendMicro-RootingMalware)(Citation: TrendM | > | sary instructs it to.(Citation: android-trojan-steals-paypal | ||
| > | icro-FlappyBird) Some Android malware comes with functional | > | -2fa) | ||
| > | ity to install additional applications, either automatically | ||||
| > | or when the adversary instructs it to.(Citation: android-tr | ||||
| > | ojan-steals-paypal-2fa) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for applications att | t | 1 | For Android, detect Evade Analysis Environment primarily dur |
| > | empting to get `android.os.SystemProperties` or `getprop` wi | > | ing application vetting or controlled analysis rather than a | ||
| > | th the runtime `exec()` commands. This could indicate some l | > | ssuming a live device SOC feed. Correlate API Calls via Appl | ||
| > | evel of sandbox evasion, as Google recommends against using | > | ication Vetting / Instrumented Dynamic Analysis [Dynamic API | ||
| > | system properties within applications. | > | /runtime trace: APK or IPA contains SystemProperties.get() c | ||
| > | alls, Runtime.exec getprop invocations, or code patterns che | ||||
| > | cking for emulator artifacts (ro.product.model=sdk, IMEI=000 | ||||
| > | 000, screen size, sensor absence) \u2014 static detection of envi | ||||
| > | ronment-check co]. Alert on a sequence or state change incon | ||||
| > | sistent with the device/app baseline, approved management po | ||||
| > | licy, or expected user workflow; do not infer unobserved API | ||||
| > | calls, file/process activity, or payload content from manag | ||||
| > | ement state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for applications att | t | 1 | For iOS, detect Evade Analysis Environment primarily during |
| > | empting to get `android.os.SystemProperties` or `getprop` wi | > | application vetting or controlled analysis rather than assum | ||
| > | th the runtime `exec()` commands. This could indicate some l | > | ing a live device SOC feed. Correlate API Calls via Applicat | ||
| > | evel of sandbox evasion, as Google recommends against using | > | ion Vetting / Instrumented Dynamic Analysis [Dynamic API/run | ||
| > | system properties within applications. | > | time trace: IPA contains UIDevice.currentDevice.model checks | ||
| > | for Simulator strings, CMMotionManager.isDeviceMotionAvaila | ||||
| > | ble comparisons, or other Simulator-detection patterns \u2014 sta | ||||
| > | tic detection of iOS environment-check code]. Alert on a seq | ||||
| > | uence or state change inconsistent with the device/app basel | ||||
| > | ine, approved management policy, or expected user workflow; | ||||
| > | do not infer unobserved API calls, file/process activity, or | ||||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | On Android, the user can use the device settings menu to vie | t | 1 | For Android, detect Code Signing Policy Modification by corr |
| > | w trusted CA certificates and look for unexpected or unknown | > | elating analyst-visible device/network evidence and manageme | ||
| > | certificates. A mobile security product could similarly exa | > | nt state; use streaming or batched telemetry only where the | ||
| > | mine the trusted CA certificate store for anomalies. Users c | > | documented collector is deployed. Correlate Application Perm | ||
| > | an use the device settings menu to view which applications o | > | ission via Android Enterprise DPC / Application Vetting [Dev | ||
| > | n the device are allowed to install unknown applications. | > | icePolicyManager.getPermissionGrantState(); PackageManager m | ||
| > | On iOS, the user can use the device settings menu to view in | > | anifest/requested-permission review]; File Creation via Appl | ||
| > | stalled Configuration Profiles and look for unexpected or un | > | ication Vetting / Forensic Acquisition [Dynamic filesystem t | ||
| > | known profiles. A Mobile Device Management (MDM) system coul | > | race or acquired app-container/filesystem artifacts: Package | ||
| > | d use the iOS MDM APIs to examine the list of installed Conf | > | Installer.install() with signing_cert NOT IN $EnterpriseCert | ||
| > | iguration Profiles for anomalies. | > | List$ within $PolicyViolationWindow$ of settings change]; Sy | ||
| > | stem Settings via Android Enterprise DPC [DevicePolicyManage | ||||
| > | r policy/compliance/security-state queries and SecurityLog e | ||||
| > | vents where supported]. Alert on a sequence or state change | ||||
| > | inconsistent with the device/app baseline, approved manageme | ||||
| > | nt policy, or expected user workflow; do not infer unobserve | ||||
| > | d API calls, file/process activity, or payload content from | ||||
| > | management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | On Android, the user can use the device settings menu to vie | t | 1 | For iOS, detect Code Signing Policy Modification from docume |
| > | w trusted CA certificates and look for unexpected or unknown | > | nted management, network, or vetting evidence; treat state q | ||
| > | certificates. A mobile security product could similarly exa | > | ueries as periodic observations rather than real-time events | ||
| > | mine the trusted CA certificate store for anomalies. Users c | > | . Correlate Application Permission via Application Vetting [ | ||
| > | an use the device settings menu to view which applications o | > | Code-signing entitlements and Info.plist privacy usage-descr | ||
| > | n the device are allowed to install unknown applications. | > | iption keys]; File Creation via Application Vetting / Forens | ||
| > | On iOS, the user can use the device settings menu to view in | > | ic Acquisition [Dynamic filesystem trace or acquired app-con | ||
| > | stalled Configuration Profiles and look for unexpected or un | > | tainer/filesystem artifacts: IPA binary written with signing | ||
| > | known profiles. A Mobile Device Management (MDM) system coul | > | cert matching user-trusted certificate NOT IN $EnterpriseCe | ||
| > | d use the iOS MDM APIs to examine the list of installed Conf | > | rtList$ within $ProfileInstallWindow$]; Protected Configurat | ||
| > | iguration Profiles for anomalies. | > | ion via Apple MDM [DeviceInformation / SecurityInfo / Profil | ||
| > | eList / restrictions and compliance queries]. Alert on a seq | ||||
| > | uence or state change inconsistent with the device/app basel | ||||
| > | ine, approved management policy, or expected user workflow; | ||||
| > | do not infer unobserved API calls, file/process activity, or | ||||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for misuse of dynami | t | 1 | For Android, detect Ptrace System Calls by correlating analy |
| > | c libraries. | > | st-visible device/network evidence and management state; use | ||
| > | streaming or batched telemetry only where the documented co | ||||
| > | llector is deployed. Correlate Host Status via Android Enter | ||||
| > | prise DPC [DevicePolicyManager policy/compliance/security-st | ||||
| > | ate queries and SecurityLog events where supported]; Network | ||||
| > | Traffic Flow via Android Enterprise Network Logging / Enter | ||||
| > | prise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEve | ||||
| > | nt / ConnectEvent; VPN flow metadata]; Process Access via Ap | ||||
| > | plication Vetting / Instrumented Dynamic Analysis [Dynamic A | ||||
| > | PI/runtime trace: process in $TargetProcessList$ shows unexp | ||||
| > | ected behavior change (new network destinations, new permiss | ||||
| > | ion accesses) within $InjectionWindow$ of root status change | ||||
| > | \u2014 behavioral delta in target process post-injection is the | ||||
| > | anomaly indicator]. Alert on a sequence or state change inco | ||||
| > | nsistent with the device/app baseline, approved management p | ||||
| > | olicy, or expected user workflow; do not infer unobserved AP | ||||
| > | I calls, file/process activity, or payload content from mana | ||||
| > | gement state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for misuse of dynami | t | 1 | For iOS, detect Ptrace System Calls by correlating analyst-v |
| > | c libraries. | > | isible device/network evidence and management state; use str | ||
| > | eaming or batched telemetry only where the documented collec | ||||
| > | tor is deployed. Correlate Host Status via Apple MDM [Device | ||||
| > | Information / SecurityInfo / ProfileList / restrictions and | ||||
| > | compliance queries]; Network Traffic Flow via Apple Network | ||||
| > | Extension / Enterprise VPN [NEFilterFlow / per-app VPN / sec | ||||
| > | ure-web-gateway flow metadata]; Process Access via Applicati | ||||
| > | on Vetting / Instrumented Dynamic Analysis [Dynamic API/runt | ||||
| > | ime trace: kernel log at level=fault referencing task_for_pi | ||||
| > | d, mach_vm_write, or get-task-allow outside developer build | ||||
| > | on SUPERVISED device \u2014 Apple Unified Log kernel subsystem re | ||||
| > | cords these violations at fault level; supervised MDM with U | ||||
| > | nified Log ]. Alert on a sequence or state change inconsiste | ||||
| > | nt with the device/app baseline, approved management policy, | ||||
| > | or expected user workflow; do not infer unobserved API call | ||||
| > | s, file/process activity, or payload content from management | ||||
| > | state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for misuse of dynami | t | 1 | For Android, detect Process Injection by correlating analyst |
| > | c libraries. | > | -visible device/network evidence and management state; use s | ||
| > | treaming or batched telemetry only where the documented coll | ||||
| > | ector is deployed. Correlate Host Status via Android Enterpr | ||||
| > | ise DPC [DevicePolicyManager policy/compliance/security-stat | ||||
| > | e queries and SecurityLog events where supported]; Network T | ||||
| > | raffic Flow via Android Enterprise Network Logging / Enterpr | ||||
| > | ise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent | ||||
| > | / ConnectEvent; VPN flow metadata]; Process Access via Appl | ||||
| > | ication Vetting / Instrumented Dynamic Analysis [Dynamic API | ||||
| > | /runtime trace: accessibility_service or notification_listen | ||||
| > | er appears attributed to a bundle IN $LegitimateSystemProces | ||||
| > | ses$ within $InjectionWindow$ of root detection \u2014 injected c | ||||
| > | ode requesting special permissions under a legitimate system | ||||
| > | process identit]. Alert on a sequence or state change incon | ||||
| > | sistent with the device/app baseline, approved management po | ||||
| > | licy, or expected user workflow; do not infer unobserved API | ||||
| > | calls, file/process activity, or payload content from manag | ||||
| > | ement state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for misuse of dynami | t | 1 | For iOS, detect Process Injection by correlating analyst-vis |
| > | c libraries. | > | ible device/network evidence and management state; use strea | ||
| > | ming or batched telemetry only where the documented collecto | ||||
| > | r is deployed. Correlate Host Status via Apple MDM [DeviceIn | ||||
| > | formation / SecurityInfo / ProfileList / restrictions and co | ||||
| > | mpliance queries]; Network Traffic Flow via Apple Network Ex | ||||
| > | tension / Enterprise VPN [NEFilterFlow / per-app VPN / secur | ||||
| > | e-web-gateway flow metadata]; Process Access via Application | ||||
| > | Vetting / Instrumented Dynamic Analysis [Dynamic API/runtim | ||||
| > | e trace: kernel log entry at level=fault referencing task_fo | ||||
| > | r_pid or get-task-allow violation on SUPERVISED device with | ||||
| > | Unified Log forwarding \u2014 kernel records entitlement violatio | ||||
| > | ns at fault level; requires supervised MDM with Unified Log | ||||
| > | export]. Alert on a sequence or state change inconsistent wi | ||||
| > | th the device/app baseline, approved management policy, or e | ||||
| > | xpected user workflow; do not infer unobserved API calls, fi | ||||
| > | le/process activity, or payload content from management stat | ||||
| > | e alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services may be able to detect known pri | t | 1 | For iOS, detect Credentials from Password Store by correlati |
| > | vilege escalation exploits contained within applications, as | > | ng analyst-visible device/network evidence and management st | ||
| > | well as searching application packages for strings that cor | > | ate; use streaming or batched telemetry only where the docum | ||
| > | relate to known password store locations. Mobile security pr | > | ented collector is deployed. Correlate Application State via | ||
| > | oducts can potentially detect jailbroken devices. | > | Apple MDM [InstalledApplicationList / ManagedApplicationLis | ||
| > | t]; Host Status via Apple MDM [DeviceInformation / SecurityI | ||||
| > | nfo / ProfileList / restrictions and compliance queries]; Ne | ||||
| > | twork Traffic Flow via Apple Network Extension / Enterprise | ||||
| > | VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow me | ||||
| > | tadata]. Alert on a sequence or state change inconsistent wi | ||||
| > | th the device/app baseline, approved management policy, or e | ||||
| > | xpected user workflow; do not infer unobserved API calls, fi | ||||
| > | le/process activity, or payload content from management stat | ||||
| > | e alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | On Android, the user can use the device settings menu to vie | t | 1 | For Android, detect Subvert Trust Controls by correlating an |
| > | w trusted CA certificates and look for unexpected or unknown | > | alyst-visible device/network evidence and management state; | ||
| > | certificates. A mobile security product could similarly exa | > | use streaming or batched telemetry only where the documented | ||
| > | mine the trusted CA certificate store for anomalies. Users c | > | collector is deployed. Correlate Application Permission via | ||
| > | an use the device settings menu to view which applications o | > | Android Enterprise DPC / Application Vetting [DevicePolicyM | ||
| > | n the device are allowed to install unknown applications. O | > | anager.getPermissionGrantState(); PackageManager manifest/re | ||
| > | n iOS, the user can use the device settings menu to view ins | > | quested-permission review]; File Creation via Application Ve | ||
| > | talled Configuration Profiles and look for unexpected or unk | > | tting / Forensic Acquisition [Dynamic filesystem trace or ac | ||
| > | nown profiles. A Mobile Device Management (MDM) system could | > | quired app-container/filesystem artifacts: PackageInstaller. | ||
| > | use the iOS MDM APIs to examine the list of installed Confi | > | install() with installer_source NOT IN $ApprovedInstallSourc | ||
| > | guration Profiles for anomalies. | > | es$ within $PolicyViolationWindow$ of settings change]; Syst | ||
| > | em Settings via Android Enterprise DPC [DevicePolicyManager | ||||
| > | policy/compliance/security-state queries and SecurityLog eve | ||||
| > | nts where supported]. Alert on a sequence or state change in | ||||
| > | consistent with the device/app baseline, approved management | ||||
| > | policy, or expected user workflow; do not infer unobserved | ||||
| > | API calls, file/process activity, or payload content from ma | ||||
| > | nagement state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | On Android, the user can use the device settings menu to vie | t | 1 | For iOS, detect Subvert Trust Controls from documented manag |
| > | w trusted CA certificates and look for unexpected or unknown | > | ement, network, or vetting evidence; treat state queries as | ||
| > | certificates. A mobile security product could similarly exa | > | periodic observations rather than real-time events. Correlat | ||
| > | mine the trusted CA certificate store for anomalies. Users c | > | e Application Permission via Application Vetting [Code-signi | ||
| > | an use the device settings menu to view which applications o | > | ng entitlements and Info.plist privacy usage-description key | ||
| > | n the device are allowed to install unknown applications. O | > | s]; File Creation via Application Vetting / Forensic Acquisi | ||
| > | n iOS, the user can use the device settings menu to view ins | > | tion [Dynamic filesystem trace or acquired app-container/fil | ||
| > | talled Configuration Profiles and look for unexpected or unk | > | esystem artifacts: app binary written to device with signing | ||
| > | nown profiles. A Mobile Device Management (MDM) system could | > | certificate matching manually-trusted enterprise cert NOT I | ||
| > | use the iOS MDM APIs to examine the list of installed Confi | > | N $EnterpriseCertAllowList$ within $ProfileInstallWindow$]; | ||
| > | guration Profiles for anomalies. | > | Protected Configuration via Apple MDM [DeviceInformation / S | ||
| > | ecurityInfo / ProfileList / restrictions and compliance quer | ||||
| > | ies]. Alert on a sequence or state change inconsistent with | ||||
| > | the device/app baseline, approved management policy, or expe | ||||
| > | cted user workflow; do not infer unobserved API calls, file/ | ||||
| > | process activity, or payload content from management state a | ||||
| > | lone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Mobile security products can potentially detect jailbroken d | t | 1 | For iOS, detect Keychain by correlating analyst-visible devi |
| > | evices. Application vetting services may be able to detect k | > | ce/network evidence and management state; use streaming or b | ||
| > | nown privilege escalation exploits contained within applicat | > | atched telemetry only where the documented collector is depl | ||
| > | ions, as well as searching application packages for strings | > | oyed. Correlate Application State via Apple MDM [InstalledAp | ||
| > | that correlate to known password store locations. | > | plicationList / ManagedApplicationList]; Host Status via App | ||
| > | le MDM [DeviceInformation / SecurityInfo / ProfileList / res | ||||
| > | trictions and compliance queries]; Network Traffic Flow via | ||||
| > | Apple Network Extension / Enterprise VPN [NEFilterFlow / per | ||||
| > | -app VPN / secure-web-gateway flow metadata]. Alert on a seq | ||||
| > | uence or state change inconsistent with the device/app basel | ||||
| > | ine, approved management policy, or expected user workflow; | ||||
| > | do not infer unobserved API calls, file/process activity, or | ||||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Mobile security products can use attestation to detect compr | t | 1 | For Android, detect Disguise Root/Jailbreak Indicators by co |
| > | omised devices. | > | rrelating analyst-visible device/network evidence and manage | ||
| > | ment state; use streaming or batched telemetry only where th | ||||
| > | e documented collector is deployed. Correlate File Metadata | ||||
| > | via Application Vetting / Forensic Acquisition [Dynamic file | ||||
| > | system trace or acquired app-container/filesystem artifacts: | ||||
| > | binary with file_permissions including setuid bit (mode & 0 | ||||
| > | 4000) at path NOT IN $KnownSystemBinPaths$ \u2014 setuid outside | ||||
| > | system bin directories is the renamed-root-binary indicator] | ||||
| > | ; Host Status via Android Enterprise DPC [DevicePolicyManage | ||||
| > | r policy/compliance/security-state queries and SecurityLog e | ||||
| > | vents where supported]; Process Metadata via Application Vet | ||||
| > | ting / Instrumented Dynamic Analysis [Dynamic API/runtime tr | ||||
| > | ace: process executing with effective UID=0]. Alert on a seq | ||||
| > | uence or state change inconsistent with the device/app basel | ||||
| > | ine, approved management policy, or expected user workflow; | ||||
| > | do not infer unobserved API calls, file/process activity, or | ||||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Mobile security products can use attestation to detect compr | t | 1 | For iOS, detect Disguise Root/Jailbreak Indicators by correl |
| > | omised devices. | > | ating analyst-visible device/network evidence and management | ||
| > | state; use streaming or batched telemetry only where the do | ||||
| > | cumented collector is deployed. Correlate Application State | ||||
| > | via Apple MDM [InstalledApplicationList / ManagedApplication | ||||
| > | List]; Host Status via Apple MDM [DeviceInformation / Securi | ||||
| > | tyInfo / ProfileList / restrictions and compliance queries]; | ||||
| > | Network Traffic Flow via Apple Network Extension / Enterpri | ||||
| > | se VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow | ||||
| > | metadata]. Alert on a sequence or state change inconsistent | ||||
| > | with the device/app baseline, approved management policy, o | ||||
| > | r expected user workflow; do not infer unobserved API calls, | ||||
| > | file/process activity, or payload content from management s | ||||
| > | tate alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) an application obtaining or maintaining eleva | t | 1 | For Android, detect Prevent Application Removal from documen |
| > | ted control mechanisms capable of resisting removal (device | > | ted management, network, or vetting evidence; treat state qu | ||
| > | administrator, accessibility control, managed-owner posture) | > | eries as periodic observations rather than real-time events. | ||
| > | , (2) user navigation into uninstall or application-manageme | > | Correlate Application Permission via Android Enterprise DPC | ||
| > | nt flows, and (3) immediate UI redirection, back-navigation | > | / Application Vetting [DevicePolicyManager.getPermissionGra | ||
| > | injection, modal dismissal, or failed uninstall completion f | > | ntState(); PackageManager manifest/requested-permission revi | ||
| > | ollowed by continued app presence. Defender observes a causa | > | ew]; OS API Execution via Application Vetting / Instrumented | ||
| > | l chain where a removal attempt is actively disrupted and th | > | Dynamic Analysis [Dynamic API/runtime trace: App invokes ac | ||
| > | e target application remains installed. | > | cessibility global actions (back, home, recents) or DevicePo | ||
| > | licyManager removal-resistance operations when package-manag | ||||
| > | ement or uninstall UI is in foreground \u2014 active uninstall in | ||||
| > | terference]. Alert on a sequence or state change inconsisten | ||||
| > | t with the device/app baseline, approved management policy, | ||||
| > | or expected user workflow; do not infer unobserved API calls | ||||
| > | , file/process activity, or payload content from management | ||||
| > | state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates an app enumerating installed packages (P | t | 1 | For Android, detect Software Discovery by correlating analys |
| > | ackageManager queries or shell 'pm list packages') with sele | > | t-visible device/network evidence and management state; use | ||
| > | ctive checks for high-value targets (banking/identity/securi | > | streaming or batched telemetry only where the documented col | ||
| > | ty apps) and near-term persistence/egress of the inventory. | > | lector is deployed. Correlate API Calls via Application Vett | ||
| > | Chain: capability to query apps \u2192 burst of enumeration calls | > | ing / Instrumented Dynamic Analysis [Dynamic API/runtime tra | ||
| > | or shell listing \u2192 optional foreground target detection \u2192 l | > | ce: PackageManager.getInstalledPackages() or getInstalledApp | ||
| > | ocal inventory file \u2192 small POST to remote endpoint. | > | lications() called by app NOT IN $AppEnumAllowList$]; Applic | ||
| > | ation State via Android Enterprise / EMM [Managed package in | ||||
| > | ventory/status and package metadata]; Network Connection Cre | ||||
| > | ation via Android Enterprise Network Logging / Enterprise VP | ||||
| > | N [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / Con | ||||
| > | nectEvent; VPN flow metadata]. Alert on a sequence or state | ||||
| > | change inconsistent with the device/app baseline, approved m | ||||
| > | anagement policy, or expected user workflow; do not infer un | ||||
| > | observed API calls, file/process activity, or payload conten | ||||
| > | t from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates attempts to inventory installed apps via | t | 1 | For iOS, detect Software Discovery by correlating analyst-vi |
| > | LaunchServices/URL-scheme probing or private APIs (e.g., LS | > | sible device/network evidence and management state; use stre | ||
| > | ApplicationWorkspace) with checks for high-value targets and | > | aming or batched telemetry only where the documented collect | ||
| > | quick persistence/egress. Chain: capability/attempt (URL sc | > | or is deployed. Correlate API Calls via Application Vetting | ||
| > | heme spray or LSWorkspace calls) \u2192 large scheme/app probe se | > | / Instrumented Dynamic Analysis [Dynamic API/runtime trace: | ||
| > | t \u2192 optional webview hits to brand domains \u2192 local inventory | > | UIApplication.canOpenURL() called > $URLProbeThreshold$ time | ||
| > | cache \u2192 small egress. | > | s with schemes NOT declared in app's LSApplicationQueriesSch | ||
| > | emes within $ProbeWindow$]; Application State via Apple MDM | ||||
| > | [InstalledApplicationList / ManagedApplicationList]; Network | ||||
| > | Connection Creation via Apple Network Extension / Enterpris | ||||
| > | e VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow | ||||
| > | metadata]. Alert on a sequence or state change inconsistent | ||||
| > | with the device/app baseline, approved management policy, or | ||||
| > | expected user workflow; do not infer unobserved API calls, | ||||
| > | file/process activity, or payload content from management st | ||||
| > | ate alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates an app process performing a burst of OS/ | t | 1 | For Android, detect System Information Discovery by correlat |
| > | device attribute lookups (build, hardware, SDK level, system | > | ing analyst-visible device/network evidence and management s | ||
| > | properties) with near-term execution branching (feature gat | > | tate; use streaming or batched telemetry only where the docu | ||
| > | ing, module load, permission workflow changes) and/or immedi | > | mented collector is deployed. Correlate API Calls via Applic | ||
| > | ate outbound communications, indicating environment evaluati | > | ation Vetting / Instrumented Dynamic Analysis [Dynamic API/r | ||
| > | on used to shape follow-on actions. | > | untime trace: android.os.Build field reads > $SysInfoFieldTh | ||
| > | reshold$ distinct fields within $SysInfoWindow$ by app NOT I | ||||
| > | N $SysInfoAllowList$ at launch or in background]; Applicatio | ||||
| > | n State via Android Enterprise / EMM [Managed package invent | ||||
| > | ory/status and package metadata]; Network Connection Creatio | ||||
| > | n via Android Enterprise Network Logging / Enterprise VPN [D | ||||
| > | evicePolicyManager.retrieveNetworkLogs(): DnsEvent / Connect | ||||
| > | Event; VPN flow metadata]. Alert on a sequence or state chan | ||||
| > | ge inconsistent with the device/app baseline, approved manag | ||||
| > | ement policy, or expected user workflow; do not infer unobse | ||||
| > | rved API calls, file/process activity, or payload content fr | ||||
| > | om management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates an app querying device model and iOS ver | t | 1 | For iOS, detect System Information Discovery by correlating |
| > | sion (often limited to UIDevice-visible attributes) with sub | > | analyst-visible device/network evidence and management state | ||
| > | sequent behavior divergence (capability gating, alternate co | > | ; use streaming or batched telemetry only where the document | ||
| > | de paths) and/or near-term outbound connections, suggesting | > | ed collector is deployed. Correlate API Calls via Applicatio | ||
| > | device fingerprinting for decision-making rather than normal | > | n Vetting / Instrumented Dynamic Analysis [Dynamic API/runti | ||
| > | telemetry. | > | me trace: UIDevice.current.model]; Application State via App | ||
| > | le MDM [InstalledApplicationList / ManagedApplicationList]; | ||||
| > | Network Connection Creation via Apple Network Extension / En | ||||
| > | terprise VPN [NEFilterFlow / per-app VPN / secure-web-gatewa | ||||
| > | y flow metadata]. Alert on a sequence or state change incons | ||||
| > | istent with the device/app baseline, approved management pol | ||||
| > | icy, or expected user workflow; do not infer unobserved API | ||||
| > | calls, file/process activity, or payload content from manage | ||||
| > | ment state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | OLD: Application vetting services could look for `android.pe | t | 1 | For Android, detect Call Log by correlating analyst-visible |
| > | rmission.READ_CALL_LOG` in an Android application\u2019s manifest | > | device/network evidence and management state; use streaming | ||
| > | . Most applications do not need call log access, so extra sc | > | or batched telemetry only where the documented collector is | ||
| > | rutiny could be applied to those that request it. On Androi | > | deployed. Correlate API Calls via Application Vetting / Inst | ||
| > | d, the user can manage which applications have permission to | > | rumented Dynamic Analysis [Dynamic API/runtime trace: Conten | ||
| > | access the call log through the device settings screen, rev | > | tResolver.query(CallLog.Calls) with query_count > $CallLogQu | ||
| > | oking the permission if necessary. NEW: A defender observes | > | eryThreshold$ by app NOT IN $ApprovedDialerApps$]; Network T | ||
| > | an Android application requesting for `android.permission.R | > | raffic Flow via Android Enterprise Network Logging / Enterpr | ||
| > | EAD_CALL_LOG`, which may also be listed in the application's | > | ise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent | ||
| > | manifest file. | > | / ConnectEvent; VPN flow metadata]; Permissions Request via | ||
| > | Android Enterprise DPC / Application Vetting [DevicePolicyM | ||||
| > | anager.getPermissionGrantState(); PackageManager manifest/re | ||||
| > | quested-permission review]. Alert on a sequence or state cha | ||||
| > | nge inconsistent with the device/app baseline, approved mana | ||||
| > | gement policy, or expected user workflow; do not infer unobs | ||||
| > | erved API calls, file/process activity, or payload content f | ||||
| > | rom management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for `android.permiss | t | 1 | For iOS, detect Call Log by correlating analyst-visible devi |
| > | ion.READ_CALL_LOG` in an Android application\u2019s manifest. Mos | > | ce/network evidence and management state; use streaming or b | ||
| > | t applications do not need call log access, so extra scrutin | > | atched telemetry only where the documented collector is depl | ||
| > | y could be applied to those that request it. On Android, th | > | oyed. Correlate Application State via Apple MDM [InstalledAp | ||
| > | e user can manage which applications have permission to acce | > | plicationList / ManagedApplicationList]; Host Status via App | ||
| > | ss the call log through the device settings screen, revoking | > | le MDM [DeviceInformation / SecurityInfo / ProfileList / res | ||
| > | the permission if necessary. | > | trictions and compliance queries]; Network Traffic Flow via | ||
| > | Apple Network Extension / Enterprise VPN [NEFilterFlow / per | ||||
| > | -app VPN / secure-web-gateway flow metadata]. Alert on a seq | ||||
| > | uence or state change inconsistent with the device/app basel | ||||
| > | ine, approved management policy, or expected user workflow; | ||||
| > | do not infer unobserved API calls, file/process activity, or | ||||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) acquisition or presence of elevated control p | t | 1 | For Android, detect Device Lockout from documented managemen |
| > | aths capable of forcing a lock state or blocking user intera | > | t, network, or vetting evidence; treat state queries as peri | ||
| > | ction, (2) invocation of screen-locking or UI-denial behavio | > | odic observations rather than real-time events. Correlate Ap | ||
| > | r such as DevicePolicyManager lock operations, persistent ov | > | plication Permission via Android Enterprise DPC / Applicatio | ||
| > | erlays, accessibility-driven navigation interruption, or for | > | n Vetting [DevicePolicyManager.getPermissionGrantState(); Pa | ||
| > | eground lock-screen impersonation, and (3) immediate transit | > | ckageManager manifest/requested-permission review]; OS API E | ||
| > | ion of the device into an unavailable or repeatedly re-locke | > | xecution via Application Vetting / Instrumented Dynamic Anal | ||
| > | d state while the responsible application remains installed | > | ysis [Dynamic API/runtime trace: App invokes DevicePolicyMan | ||
| > | and active. The defender observes a causal chain where an ap | > | ager.lockNow(), creates persistent fullscreen overlay (TYPE_ | ||
| > | plication first gains the ability to control lock-related be | > | APPLICATION_OVERLAY covering full screen), or uses accessibi | ||
| > | havior, then forces or simulates lockout, and the device bec | > | lity to block UI interaction \u2014 lock or UI-denial API invocat | ||
| > | omes unusable to the legitimate user. | > | ion]. Alert on a sequence or state change inconsistent with | ||
| > | the device/app baseline, approved management policy, or expe | ||||
| > | cted user workflow; do not infer unobserved API calls, file/ | ||||
| > | process activity, or payload content from management state a | ||||
| > | lone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender observes a newly enrolled or recently activated | t | 1 | For Android, detect Compromise Hardware Supply Chain by corr |
| > | device presenting abnormal integrity, hardware-backed attes | > | elating analyst-visible device/network evidence and manageme | ||
| > | tation, or firmware/build relationships at the management pl | > | nt state; use streaming or batched telemetry only where the | ||
| > | ane, followed by privileged or system-context access to prot | > | documented collector is deployed. Correlate Application Perm | ||
| > | ected resources or framework paths, and then outbound commun | > | ission via Android Enterprise DPC / Application Vetting [Dev | ||
| > | ication inconsistent with setup state, lock state, or recent | > | icePolicyManager.getPermissionGrantState(); PackageManager m | ||
| > | user interaction. The causal sequence is strongest when the | > | anifest/requested-permission review]; Application State via | ||
| > | device has not yet reached a normal trusted posture but sti | > | Android Enterprise / EMM [Managed package inventory/status a | ||
| > | ll exhibits system-level capability use or network activity. | > | nd package metadata]; Network Traffic Content via Enterprise | ||
| > | Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy | ||||
| > | transaction metadata where enterprise decryption/inspection | ||||
| > | is deployed]. Alert on a sequence or state change inconsist | ||||
| > | ent with the device/app baseline, approved management policy | ||||
| > | , or expected user workflow; do not infer unobserved API cal | ||||
| > | ls, file/process activity, or payload content from managemen | ||||
| > | t state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender observes a device at activation, supervision, o | t | 1 | For iOS, detect Compromise Hardware Supply Chain by correlat |
| > | r enrollment time with unusual management-plane posture, inv | > | ing analyst-visible device/network evidence and management s | ||
| > | entory, or trust characteristics and then relies primarily o | > | tate; use streaming or batched telemetry only where the docu | ||
| > | n downstream network effects and device state inconsistencie | > | mented collector is deployed. Correlate Application Permissi | ||
| > | s rather than direct low-level process telemetry. On iOS, th | > | on via Application Vetting [Code-signing entitlements and In | ||
| > | e most reliable sequence is supervision/attestation or inven | > | fo.plist privacy usage-description keys]; Application State | ||
| > | tory concern near first contact followed by network egress o | > | via Apple MDM [InstalledApplicationList / ManagedApplication | ||
| > | r protected-state behavior that is inconsistent with lock st | > | List]; Network Traffic Content via Enterprise Secure Web Gat | ||
| > | ate, setup phase, or expected managed app activity. | > | eway / Proxy [DNS/HTTP(S) inspection or proxy transaction me | ||
| > | tadata where enterprise decryption/inspection is deployed]. | ||||
| > | Alert on a sequence or state change inconsistent with the de | ||||
| > | vice/app baseline, approved management policy, or expected u | ||||
| > | ser workflow; do not infer unobserved API calls, file/proces | ||||
| > | s activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could closely scrutinize applic | t | 1 | For Android, detect Account Access Removal by correlating an |
| > | ations that request Device Administrator permissions. | > | alyst-visible device/network evidence and management state; | ||
| > | use streaming or batched telemetry only where the documented | ||||
| > | collector is deployed. Correlate API Calls via Application | ||||
| > | Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime | ||||
| > | trace: DevicePolicyManager.resetPassword() or lockNow() or | ||||
| > | wipeData() called by caller NOT IN $MDMAgentPackageList$]; A | ||||
| > | pplication Permission via Android Enterprise DPC / Applicati | ||||
| > | on Vetting [DevicePolicyManager.getPermissionGrantState(); P | ||||
| > | ackageManager manifest/requested-permission review]; Host St | ||||
| > | atus via Android Enterprise DPC [DevicePolicyManager policy/ | ||||
| > | compliance/security-state queries and SecurityLog events whe | ||||
| > | re supported]. Alert on a sequence or state change inconsist | ||||
| > | ent with the device/app baseline, approved management policy | ||||
| > | , or expected user workflow; do not infer unobserved API cal | ||||
| > | ls, file/process activity, or payload content from managemen | ||||
| > | t state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The user can view a list of device administrators and applic | t | 1 | For Android, detect Virtualization Solution by correlating a |
| > | ations that have registered Accessibility services in device | > | nalyst-visible device/network evidence and management state; | ||
| > | settings. Applications that register an Accessibility servi | > | use streaming or batched telemetry only where the documente | ||
| > | ce or request device administrator permissions should be scr | > | d collector is deployed. Correlate Application Permission vi | ||
| > | utinized further for malicious behavior. Application vettin | > | a Android Enterprise DPC / Application Vetting [DevicePolicy | ||
| > | g services can look for applications that request permission | > | Manager.getPermissionGrantState(); PackageManager manifest/r | ||
| > | s to Accessibility services or application overlay. Monitor | > | equested-permission review]; Application State via Android E | ||
| > | for API calls that are related to GooglePlayServices. | > | nterprise / EMM [Managed package inventory/status and packag | ||
| > | e metadata]; Network Traffic Flow via Android Enterprise Net | ||||
| > | work Logging / Enterprise VPN [DevicePolicyManager.retrieveN | ||||
| > | etworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. A | ||||
| > | lert on a sequence or state change inconsistent with the dev | ||||
| > | ice/app baseline, approved management policy, or expected us | ||||
| > | er workflow; do not infer unobserved API calls, file/process | ||||
| > | activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates app-driven shell-launch behavior wit | t | 1 | For Android, detect Unix Shell from documented management, n |
| > | h subsequent execution of Unix shell processes or shell-scri | > | etwork, or vetting evidence; treat state queries as periodic | ||
| > | pt activity under the same app context, especially when exec | > | observations rather than real-time events. Correlate Comman | ||
| > | ution occurs from background state, without recent user inte | > | d Execution via Application Vetting / Instrumented Dynamic A | ||
| > | raction, or is followed by file-system, privilege-escalation | > | nalysis [Dynamic API/runtime trace: Unix shell process (sh, | ||
| > | , or network effects inconsistent with the app's declared ro | > | bash, busybox sh, toybox) spawns as child of app process wit | ||
| > | le. The analytic prioritizes Android-observable control-plan | > | h command-line arguments indicating scripted operation \u2014 she | ||
| > | e effects: Runtime or ProcessBuilder invocation, spawn of sh | > | ll with arguments confirms script execution not interactive | ||
| > | /toybox/toolbox/su or equivalent shell process, script-file | > | terminal]; Process Creation via Application Vetting / Manage | ||
| > | staging or redirected output, and post-execution network or | > | d Device Telemetry [Application invokes Runtime.exec(), Proc | ||
| > | local artifact creation. | > | essBuilder.start(), or JNI-backed launcher with sh, bash, to | ||
| > | ybox, toolbox, or su as command argument NOT IN $ApprovedShe | ||||
| > | llApps$ \u2014 explicit Unix shell invocation]. Alert on a sequen | ||||
| > | ce or state change inconsistent with the device/app baseline | ||||
| > | , approved management policy, or expected user workflow; do | ||||
| > | not infer unobserved API calls, file/process activity, or pa | ||||
| > | yload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates managed-app process-launch or shell- | t | 1 | For iOS, detect Unix Shell from documented management, netwo |
| > | like execution effects with subsequent file or network activ | > | rk, or vetting evidence; treat state queries as periodic obs | ||
| > | ity by the same app, then raises confidence when execution o | > | ervations rather than real-time events. Correlate Command Ex | ||
| > | ccurs in background context, without recent user interaction | > | ecution via Application Vetting / Instrumented Dynamic Analy | ||
| > | , or appears tied to command delivery or output exfiltration | > | sis [Dynamic API/runtime trace: Shell or command-executing c | ||
| > | . Because direct Unix-shell observability is typically weake | > | hild process with arguments spawned under managed app contex | ||
| > | r on iOS and child processes remain constrained by the app s | > | t on supervised iOS device]; Process Creation via Applicatio | ||
| > | andbox, the analytic anchors on process-execution effects wh | > | n Vetting / Managed Device Telemetry [Managed iOS app invoke | ||
| > | ere available and then on lifecycle, file, and network side | > | s process-launch behavior resulting in sh, bash, or equivale | ||
| > | effects rather than assuming rich shell-parameter visibility | > | nt shell child process on supervised device \u2014 any shell spaw | ||
| > | in all environments. | > | n on stock iOS is a jailbreak indicator]. Alert on a sequenc | ||
| > | e or state change inconsistent with the device/app baseline, | ||||
| > | approved management policy, or expected user workflow; do n | ||||
| > | ot infer unobserved API calls, file/process activity, or pay | ||||
| > | load content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | On Android, the user can review which applications can use p | t | 1 | For Android, detect Generate Traffic from Victim by correlat |
| > | remium SMS features in the \"Special access\" page within appl | > | ing analyst-visible device/network evidence and management s | ||
| > | ication settings. Application vetting services can detect w | > | tate; use streaming or batched telemetry only where the docu | ||
| > | hen applications request the `SEND_SMS` permission, which sh | > | mented collector is deployed. Correlate API Calls via Applic | ||
| > | ould be infrequently used. | > | ation Vetting / Instrumented Dynamic Analysis [Dynamic API/r | ||
| > | untime trace: SmsManager.sendTextMessage() called by app NOT | ||||
| > | IN $ApprovedMessagingApps$]; Network Connection Creation vi | ||||
| > | a Android Enterprise Network Logging / Enterprise VPN [Devic | ||||
| > | ePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEven | ||||
| > | t; VPN flow metadata]; Permissions Request via Android Enter | ||||
| > | prise DPC / Application Vetting [DevicePolicyManager.getPerm | ||||
| > | issionGrantState(); PackageManager manifest/requested-permis | ||||
| > | sion review]. Alert on a sequence or state change inconsiste | ||||
| > | nt with the device/app baseline, approved management policy, | ||||
| > | or expected user workflow; do not infer unobserved API call | ||||
| > | s, file/process activity, or payload content from management | ||||
| > | state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | On Android, the user can review which applications can use p | t | 1 | For iOS, detect Generate Traffic from Victim by correlating |
| > | remium SMS features in the \"Special access\" page within appl | > | analyst-visible device/network evidence and management state | ||
| > | ication settings. Application vetting services can detect w | > | ; use streaming or batched telemetry only where the document | ||
| > | hen applications request the `SEND_SMS` permission, which sh | > | ed collector is deployed. Correlate Application State via Ap | ||
| > | ould be infrequently used. | > | ple MDM [InstalledApplicationList / ManagedApplicationList]; | ||
| > | Network Connection Creation via Apple Network Extension / E | ||||
| > | nterprise VPN [NEFilterFlow / per-app VPN / secure-web-gatew | ||||
| > | ay flow metadata]; Network Traffic Flow via Apple Network Ex | ||||
| > | tension / Enterprise VPN [NEFilterFlow / per-app VPN / secur | ||||
| > | e-web-gateway flow metadata]. Alert on a sequence or state c | ||||
| > | hange inconsistent with the device/app baseline, approved ma | ||||
| > | nagement policy, or expected user workflow; do not infer uno | ||||
| > | bserved API calls, file/process activity, or payload content | ||||
| > | from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Unexpected behavior from an application could be an indicato | t | 1 | For Android, detect Match Legitimate Name or Location from d |
| > | r of masquerading. Application vetting services may potentia | > | ocumented management, network, or vetting evidence; treat st | ||
| > | lly determine if an application contains suspicious code and | > | ate queries as periodic observations rather than real-time e | ||
| > | /or metadata. | > | vents. Correlate Application Permission via Android Enterpri | ||
| > | se DPC / Application Vetting [DevicePolicyManager.getPermiss | ||||
| > | ionGrantState(); PackageManager manifest/requested-permissio | ||||
| > | n review]; File Creation via Application Vetting / Forensic | ||||
| > | Acquisition [Dynamic filesystem trace or acquired app-contai | ||||
| > | ner/filesystem artifacts: PackageInstaller.install() writes | ||||
| > | binary to device storage for impersonating app \u2014 install eve | ||||
| > | nt is the enrollment of impersonating app]; File Metadata vi | ||||
| > | a Application Vetting / Forensic Acquisition [Dynamic filesy | ||||
| > | stem trace or acquired app-container/filesystem artifacts: a | ||||
| > | pp package_name distance <= $NameDistanceThreshold$ from $Kn | ||||
| > | ownAppCatalog$ entry]. Alert on a sequence or state change i | ||||
| > | nconsistent with the device/app baseline, approved managemen | ||||
| > | t policy, or expected user workflow; do not infer unobserved | ||||
| > | API calls, file/process activity, or payload content from m | ||||
| > | anagement state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Unexpected behavior from an application could be an indicato | t | 1 | For iOS, detect Match Legitimate Name or Location by correla |
| > | r of masquerading. Application vetting services may potentia | > | ting analyst-visible device/network evidence and management | ||
| > | lly determine if an application contains suspicious code and | > | state; use streaming or batched telemetry only where the doc | ||
| > | /or metadata. | > | umented collector is deployed. Correlate Application Permiss | ||
| > | ion via Application Vetting [Code-signing entitlements and I | ||||
| > | nfo.plist privacy usage-description keys]; File Metadata via | ||||
| > | Application Vetting / Forensic Acquisition [Dynamic filesys | ||||
| > | tem trace or acquired app-container/filesystem artifacts: di | ||||
| > | splay_name Levenshtein distance <= $NameDistanceThreshold$ f | ||||
| > | rom $KnownIOSAppCatalog$ entry]; Network Traffic Flow via Ap | ||||
| > | ple Network Extension / Enterprise VPN [NEFilterFlow / per-a | ||||
| > | pp VPN / secure-web-gateway flow metadata]. Alert on a seque | ||||
| > | nce or state change inconsistent with the device/app baselin | ||||
| > | e, approved management policy, or expected user workflow; do | ||||
| > | not infer unobserved API calls, file/process activity, or p | ||||
| > | ayload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates repeated or periodic app-attributed | t | 1 | For Android, detect One-Way Communication by correlating ana |
| > | retrieval from a legitimate public web-service platform with | > | lyst-visible device/network evidence and management state; u | ||
| > | runtime conditions showing that the retrieval is not aligne | > | se streaming or batched telemetry only where the documented | ||
| > | d to normal foreground consumption, user interaction, or app | > | collector is deployed. Correlate Application Permission via | ||
| > | roved app role. The strongest Android evidence is a managed | > | Android Enterprise DPC / Application Vetting [DevicePolicyMa | ||
| > | or installed app repeatedly issuing inbound-oriented GET, fe | > | nager.getPermissionGrantState(); PackageManager manifest/req | ||
| > | tch, sync, or content-pull operations to social, collaborati | > | uested-permission review]; Application State via Android Ent | ||
| > | on, paste, code-hosting, cloud-storage, messaging, or generi | > | erprise / EMM [Managed package inventory/status and package | ||
| > | c HTTPS platforms while the app is backgrounded, while the d | > | metadata]; Network Traffic Content via Enterprise Secure Web | ||
| > | evice is locked, or without recent user interaction, and wit | > | Gateway / Proxy [DNS/HTTP(S) inspection or proxy transactio | ||
| > | hout a corresponding outbound writeback to that same service | > | n metadata where enterprise decryption/inspection is deploye | ||
| > | class during the operational window. The detection is stren | > | d]. Alert on a sequence or state change inconsistent with th | ||
| > | gthened when the retrieval is temporally adjacent to schedul | > | e device/app baseline, approved management policy, or expect | ||
| > | ed/background execution, local state changes, or later downs | > | ed user workflow; do not infer unobserved API calls, file/pr | ||
| > | tream effects that do not require the same public platform t | > | ocess activity, or payload content from management state alo | ||
| > | o receive output. | > | ne. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates repeated retrieval-oriented communic | t | 1 | For iOS, detect One-Way Communication by correlating analyst |
| > | ation from a supervised device or managed iOS app to a legit | > | -visible device/network evidence and management state; use s | ||
| > | imate public web-service platform where the activity remains | > | treaming or batched telemetry only where the documented coll | ||
| > | primarily inbound and does not produce corresponding writeb | > | ector is deployed. Correlate Application Permission via Appl | ||
| > | ack to that same service class during the operational window | > | ication Vetting [Code-signing entitlements and Info.plist pr | ||
| > | . The strongest iOS evidence is managed-app or device-attrib | > | ivacy usage-description keys]; Application State via Apple M | ||
| > | uted communication to collaboration, social, messaging, stor | > | DM [InstalledApplicationList / ManagedApplicationList]; Netw | ||
| > | age, or generic HTTPS platforms where inbound fetches or con | > | ork Traffic Content via Enterprise Secure Web Gateway / Prox | ||
| > | tent pulls recur during background refresh, while the device | > | y [DNS/HTTP(S) inspection or proxy transaction metadata wher | ||
| > | is locked, or without recent user interaction, and no match | > | e enterprise decryption/inspection is deployed]. Alert on a | ||
| > | ing POST, upload, update, or message-send activity to that s | > | sequence or state change inconsistent with the device/app ba | ||
| > | ame public service class is observed. Because direct local r | > | seline, approved management policy, or expected user workflo | ||
| > | untime visibility is weaker than Android, the primary analyt | > | w; do not infer unobserved API calls, file/process activity, | ||
| > | ic is anchored on network directionality plus supervised man | > | or payload content from management state alone. | ||
| > | aged-app and device-state context. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An application is granted or maintains notification listener | t | 1 | For Android, detect Access Notifications from documented man |
| > | access, observes notification content from other applicatio | > | agement, network, or vetting evidence; treat state queries a | ||
| > | ns (including sensitive sources such as SMS/email/2FA apps), | > | s periodic observations rather than real-time events. Correl | ||
| > | processes or stores notification payloads, and optionally s | > | ate Application Permission via Android Enterprise DPC / Appl | ||
| > | uppresses or programmatically interacts with notifications ( | > | ication Vetting [DevicePolicyManager.getPermissionGrantState | ||
| > | dismiss/action triggers) without corresponding foreground us | > | (); PackageManager manifest/requested-permission review]; Ap | ||
| > | er interaction. Detection correlates special access permissi | > | plication State via Android Enterprise / EMM [Managed packag | ||
| > | on state + notification event interception + application bac | > | e inventory/status and package metadata]; OS API Execution v | ||
| > | kground state + downstream data use (local write or network | > | ia Application Vetting / Instrumented Dynamic Analysis [Dyna | ||
| > | transmission). | > | mic API/runtime trace: App intercepts notification content f | ||
| > | rom source_app IN $HighValueNotifApps$ (banking, auth, messa | ||||
| > | ging) while AppState=background]. Alert on a sequence or sta | ||||
| > | te change inconsistent with the device/app baseline, approve | ||||
| > | d management policy, or expected user workflow; do not infer | ||||
| > | unobserved API calls, file/process activity, or payload con | ||||
| > | tent from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates Android accessibility or UI-automati | t | 1 | For Android, detect Input Injection from documented manageme |
| > | on-capable behavior from an app identity with injected user- | > | nt, network, or vetting evidence; treat state queries as per | ||
| > | interface actions occurring on behalf of the user in another | > | iodic observations rather than real-time events. Correlate A | ||
| > | foreground application. The strongest Android evidence is a | > | pplication State via Android Enterprise / EMM [Managed packa | ||
| > | ccessibility-enabled or similarly privileged app behavior th | > | ge inventory/status and package metadata]; OS API Execution | ||
| > | at triggers programmatic clicks, global actions, or text ins | > | via Application Vetting / Instrumented Dynamic Analysis [Dyn | ||
| > | ertion into another app's active UI, especially when those a | > | amic API/runtime trace: Accessibility-enabled app NOT IN $Ac | ||
| > | ctions occur without matching user touch interaction, while | > | cessibilityAllowList$ invokes performAction() click, global | ||
| > | the injecting app is backgrounded or foreground-service-only | > | action (GLOBAL_ACTION_BACK/HOME/RECENTS), or insertText() on | ||
| > | , or when the target foreground app belongs to a sensitive c | > | a UI element belonging to a different foregrounded app \u2014 cr | ||
| > | ategory such as banking, payments, identity, communications, | > | oss-app UI action is the]. Alert on a sequence or state chan | ||
| > | or enterprise access. The detection is strengthened when th | > | ge inconsistent with the device/app baseline, approved manag | ||
| > | e injected input sequence is followed by target-app navigati | > | ement policy, or expected user workflow; do not infer unobse | ||
| > | on, form submission, transaction progression, or network act | > | rved API calls, file/process activity, or payload content fr | ||
| > | ivity from the target context. | > | om management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for pseudo-randomly generated domain names based on | t | 1 | For Android, detect Dynamic Resolution by correlating analys |
| > | frequency analysis, Markov chains, entropy, proportion of di | > | t-visible device/network evidence and management state; use | ||
| > | ctionary words, ratio of vowels to other characters, and mor | > | streaming or batched telemetry only where the documented col | ||
| > | e.(Citation: Data Driven Security DGA) Additionally, check i | > | lector is deployed. Correlate API Calls via Application Vett | ||
| > | f the suspicious domain has been recently registered, if it | > | ing / Instrumented Dynamic Analysis [Dynamic API/runtime tra | ||
| > | has been rarely visited, or if the domain had a spike in act | > | ce: InetAddress.getByName() or DnsResolver called > $DGACand | ||
| > | ivity after being dormant.(Citation: unit42_strat_aged_domai | > | idateThreshold$ times with algorithmically-distinct hostname | ||
| > | n_det) Content delivery network (CDN) domains may trigger th | > | s in $DGAWindow$ \u2014 rapid programmatic resolution attempts]; | ||
| > | ese detections due to the format of their domain names. | > | Network Connection Creation via Android Enterprise Network L | ||
| > | ogging / Enterprise VPN [DevicePolicyManager.retrieveNetwork | ||||
| > | Logs(): DnsEvent / ConnectEvent; VPN flow metadata]; Network | ||||
| > | Traffic Flow via Android Enterprise Network Logging / Enter | ||||
| > | prise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEve | ||||
| > | nt / ConnectEvent; VPN flow metadata]. Alert on a sequence o | ||||
| > | r state change inconsistent with the device/app baseline, ap | ||||
| > | proved management policy, or expected user workflow; do not | ||||
| > | infer unobserved API calls, file/process activity, or payloa | ||||
| > | d content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for pseudo-randomly generated domain names based on | t | 1 | For iOS, detect Dynamic Resolution by correlating analyst-vi |
| > | frequency analysis, Markov chains, entropy, proportion of di | > | sible device/network evidence and management state; use stre | ||
| > | ctionary words, ratio of vowels to other characters, and mor | > | aming or batched telemetry only where the documented collect | ||
| > | e.(Citation: Data Driven Security DGA) Additionally, check i | > | or is deployed. Correlate Application Permission via Applica | ||
| > | f the suspicious domain has been recently registered, if it | > | tion Vetting [Code-signing entitlements and Info.plist priva | ||
| > | has been rarely visited, or if the domain had a spike in act | > | cy usage-description keys]; Network Connection Creation via | ||
| > | ivity after being dormant.(Citation: unit42_strat_aged_domai | > | Apple Network Extension / Enterprise VPN [NEFilterFlow / per | ||
| > | n_det) Content delivery network (CDN) domains may trigger th | > | -app VPN / secure-web-gateway flow metadata]; Network Traffi | ||
| > | ese detections due to the format of their domain names. | > | c Flow via Apple Network Extension / Enterprise VPN [NEFilte | ||
| > | rFlow / per-app VPN / secure-web-gateway flow metadata]. Ale | ||||
| > | rt on a sequence or state change inconsistent with the devic | ||||
| > | e/app baseline, approved management policy, or expected user | ||||
| > | workflow; do not infer unobserved API calls, file/process a | ||||
| > | ctivity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A defender correlates navigation to external web content in | t | 1 | For Android, detect Drive-By Compromise by correlating analy |
| > | a browser or embedded WebView with immediate script-heavy or | > | st-visible device/network evidence and management state; use | ||
| > | exploit-preparation network activity, followed by abnormal | > | streaming or batched telemetry only where the documented co | ||
| > | browser/WebView process behavior, suspicious file or downloa | > | llector is deployed. Correlate File Creation via Application | ||
| > | d artifacts, or rapid post-visit capability shifts such as n | > | Vetting / Forensic Acquisition [Dynamic filesystem trace or | ||
| > | ew package install attempts, overlay prompts, permission req | > | acquired app-container/filesystem artifacts: open() with O_ | ||
| > | uests, or outbound command traffic inconsistent with normal | > | CREAT for APK or binary file in /sdcard/ or /data/local/tmp/ | ||
| > | browsing. | > | by browser process within $DriveByWindow$ \u2014 payload drop co | ||
| > | nfirms exploit code execution]; Network Traffic Content via | ||||
| > | Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspectio | ||||
| > | n or proxy transaction metadata where enterprise decryption/ | ||||
| > | inspection is deployed]; Process Creation via Application Ve | ||||
| > | tting / Managed Device Telemetry [execve()]. Alert on a sequ | ||||
| > | ence or state change inconsistent with the device/app baseli | ||||
| > | ne, approved management policy, or expected user workflow; d | ||||
| > | o not infer unobserved API calls, file/process activity, or | ||||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A defender correlates Safari or embedded web content navigat | t | 1 | For iOS, detect Drive-By Compromise by correlating analyst-v |
| > | ion with short-lived but abnormal web session behavior such | > | isible device/network evidence and management state; use str | ||
| > | as staged redirects, environment fingerprinting, or exploit- | > | eaming or batched telemetry only where the documented collec | ||
| > | preparation fetches, followed by browser/WebView instability | > | tor is deployed. Correlate Network Connection Creation via A | ||
| > | , unusual file handling, profile/download prompts, or near-t | > | pple Network Extension / Enterprise VPN [NEFilterFlow / per- | ||
| > | erm changes in device or application behavior inconsistent w | > | app VPN / secure-web-gateway flow metadata]; Network Traffic | ||
| > | ith normal browsing. | > | Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP | ||
| > | (S) inspection or proxy transaction metadata where enterpris | ||||
| > | e decryption/inspection is deployed]; Process Creation via A | ||||
| > | pplication Vetting / Managed Device Telemetry [com.apple.Web | ||||
| > | Kit or com.apple.WebContent process fault at level=fault wit | ||||
| > | hin $DriveByWindow$ of navigation to flagged URL \u2014 kernel fa | ||||
| > | ult in WebKit subsystem is the exploit-execution signal]. Al | ||||
| > | ert on a sequence or state change inconsistent with the devi | ||||
| > | ce/app baseline, approved management policy, or expected use | ||||
| > | r workflow; do not infer unobserved API calls, file/process | ||||
| > | activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates an app-attributed request to a legit | t | 1 | For Android, detect Dead Drop Resolver by correlating analys |
| > | imate public web platform with a subsequent outbound connect | > | t-visible device/network evidence and management state; use | ||
| > | ion to a newly derived or previously unseen destination with | > | streaming or batched telemetry only where the documented col | ||
| > | in a short time window. The behavior is strengthened when th | > | lector is deployed. Correlate Application Permission via And | ||
| > | e initial request retrieves structured or encoded content fo | > | roid Enterprise DPC / Application Vetting [DevicePolicyManag | ||
| > | llowed by a pivot to a different domain or IP that was not p | > | er.getPermissionGrantState(); PackageManager manifest/reques | ||
| > | reviously contacted by the app, especially when occurring wi | > | ted-permission review]; Application State via Android Enterp | ||
| > | thout user interaction, in background state, or immediately | > | rise / EMM [Managed package inventory/status and package met | ||
| > | after app initialization or scheduled execution. This sequen | > | adata]; Network Traffic Content via Enterprise Secure Web Ga | ||
| > | ce reflects resolver retrieval followed by dynamic C2 resolu | > | teway / Proxy [DNS/HTTP(S) inspection or proxy transaction m | ||
| > | tion. | > | etadata where enterprise decryption/inspection is deployed]. | ||
| > | Alert on a sequence or state change inconsistent with the d | ||||
| > | evice/app baseline, approved management policy, or expected | ||||
| > | user workflow; do not infer unobserved API calls, file/proce | ||||
| > | ss activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates a supervised-device or managed-app r | t | 1 | For iOS, detect Dead Drop Resolver by correlating analyst-vi |
| > | equest to a legitimate web platform with a subsequent connec | > | sible device/network evidence and management state; use stre | ||
| > | tion to a newly derived destination that is not part of the | > | aming or batched telemetry only where the documented collect | ||
| > | expected service interaction. Because iOS has weaker app-lev | > | or is deployed. Correlate Application Permission via Applica | ||
| > | el telemetry, the strongest signal is a network-level sequen | > | tion Vetting [Code-signing entitlements and Info.plist priva | ||
| > | ce where a request to a known public platform is immediately | > | cy usage-description keys]; Application State via Apple MDM | ||
| > | followed by a connection to a different domain or IP, parti | > | [InstalledApplicationList / ManagedApplicationList]; Network | ||
| > | cularly when the device is locked, no recent user interactio | > | Traffic Content via Enterprise Secure Web Gateway / Proxy [ | ||
| > | n occurred, and the bundle is not expected to interact with | > | DNS/HTTP(S) inspection or proxy transaction metadata where e | ||
| > | such downstream infrastructure. | > | nterprise decryption/inspection is deployed]. Alert on a seq | ||
| > | uence or state change inconsistent with the device/app basel | ||||
| > | ine, approved management policy, or expected user workflow; | ||||
| > | do not infer unobserved API calls, file/process activity, or | ||||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | From the defender\u2019s view: an app retrieves opaque code (DEX/ | t | 1 | For Android, detect Download New Code at Runtime by correlat |
| > | SO/JAR/JS) over the network or IPC, writes it into an app-wr | > | ing analyst-visible device/network evidence and management s | ||
| > | itable path, optionally performs verification-bypass behavio | > | tate; use streaming or batched telemetry only where the docu | ||
| > | rs (reflection, addJavascriptInterface exposure, or execmem | > | mented collector is deployed. Correlate File Metadata via Ap | ||
| > | friction), and then loads/executes that code via DexClassLoa | > | plication Vetting / Forensic Acquisition [Dynamic filesystem | ||
| > | der/PathClassLoader, dlopen, or WebView bridge invocation wi | > | trace or acquired app-container/filesystem artifacts: app_v | ||
| > | thin a short window. The analytic correlates Network Content | > | ersion in MDM == prior_version while dynamic code load from | ||
| > | \u2192 File Creation/Modification \u2192 OS API Execution (loader/sys | > | network is observed \u2014 confirms this is not a legitimate upda | ||
| > | call/SELinux friction) \u2192 Module Load (DexClassLoader/dlopen) | > | te]; Module Load via Application Vetting / Instrumented Dyna | ||
| > | and, for WebView paths, Application Log signals of JavaScri | > | mic Analysis [Dynamic API/runtime trace: DexClassLoader() or | ||
| > | pt interface attachment. | > | System.load() or WebView.loadUrl(javascript:) called with c | ||
| > | ontent_source='network_download' within $CodeDownloadWindow$ | ||||
| > | of download event]; Network Connection Creation via Android | ||||
| > | Enterprise Network Logging / Enterprise VPN [DevicePolicyMa | ||||
| > | nager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN fl | ||||
| > | ow metadata]. Alert on a sequence or state change inconsiste | ||||
| > | nt with the device/app baseline, approved management policy, | ||||
| > | or expected user workflow; do not infer unobserved API call | ||||
| > | s, file/process activity, or payload content from management | ||||
| > | state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | From the defender\u2019s view: a sandboxed app retrieves code-lik | t | 1 | For iOS, detect Download New Code at Runtime by correlating |
| > | e content (JS/Mach-O/bundles), writes it to container tmp/Ca | > | analyst-visible device/network evidence and management state | ||
| > | ches, performs memory permission changes (RW\u2192RX/RWX) or dire | > | ; use streaming or batched telemetry only where the document | ||
| > | ctly loads via dyld/dlopen from writable paths, sometimes pr | > | ed collector is deployed. Correlate Application Permission v | ||
| > | eceded by 3rd-party hotpatch frameworks (e.g., JSPatch-like | > | ia Application Vetting [Code-signing entitlements and Info.p | ||
| > | behavior) or script engine evaluation. The analytic correlat | > | list privacy usage-description keys]; Network Traffic Conten | ||
| > | es Network Content \u2192 File Creation \u2192 OS API Execution (memor | > | t via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) ins | ||
| > | y permission change) \u2192 Module Load (dyld/dlopen) and/or Proc | > | pection or proxy transaction metadata where enterprise decry | ||
| > | ess Access (codesign validation touches), with optional scri | > | ption/inspection is deployed]; Network Traffic Flow via Appl | ||
| > | pting engine events. | > | e Network Extension / Enterprise VPN [NEFilterFlow / per-app | ||
| > | VPN / secure-web-gateway flow metadata]. Alert on a sequenc | ||||
| > | e or state change inconsistent with the device/app baseline, | ||||
| > | approved management policy, or expected user workflow; do n | ||||
| > | ot infer unobserved API calls, file/process activity, or pay | ||||
| > | load content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes an application establishing recurrent HTTP | t | 1 | For Android, detect Web Protocols by correlating analyst-vis |
| > | S or FCM-based communication sessions exhibiting structured | > | ible device/network evidence and management state; use strea | ||
| > | cadence, asymmetric request/response sizes, or persistent lo | > | ming or batched telemetry only where the documented collecto | ||
| > | w-volume polling inconsistent with declared application func | > | r is deployed. Correlate API Calls via Application Vetting / | ||
| > | tionality, potentially embedding command data within web pro | > | Instrumented Dynamic Analysis [Dynamic API/runtime trace: F | ||
| > | tocol traffic. | > | irebaseMessaging.getToken() called for project_id NOT IN $FC | ||
| > | MAllowList$ \u2014 rogue FCM project registration is the adversar | ||||
| > | y enabling C2 over Google infrastructure]; Network Connectio | ||||
| > | n Creation via Android Enterprise Network Logging / Enterpri | ||||
| > | se VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent | ||||
| > | / ConnectEvent; VPN flow metadata]; Network Traffic Content | ||||
| > | via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspe | ||||
| > | ction or proxy transaction metadata where enterprise decrypt | ||||
| > | ion/inspection is deployed]. Alert on a sequence or state ch | ||||
| > | ange inconsistent with the device/app baseline, approved man | ||||
| > | agement policy, or expected user workflow; do not infer unob | ||||
| > | served API calls, file/process activity, or payload content | ||||
| > | from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes an application establishing recurrent HTTP | t | 1 | For iOS, detect Web Protocols by correlating analyst-visible |
| > | S or APNS-related communications exhibiting structured caden | > | device/network evidence and management state; use streaming | ||
| > | ce, abnormal session persistence, or notification-triggered | > | or batched telemetry only where the documented collector is | ||
| > | network bursts inconsistent with user interaction patterns o | > | deployed. Correlate API Calls via Application Vetting / Ins | ||
| > | r declared application behavior. | > | trumented Dynamic Analysis [Dynamic API/runtime trace: UNUse | ||
| > | rNotificationCenter or legacy UIApplication.registerForRemot | ||||
| > | eNotifications with Apple Team ID NOT IN $APNSAllowList$ \u2014 r | ||||
| > | ogue APNS sender registration]; Network Connection Creation | ||||
| > | via Apple Network Extension / Enterprise VPN [NEFilterFlow / | ||||
| > | per-app VPN / secure-web-gateway flow metadata]; Network Tr | ||||
| > | affic Content via Enterprise Secure Web Gateway / Proxy [DNS | ||||
| > | /HTTP(S) inspection or proxy transaction metadata where ente | ||||
| > | rprise decryption/inspection is deployed]. Alert on a sequen | ||||
| > | ce or state change inconsistent with the device/app baseline | ||||
| > | , approved management policy, or expected user workflow; do | ||||
| > | not infer unobserved API calls, file/process activity, or pa | ||||
| > | yload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates an app escalating file visibility (permi | t | 1 | For Android, detect Stored Application Data by correlating a |
| > | ssions/flags, legacy storage modes) with enumeration of othe | > | nalyst-visible device/network evidence and management state; | ||
| > | r apps\u2019 storage or exported ContentProviders, followed by bu | > | use streaming or batched telemetry only where the documente | ||
| > | lk reads/copies from target paths (including shared/external | > | d collector is deployed. Correlate Application Permission vi | ||
| > | storage) and optional archive/encode then share/upload. Seq | > | a Android Enterprise DPC / Application Vetting [DevicePolicy | ||
| > | uence: storage capability/permission gain \u2192 target discovery | > | Manager.getPermissionGrantState(); PackageManager manifest/r | ||
| > | (provider queries, directory listing) \u2192 high-volume cross-a | > | equested-permission review]; File Access via Application Vet | ||
| > | pp data reads from writable/shared paths \u2192 archive/encode \u2192 | > | ting / Forensic Acquisition [Dynamic filesystem trace or acq | ||
| > | exfil/share within a short window. | > | uired app-container/filesystem artifacts: open() for read on | ||
| > | path IN /sdcard/ OR on path with file_permissions=777]; Net | ||||
| > | work Traffic Flow via Android Enterprise Network Logging / E | ||||
| > | nterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): Dn | ||||
| > | sEvent / ConnectEvent; VPN flow metadata]. Alert on a sequen | ||||
| > | ce or state change inconsistent with the device/app baseline | ||||
| > | , approved management policy, or expected user workflow; do | ||||
| > | not infer unobserved API calls, file/process activity, or pa | ||||
| > | yload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates attempts to access other apps\u2019 data via | t | 1 | For iOS, detect Stored Application Data by correlating analy |
| > | shared containers (App Groups), Photos/Files providers, past | > | st-visible device/network evidence and management state; use | ||
| > | eboard abuse, or jailbroken cross-container reads, followed | > | streaming or batched telemetry only where the documented co | ||
| > | by aggregation/packaging and optional exfil/share. Sequence: | > | llector is deployed. Correlate Application State via Apple M | ||
| > | capability/consent (TCC/entitlements) \u2192 target discovery (A | > | DM [InstalledApplicationList / ManagedApplicationList]; Host | ||
| > | ppGroup/Photos/Files enumeration, URL schemes) \u2192 bulk read f | > | Status via Apple MDM [DeviceInformation / SecurityInfo / Pr | ||
| > | rom shared/foreign container or provider \u2192 package/encode \u2192 | > | ofileList / restrictions and compliance queries]; Network Tr | ||
| > | exfil/share. | > | affic Flow via Apple Network Extension / Enterprise VPN [NEF | ||
| > | ilterFlow / per-app VPN / secure-web-gateway flow metadata]. | ||||
| > | Alert on a sequence or state change inconsistent with the d | ||||
| > | evice/app baseline, approved management policy, or expected | ||||
| > | user workflow; do not infer unobserved API calls, file/proce | ||||
| > | ss activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Mobile security products can potentially detect rogue Wi-Fi | t | 1 | For Android, detect Adversary-in-the-Middle by correlating a |
| > | access points if the adversary is attempting to decrypt traf | > | nalyst-visible device/network evidence and management state; | ||
| > | fic using an untrusted SSL certificate. Application vetting | > | use streaming or batched telemetry only where the documente | ||
| > | services should look for applications that request VPN acce | > | d collector is deployed. Correlate File Modification via App | ||
| > | ss. These applications should be heavily scrutinized since V | > | lication Vetting / Forensic Acquisition [Dynamic filesystem | ||
| > | PN functionality is not very common. On both Android and iO | > | trace or acquired app-container/filesystem artifacts: write( | ||
| > | S, the user must grant consent to an application to act as a | > | ) to /sdcard/ path]; Network Traffic Content via Enterprise | ||
| > | VPN. Both platforms also provide visual context to the user | > | Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy | ||
| > | in the top status bar when a VPN connection is active. The | > | transaction metadata where enterprise decryption/inspection | ||
| > | user can see registered VPN services in the device settings. | > | is deployed]; Protected Configuration via Android Enterprise | ||
| > | > | DPC [DevicePolicyManager policy/compliance/security-state q | |||
| > | ueries and SecurityLog events where supported]. Alert on a s | ||||
| > | equence or state change inconsistent with the device/app bas | ||||
| > | eline, approved management policy, or expected user workflow | ||||
| > | ; do not infer unobserved API calls, file/process activity, | ||||
| > | or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Mobile security products can potentially detect rogue Wi-Fi | t | 1 | For iOS, detect Adversary-in-the-Middle by correlating analy |
| > | access points if the adversary is attempting to decrypt traf | > | st-visible device/network evidence and management state; use | ||
| > | fic using an untrusted SSL certificate. Application vetting | > | streaming or batched telemetry only where the documented co | ||
| > | services should look for applications that request VPN acce | > | llector is deployed. Correlate Application Permission via Ap | ||
| > | ss. These applications should be heavily scrutinized since V | > | plication Vetting [Code-signing entitlements and Info.plist | ||
| > | PN functionality is not very common. On both Android and iO | > | privacy usage-description keys]; Network Traffic Content via | ||
| > | S, the user must grant consent to an application to act as a | > | Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspecti | ||
| > | VPN. Both platforms also provide visual context to the user | > | on or proxy transaction metadata where enterprise decryption | ||
| > | in the top status bar when a VPN connection is active. The | > | /inspection is deployed]; Protected Configuration via Apple | ||
| > | user can see registered VPN services in the device settings. | > | MDM [DeviceInformation / SecurityInfo / ProfileList / restri | ||
| > | > | ctions and compliance queries]. Alert on a sequence or state | |||
| > | change inconsistent with the device/app baseline, approved | ||||
| > | management policy, or expected user workflow; do not infer u | ||||
| > | nobserved API calls, file/process activity, or payload conte | ||||
| > | nt from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Remote access software typically requires many privileged pe | t | 1 | For Android, detect Remote Access Software by correlating an |
| > | rmissions, such as accessibility services or device administ | > | alyst-visible device/network evidence and management state; | ||
| > | rator. | > | use streaming or batched telemetry only where the documented | ||
| > | collector is deployed. Correlate Application Permission via | ||||
| > | Android Enterprise DPC / Application Vetting [DevicePolicyM | ||||
| > | anager.getPermissionGrantState(); PackageManager manifest/re | ||||
| > | quested-permission review]; Network Connection Creation via | ||||
| > | Android Enterprise Network Logging / Enterprise VPN [DeviceP | ||||
| > | olicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; | ||||
| > | VPN flow metadata]; Network Traffic Flow via Android Enterp | ||||
| > | rise Network Logging / Enterprise VPN [DevicePolicyManager.r | ||||
| > | etrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow meta | ||||
| > | data]. Alert on a sequence or state change inconsistent with | ||||
| > | the device/app baseline, approved management policy, or exp | ||||
| > | ected user workflow; do not infer unobserved API calls, file | ||||
| > | /process activity, or payload content from management state | ||||
| > | alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Remote access software typically requires many privileged pe | t | 1 | For iOS, detect Remote Access Software by correlating analys |
| > | rmissions, such as accessibility services or device administ | > | t-visible device/network evidence and management state; use | ||
| > | rator. | > | streaming or batched telemetry only where the documented col | ||
| > | lector is deployed. Correlate Application Permission via App | ||||
| > | lication Vetting [Code-signing entitlements and Info.plist p | ||||
| > | rivacy usage-description keys]; Network Connection Creation | ||||
| > | via Apple Network Extension / Enterprise VPN [NEFilterFlow / | ||||
| > | per-app VPN / secure-web-gateway flow metadata]; Network Tr | ||||
| > | affic Flow via Apple Network Extension / Enterprise VPN [NEF | ||||
| > | ilterFlow / per-app VPN / secure-web-gateway flow metadata]. | ||||
| > | Alert on a sequence or state change inconsistent with the d | ||||
| > | evice/app baseline, approved management policy, or expected | ||||
| > | user workflow; do not infer unobserved API calls, file/proce | ||||
| > | ss activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for applications att | t | 1 | For Android, detect System Checks by correlating analyst-vis |
| > | empting to get `android.os.SystemProperties` or `getprop` wi | > | ible device/network evidence and management state; use strea | ||
| > | th the runtime `exec()` commands. This could indicate some l | > | ming or batched telemetry only where the documented collecto | ||
| > | evel of sandbox evasion, as Google recommends against using | > | r is deployed. Correlate API Calls via Application Vetting / | ||
| > | system properties within applications. | > | Instrumented Dynamic Analysis [Dynamic API/runtime trace: g | ||
| > | etNetworkInterfaces() OR NetworkInterface.getHardwareAddress | ||||
| > | () called within $ProcReadWindow$ of /proc reads by same app | ||||
| > | \u2014 network MAC OUI check completes hardware fingerprint]; Fi | ||||
| > | le Access via Application Vetting / Forensic Acquisition [Dy | ||||
| > | namic filesystem trace or acquired app-container/filesystem | ||||
| > | artifacts: open() for read on /proc/cpuinfo]; Network Connec | ||||
| > | tion Creation via Android Enterprise Network Logging / Enter | ||||
| > | prise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEve | ||||
| > | nt / ConnectEvent; VPN flow metadata]. Alert on a sequence o | ||||
| > | r state change inconsistent with the device/app baseline, ap | ||||
| > | proved management policy, or expected user workflow; do not | ||||
| > | infer unobserved API calls, file/process activity, or payloa | ||||
| > | d content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for applications att | t | 1 | For iOS, detect System Checks by correlating analyst-visible |
| > | empting to get `android.os.SystemProperties` or `getprop` wi | > | device/network evidence and management state; use streaming | ||
| > | th the runtime `exec()` commands. This could indicate some l | > | or batched telemetry only where the documented collector is | ||
| > | evel of sandbox evasion, as Google recommends against using | > | deployed. Correlate API Calls via Application Vetting / Ins | ||
| > | system properties within applications. | > | trumented Dynamic Analysis [Dynamic API/runtime trace: UIDev | ||
| > | ice.currentDevice.model]; Application State via Apple MDM [I | ||||
| > | nstalledApplicationList / ManagedApplicationList]; Network C | ||||
| > | onnection Creation via Apple Network Extension / Enterprise | ||||
| > | VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow me | ||||
| > | tadata]. Alert on a sequence or state change inconsistent wi | ||||
| > | th the device/app baseline, approved management policy, or e | ||||
| > | xpected user workflow; do not infer unobserved API calls, fi | ||||
| > | le/process activity, or payload content from management stat | ||||
| > | e alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | When vetting applications for potential security weaknesses, | t | 1 | For Android, detect URI Hijacking by correlating analyst-vis |
| > | the vetting process could look for insecure use of Intents. | > | ible device/network evidence and management state; use strea | ||
| > | Defenders should validate the entirety of the URI. For exam | > | ming or batched telemetry only where the documented collecto | ||
| > | ple, the URI's scheme should be `https` and the URI's host s | > | r is deployed. Correlate API Calls via Application Vetting / | ||
| > | hould be on a list of trusted hosts.(Citation: Android_Unsaf | > | Instrumented Dynamic Analysis [Dynamic API/runtime trace: P | ||
| > | eURILoading_Sept2024) Developers should be encouraged to us | > | ackageManager reports two or more apps with identical URI sc | ||
| > | e techniques to ensure that the intent can only be sent to a | > | heme intent-filter]; Application Permission via Android Ente | ||
| > | n appropriate destination (e.g., use explicit rather than im | > | rprise DPC / Application Vetting [DevicePolicyManager.getPer | ||
| > | plicit intents, permission checking, checking of the destina | > | missionGrantState(); PackageManager manifest/requested-permi | ||
| > | tion app's signing certificate, or utilizing the App Links f | > | ssion review]; Network Traffic Content via Enterprise Secure | ||
| > | eature). For mobile applications using OAuth, encourage use | > | Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transa | ||
| > | of best practice.(Citation: IETF-OAuthNativeApps)(Citation: | > | ction metadata where enterprise decryption/inspection is dep | ||
| > | Android-AppLinks) On Android, users may be presented with a | > | loyed]. Alert on a sequence or state change inconsistent wit | ||
| > | popup to select the appropriate application to open the URI | > | h the device/app baseline, approved management policy, or ex | ||
| > | in. If the user sees an application they do not recognize, | > | pected user workflow; do not infer unobserved API calls, fil | ||
| > | they can remove it. | > | e/process activity, or payload content from management state | ||
| > | alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | When vetting applications for potential security weaknesses, | t | 1 | For iOS, detect URI Hijacking by correlating analyst-visible |
| > | the vetting process could look for insecure use of Intents. | > | device/network evidence and management state; use streaming | ||
| > | Developers should be encouraged to use techniques to ensu | > | or batched telemetry only where the documented collector is | ||
| > | re that the intent can only be sent to an appropriate destin | > | deployed. Correlate Application Permission via Application | ||
| > | ation (e.g., use explicit rather than implicit intents, perm | > | Vetting [Code-signing entitlements and Info.plist privacy us | ||
| > | ission checking, checking of the destination app's signing c | > | age-description keys]; Network Connection Creation via Apple | ||
| > | ertificate, or utilizing the App Links feature). For mobile | > | Network Extension / Enterprise VPN [NEFilterFlow / per-app | ||
| > | applications using OAuth, encourage use of best practice.(Ci | > | VPN / secure-web-gateway flow metadata]; Network Traffic Con | ||
| > | tation: IETF-OAuthNativeApps)(Citation: SecureAuth_iOSOAuth_ | > | tent via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) | ||
| > | 2025) | > | inspection or proxy transaction metadata where enterprise de | ||
| > | cryption/inspection is deployed]. Alert on a sequence or sta | ||||
| > | te change inconsistent with the device/app baseline, approve | ||||
| > | d management policy, or expected user workflow; do not infer | ||||
| > | unobserved API calls, file/process activity, or payload con | ||||
| > | tent from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | On Android, the user can review which applications have Devi | t | 1 | For Android, detect Endpoint Denial of Service by correlatin |
| > | ce Administrator access in the device settings and revoke pe | > | g analyst-visible device/network evidence and management sta | ||
| > | rmission where appropriate. Application vetting services ca | > | te; use streaming or batched telemetry only where the docume | ||
| > | n detect and closely scrutinize applications that utilize De | > | nted collector is deployed. Correlate API Calls via Applicat | ||
| > | vice Administrator access. | > | ion Vetting / Instrumented Dynamic Analysis [Dynamic API/run | ||
| > | time trace: DevicePolicyManager.lockNow() or resetPassword() | ||||
| > | called by caller NOT IN $MDMAgentPackageList$]; Application | ||||
| > | Permission via Android Enterprise DPC / Application Vetting | ||||
| > | [DevicePolicyManager.getPermissionGrantState(); PackageMana | ||||
| > | ger manifest/requested-permission review]; Host Status via A | ||||
| > | ndroid Enterprise DPC [DevicePolicyManager policy/compliance | ||||
| > | /security-state queries and SecurityLog events where support | ||||
| > | ed]. Alert on a sequence or state change inconsistent with t | ||||
| > | he device/app baseline, approved management policy, or expec | ||||
| > | ted user workflow; do not infer unobserved API calls, file/p | ||||
| > | rocess activity, or payload content from management state al | ||||
| > | one. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | On Android, the user can review which applications have Devi | t | 1 | For iOS, detect Endpoint Denial of Service from documented m |
| > | ce Administrator access in the device settings and revoke pe | > | anagement, network, or vetting evidence; treat state queries | ||
| > | rmission where appropriate. Application vetting services ca | > | as periodic observations rather than real-time events. Corr | ||
| > | n detect and closely scrutinize applications that utilize De | > | elate Application Permission via Application Vetting [Code-s | ||
| > | vice Administrator access. | > | igning entitlements and Info.plist privacy usage-description | ||
| > | keys]; Host Status via Apple MDM [DeviceInformation / Secur | ||||
| > | ityInfo / ProfileList / restrictions and compliance queries] | ||||
| > | . Alert on a sequence or state change inconsistent with the | ||||
| > | device/app baseline, approved management policy, or expected | ||||
| > | user workflow; do not infer unobserved API calls, file/proc | ||||
| > | ess activity, or payload content from management state alone | ||||
| > | . |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An app or app update arrives through an expected delivery pa | t | 1 | For Android, detect Supply Chain Compromise by correlating a |
| > | th or presents as a known legitimate package identity, but i | > | nalyst-visible device/network evidence and management state; | ||
| > | ts post-install or post-update behavior materially changes i | > | use streaming or batched telemetry only where the documente | ||
| > | n ways inconsistent with its historical role. The defender c | > | d collector is deployed. Correlate Application Permission vi | ||
| > | orrelates package identity and install/update context, newly | > | a Android Enterprise DPC / Application Vetting [DevicePolicy | ||
| > | expanded capability state, changed runtime framework use, n | > | Manager.getPermissionGrantState(); PackageManager manifest/r | ||
| > | ew sensor or storage behaviors, and new network destinations | > | equested-permission review]; Application State via Android E | ||
| > | shortly after installation or update to identify likely sup | > | nterprise / EMM [Managed package inventory/status and packag | ||
| > | ply-chain compromise rather than ordinary malicious sideload | > | e metadata]; OS API Execution via Application Vetting / Inst | ||
| > | ing or unrelated post-compromise activity. | > | rumented Dynamic Analysis [Dynamic API/runtime trace: Known | ||
| > | application begins first-seen or expanded use of content pro | ||||
| > | viders, account services, accessibility, or network destinat | ||||
| > | ions not in $AppBehaviorBaseline$ post-update]. Alert on a s | ||||
| > | equence or state change inconsistent with the device/app bas | ||||
| > | eline, approved management policy, or expected user workflow | ||||
| > | ; do not infer unobserved API calls, file/process activity, | ||||
| > | or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A managed or supervised app, app update, or enterprise-distr | t | 1 | For iOS, detect Supply Chain Compromise from documented mana |
| > | ibuted build retains a legitimate-seeming identity but exhib | > | gement, network, or vetting evidence; treat state queries as | ||
| > | its post-delivery behavior inconsistent with its expected ro | > | periodic observations rather than real-time events. Correla | ||
| > | le, prior version, or distribution context. Because iOS expo | > | te Application Permission via Application Vetting [Code-sign | ||
| > | ses less direct visibility into bundled dependency tampering | > | ing entitlements and Info.plist privacy usage-description ke | ||
| > | or component-level supply-chain insertion, the defender pri | > | ys]; Application State via Apple MDM [InstalledApplicationLi | ||
| > | oritizes supervised app inventory, signing/provisioning trus | > | st / ManagedApplicationList]; OS API Execution via Applicati | ||
| > | t posture, entitlement and behavior drift after update, new | > | on Vetting / Instrumented Dynamic Analysis [Dynamic API/runt | ||
| > | sensor/resource use, and new downstream network effects soon | > | ime trace: Known app begins first-seen use of protected fram | ||
| > | after install or version change. | > | ework categories (location, microphone, contacts) or backgro | ||
| > | und task patterns post-update]. Alert on a sequence or state | ||||
| > | change inconsistent with the device/app baseline, approved | ||||
| > | management policy, or expected user workflow; do not infer u | ||||
| > | nobserved API calls, file/process activity, or payload conte | ||||
| > | nt from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Network traffic analysis may reveal processes communicating | t | 1 | For Android, detect Exploitation for Client Execution by cor |
| > | with malicious domains. | > | relating analyst-visible device/network evidence and managem | ||
| > | ent state; use streaming or batched telemetry only where the | ||||
| > | documented collector is deployed. Correlate Host Status via | ||||
| > | Android Enterprise DPC [DevicePolicyManager policy/complian | ||||
| > | ce/security-state queries and SecurityLog events where suppo | ||||
| > | rted]; Network Connection Creation via Android Enterprise Ne | ||||
| > | twork Logging / Enterprise VPN [DevicePolicyManager.retrieve | ||||
| > | NetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; | ||||
| > | Process Creation via Application Vetting / Managed Device Te | ||||
| > | lemetry [execve()]. Alert on a sequence or state change inco | ||||
| > | nsistent with the device/app baseline, approved management p | ||||
| > | olicy, or expected user workflow; do not infer unobserved AP | ||||
| > | I calls, file/process activity, or payload content from mana | ||||
| > | gement state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Network traffic analysis may reveal processes communicating | t | 1 | For iOS, detect Exploitation for Client Execution by correla |
| > | with malicious domains. | > | ting analyst-visible device/network evidence and management | ||
| > | state; use streaming or batched telemetry only where the doc | ||||
| > | umented collector is deployed. Correlate Host Status via App | ||||
| > | le MDM [DeviceInformation / SecurityInfo / ProfileList / res | ||||
| > | trictions and compliance queries]; Network Connection Creati | ||||
| > | on via Apple Network Extension / Enterprise VPN [NEFilterFlo | ||||
| > | w / per-app VPN / secure-web-gateway flow metadata]; Process | ||||
| > | Creation via Application Vetting / Managed Device Telemetry | ||||
| > | [com.apple.WebContent or com.apple.imagent process shows un | ||||
| > | expected child spawn or memory fault at level=fault in Unifi | ||||
| > | ed Log \u2014 kernel fault in message-processing subsystem is exp | ||||
| > | loit execution signal]. Alert on a sequence or state change | ||||
| > | inconsistent with the device/app baseline, approved manageme | ||||
| > | nt policy, or expected user workflow; do not infer unobserve | ||||
| > | d API calls, file/process activity, or payload content from | ||||
| > | management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) activation of Device Administrator privileges | t | 1 | For Android, detect Device Administrator Permissions from do |
| > | by an application, (2) absence or mismatch of legitimate us | > | cumented management, network, or vetting evidence; treat sta | ||
| > | er interaction during the approval flow, and (3) immediate e | > | te queries as periodic observations rather than real-time ev | ||
| > | xecution of administrator-level control actions (e.g., passw | > | ents. Correlate Application Permission via Android Enterpris | ||
| > | ord reset, device lock, policy enforcement, prevention of un | > | e DPC / Application Vetting [DevicePolicyManager.getPermissi | ||
| > | install). The defender observes a causal chain where an appl | > | onGrantState(); PackageManager manifest/requested-permission | ||
| > | ication transitions into a privileged device control role an | > | review]; OS API Execution via Application Vetting / Instrum | ||
| > | d rapidly exercises those capabilities outside expected user | > | ented Dynamic Analysis [Dynamic API/runtime trace: App invok | ||
| > | -driven patterns. Application vetting services can check fo | > | es DevicePolicyManager.resetPassword(), lockNow(), wipeData( | ||
| > | r the string `BIND_DEVICE_ADMIN` in the application\u2019s manife | > | ), or setCameraDisabled() immediately after Device Admin act | ||
| > | st. | > | ivation without MDM-initiated policy context or user interac | ||
| > | tion]. Alert on a sequence or state change inconsistent with | ||||
| > | the device/app baseline, approved management policy, or exp | ||||
| > | ected user workflow; do not infer unobserved API calls, file | ||||
| > | /process activity, or payload content from management state | ||||
| > | alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates proxy-capable network setup or socke | t | 1 | For Android, detect Proxy Through Victim by correlating anal |
| > | t-handling behavior with subsequent bidirectional traffic re | > | yst-visible device/network evidence and management state; us | ||
| > | laying through the same device and app context, especially w | > | e streaming or batched telemetry only where the documented c | ||
| > | hen inbound client sessions are followed by outbound connect | > | ollector is deployed. Correlate Application Permission via A | ||
| > | ions to unrelated remote destinations or when the device sus | > | ndroid Enterprise DPC / Application Vetting [DevicePolicyMan | ||
| > | tains multiplexed traffic patterns inconsistent with normal | > | ager.getPermissionGrantState(); PackageManager manifest/requ | ||
| > | mobile app workflows. The analytic prioritizes Android-obser | > | ested-permission review]; Network Traffic Content via Enterp | ||
| > | vable effects: proxy or raw-socket setup, app background exe | > | rise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or p | ||
| > | cution, inbound-to-outbound traffic bridging, and sustained | > | roxy transaction metadata where enterprise decryption/inspec | ||
| > | relayed flows to multiple destinations without recent user i | > | tion is deployed]; Network Traffic Flow via Android Enterpri | ||
| > | nteraction. | > | se Network Logging / Enterprise VPN [DevicePolicyManager.ret | ||
| > | rieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metada | ||||
| > | ta]. Alert on a sequence or state change inconsistent with t | ||||
| > | he device/app baseline, approved management policy, or expec | ||||
| > | ted user workflow; do not infer unobserved API calls, file/p | ||||
| > | rocess activity, or payload content from management state al | ||||
| > | one. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes an app (package/UID) repeatedly retrieving | t | 1 | For Android, detect System Network Configuration Discovery b |
| > | network interface configuration attributes (local IP/MAC/in | > | y correlating analyst-visible device/network evidence and ma | ||
| > | terface names, active network capabilities, link properties, | > | nagement state; use streaming or batched telemetry only wher | ||
| > | proxy/DNS settings, or carrier identifiers when permitted) | > | e the documented collector is deployed. Correlate API Calls | ||
| > | in a short time window, without corresponding user network-m | > | via Application Vetting / Instrumented Dynamic Analysis [Dyn | ||
| > | anagement activity. The pattern is characterized by OS API e | > | amic API/runtime trace: NetworkInterface.getNetworkInterface | ||
| > | xecution for interface/config reads combined with background | > | s()]; Application State via Android Enterprise / EMM [Manage | ||
| > | state, permission/role context (e.g., device owner/profile | > | d package inventory/status and package metadata]; Network Co | ||
| > | owner/carrier/default-SMS), and optional follow-on connectiv | > | nnection Creation via Android Enterprise Network Logging / E | ||
| > | ity tests (gateway/DNS/proxy reachability). Correlate across | > | nterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): Dn | ||
| > | API execution + app state + (optional) local probe to ident | > | sEvent / ConnectEvent; VPN flow metadata]. Alert on a sequen | ||
| > | ify automated network configuration discovery rather than ro | > | ce or state change inconsistent with the device/app baseline | ||
| > | utine connectivity checks. | > | , approved management policy, or expected user workflow; do | ||
| > | not infer unobserved API calls, file/process activity, or pa | ||||
| > | yload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for usage of the `RE | t | 1 | For iOS, detect System Network Configuration Discovery by co |
| > | AD_PRIVILEGED_PHONE_STATE` Android permission. This could in | > | rrelating analyst-visible device/network evidence and manage | ||
| > | dicate that non-system apps are attempting to access informa | > | ment state; use streaming or batched telemetry only where th | ||
| > | tion that they do not have access to. | > | e documented collector is deployed. Correlate Application St | ||
| > | ate via Apple MDM [InstalledApplicationList / ManagedApplica | ||||
| > | tionList]; Host Status via Apple MDM [DeviceInformation / Se | ||||
| > | curityInfo / ProfileList / restrictions and compliance queri | ||||
| > | es]; Network Traffic Flow via Apple Network Extension / Ente | ||||
| > | rprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway | ||||
| > | flow metadata]. Alert on a sequence or state change inconsis | ||||
| > | tent with the device/app baseline, approved management polic | ||||
| > | y, or expected user workflow; do not infer unobserved API ca | ||||
| > | lls, file/process activity, or payload content from manageme | ||||
| > | nt state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | OLD: Monitor for API calls that are related to the AccountMa | t | 1 | For Android, detect Accounts by correlating analyst-visible |
| > | nager API on Android and Keychain services on iOS. Applicati | > | device/network evidence and management state; use streaming | ||
| > | on vetting services may look for `MANAGE_ACCOUNTS` in an And | > | or batched telemetry only where the documented collector is | ||
| > | roid application\u2019s manifest. Most applications do not need a | > | deployed. Correlate API Calls via Application Vetting / Inst | ||
| > | ccess to accounts, so extra scrutiny may be applied to those | > | rumented Dynamic Analysis [Dynamic API/runtime trace: Accoun | ||
| > | that request it. NEW: A defender observes an Android appli | > | tManager.getAccounts() OR getAccountsByType() called > $Acco | ||
| > | cation invoking the AccountManager API. | > | untEnumThreshold$ times within $AccountEnumWindow$ by app NO | ||
| > | T IN $ApprovedAuthenticatorApps$]; Network Traffic Flow via | ||||
| > | Android Enterprise Network Logging / Enterprise VPN [DeviceP | ||||
| > | olicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; | ||||
| > | VPN flow metadata]; Permissions Request via Android Enterpr | ||||
| > | ise DPC / Application Vetting [DevicePolicyManager.getPermis | ||||
| > | sionGrantState(); PackageManager manifest/requested-permissi | ||||
| > | on review]. Alert on a sequence or state change inconsistent | ||||
| > | with the device/app baseline, approved management policy, o | ||||
| > | r expected user workflow; do not infer unobserved API calls, | ||||
| > | file/process activity, or payload content from management s | ||||
| > | tate alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for API calls that are related to the AccountManager | t | 1 | For iOS, detect Accounts by correlating analyst-visible devi |
| > | API on Android and Keychain services on iOS. Application ve | > | ce/network evidence and management state; use streaming or b | ||
| > | tting services may look for `MANAGE_ACCOUNTS` in an Android | > | atched telemetry only where the documented collector is depl | ||
| > | application\u2019s manifest. Most applications do not need access | > | oyed. Correlate API Calls via Application Vetting / Instrume | ||
| > | to accounts, so extra scrutiny may be applied to those that | > | nted Dynamic Analysis [Dynamic API/runtime trace: SecItemCop | ||
| > | request it. | > | yMatching() called with kSecMatchLimitAll]; Application Perm | ||
| > | ission via Application Vetting [Code-signing entitlements an | ||||
| > | d Info.plist privacy usage-description keys]; Network Traffi | ||||
| > | c Content via Enterprise Secure Web Gateway / Proxy [DNS/HTT | ||||
| > | P(S) inspection or proxy transaction metadata where enterpri | ||||
| > | se decryption/inspection is deployed]. Alert on a sequence o | ||||
| > | r state change inconsistent with the device/app baseline, ap | ||||
| > | proved management policy, or expected user workflow; do not | ||||
| > | infer unobserved API calls, file/process activity, or payloa | ||||
| > | d content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes an app (package/UID) repeatedly querying d | t | 1 | For Android, detect System Network Connections Discovery by |
| > | evice networking context APIs (Wi-Fi scan results/current SS | > | correlating analyst-visible device/network evidence and mana | ||
| > | ID/BSSID, Bluetooth device discovery, or cellular tower list | > | gement state; use streaming or batched telemetry only where | ||
| > | s) at a rate or timing inconsistent with the app\u2019s normal UX | > | the documented collector is deployed. Correlate API Calls vi | ||
| > | , often while backgrounded. Correlate API calls with permiss | > | a Application Vetting / Instrumented Dynamic Analysis [Dynam | ||
| > | ion usage (fine location, nearby devices/Bluetooth) and conc | > | ic API/runtime trace: WifiInfo.getBSSID()]; Network Connecti | ||
| > | urrent connectivity probes (DNS lookups/ARP/port reachabilit | > | on Creation via Android Enterprise Network Logging / Enterpr | ||
| > | y) to distinguish automated discovery from user-initiated se | > | ise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent | ||
| > | ttings checks. The detection is based on observed API execut | > | / ConnectEvent; VPN flow metadata]; Permissions Request via | ||
| > | ion + permission use + rate/sequence, not the specific API m | > | Android Enterprise DPC / Application Vetting [DevicePolicyM | ||
| > | ethod name. | > | anager.getPermissionGrantState(); PackageManager manifest/re | ||
| > | quested-permission review]. Alert on a sequence or state cha | ||||
| > | nge inconsistent with the device/app baseline, approved mana | ||||
| > | gement policy, or expected user workflow; do not infer unobs | ||||
| > | erved API calls, file/process activity, or payload content f | ||||
| > | rom management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates foreground service start or promotio | t | 1 | For Android, detect Foreground Persistence by correlating an |
| > | n activity with persistent-notification presentation, long-l | > | alyst-visible device/network evidence and management state; | ||
| > | ived application execution, and continued access to while-in | > | use streaming or batched telemetry only where the documented | ||
| > | -use sensors or network activity outside expected user-drive | > | collector is deployed. Correlate Application State via Andr | ||
| > | n context. The analytic looks for an application invoking fo | > | oid Enterprise / EMM [Managed package inventory/status and p | ||
| > | reground service APIs, sustaining a foreground state longer | > | ackage metadata]; OS API Execution via Application Vetting / | ||
| > | than expected for its declared role, and retaining camera, m | > | Instrumented Dynamic Analysis [Dynamic API/runtime trace: A | ||
| > | icrophone, location, or other sensor access while the device | > | pp invokes startForegroundService() or startForeground() NOT | ||
| > | is locked, the app lacks recent interaction, or the notific | > | IN $ApprovedForegroundServiceApps$]; System Settings via An | ||
| > | ation identity/function does not match the application\u2019s beh | > | droid Enterprise DPC [DevicePolicyManager policy/compliance/ | ||
| > | avior. | > | security-state queries and SecurityLog events where supporte | ||
| > | d]. Alert on a sequence or state change inconsistent with th | ||||
| > | e device/app baseline, approved management policy, or expect | ||||
| > | ed user workflow; do not infer unobserved API calls, file/pr | ||||
| > | ocess activity, or payload content from management state alo | ||||
| > | ne. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) application access to or staging of local fil | t | 1 | For Android, detect File Deletion from documented management |
| > | es likely to be of operational, evidentiary, or user value, | > | , network, or vetting evidence; treat state queries as perio | ||
| > | (2) deletion of those files or wipe-like destructive actions | > | dic observations rather than real-time events. Correlate App | ||
| > | through ordinary storage access, administrative controls, o | > | lication Permission via Android Enterprise DPC / Application | ||
| > | r privileged/rooted paths, and (3) continued app or device a | > | Vetting [DevicePolicyManager.getPermissionGrantState(); Pac | ||
| > | ctivity after deletion, including cleanup, concealment, or o | > | kageManager manifest/requested-permission review]; File Dele | ||
| > | utbound transfer. The defender observes a causal chain where | > | tion via Application Vetting / Forensic Acquisition [Dynamic | ||
| > | files are first accessed or prepared, then removed, and dev | > | filesystem trace or acquired app-container/filesystem artif | ||
| > | ice-side behavior continues after evidence or data is gone. | > | acts: App deletes, truncates, or removes files that were rec | ||
| > | ently written by the same app (collected data, staged exfil | ||||
| > | artifacts, operation logs) within $PostExfilCleanupWindow$ o | ||||
| > | f network upload event \u2014 post-exfil cleanup chain]; OS API E | ||||
| > | xecution via Application Vetting / Instrumented Dynamic Anal | ||||
| > | ysis [Dynamic API/runtime trace: App invokes file management | ||||
| > | , storage-clear, or wipe operations in background state foll | ||||
| > | owing network upload without user-initiated delete action]. | ||||
| > | Alert on a sequence or state change inconsistent with the de | ||||
| > | vice/app baseline, approved management policy, or expected u | ||||
| > | ser workflow; do not infer unobserved API calls, file/proces | ||||
| > | s activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates an Android-specific causal chain where d | t | 1 | For Android, detect Network Denial of Service by correlating |
| > | evice connectivity degrades or oscillates across one or more | > | analyst-visible device/network evidence and management stat | ||
| > | radios, applications lose or repeatedly reattempt network a | > | e; use streaming or batched telemetry only where the documen | ||
| > | ccess, and the radio or network failure pattern is inconsist | > | ted collector is deployed. Correlate Application Permission | ||
| > | ent with ordinary mobility, coverage transition, or user-ini | > | via Android Enterprise DPC / Application Vetting [DevicePoli | ||
| > | tiated airplane mode behavior. The defender correlates radio | > | cyManager.getPermissionGrantState(); PackageManager manifest | ||
| > | state, connectivity framework behavior, application state, | > | /requested-permission review]; OS API Execution via Applicat | ||
| > | network session failures, and location/network-provider degr | > | ion Vetting / Instrumented Dynamic Analysis [Dynamic API/run | ||
| > | adation to distinguish network denial effects from routine w | > | time trace: ConnectivityManager, TelephonyManager, or WifiMa | ||
| > | eak-signal conditions. | > | nager framework callbacks report repeated failure, disable, | ||
| > | or oscillation events outside expected coverage-transition p | ||||
| > | attern]; Protected Configuration via Android Enterprise DPC | ||||
| > | [DevicePolicyManager policy/compliance/security-state querie | ||||
| > | s and SecurityLog events where supported]. Alert on a sequen | ||||
| > | ce or state change inconsistent with the device/app baseline | ||||
| > | , approved management policy, or expected user workflow; do | ||||
| > | not infer unobserved API calls, file/process activity, or pa | ||||
| > | yload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates an iOS-specific reduced-confidence chain | t | 1 | For iOS, detect Network Denial of Service from documented ma |
| > | where a managed or supervised device remains active but exp | > | nagement, network, or vetting evidence; treat state queries | ||
| > | eriences abrupt loss of network-dependent functionality, rep | > | as periodic observations rather than real-time events. Corre | ||
| > | eated session failure, or sustained communication inability | > | late Application State via Apple MDM [InstalledApplicationLi | ||
| > | without matching configuration changes or ordinary user acti | > | st / ManagedApplicationList]; Protected Configuration via Ap | ||
| > | on. Because direct radio-layer and RF-cause visibility is we | > | ple MDM [DeviceInformation / SecurityInfo / ProfileList / re | ||
| > | aker on iOS, the defender emphasizes device posture, applica | > | strictions and compliance queries]; System Settings via Appl | ||
| > | tion wake or foreground behavior during service loss, protec | > | e MDM [DeviceInformation / SecurityInfo / ProfileList / rest | ||
| > | ted network-policy stability, and downstream failure pattern | > | rictions and compliance queries]. Alert on a sequence or sta | ||
| > | s observed in VPN or proxy telemetry. | > | te change inconsistent with the device/app baseline, approve | ||
| > | d management policy, or expected user workflow; do not infer | ||||
| > | unobserved API calls, file/process activity, or payload con | ||||
| > | tent from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) changes to application visibility or user-fac | t | 1 | For Android, detect Hide Artifacts from documented managemen |
| > | ing presence such as launcher component disablement, icon su | > | t, network, or vetting evidence; treat state queries as peri | ||
| > | ppression, or reduced discoverability, (2) continued applica | > | odic observations rather than real-time events. Correlate Ap | ||
| > | tion execution or privileged framework activity after that v | > | plication Permission via Android Enterprise DPC / Applicatio | ||
| > | isibility reduction, and (3) follow-on behavior such as back | > | n Vetting [DevicePolicyManager.getPermissionGrantState(); Pa | ||
| > | ground network communication, sensor access, or persistence- | > | ckageManager manifest/requested-permission review]. Alert on | ||
| > | related state transitions. The defender observes a causal ch | > | a sequence or state change inconsistent with the device/app | ||
| > | ain where an application becomes less visible to the user wh | > | baseline, approved management policy, or expected user work | ||
| > | ile retaining or increasing operational activity. | > | flow; do not infer unobserved API calls, file/process activi | ||
| > | ty, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An application performs explicit cryptographic operations (e | t | 1 | For Android, detect Encrypted Channel from documented manage |
| > | .g., symmetric/asymmetric encryption routines) on locally co | > | ment, network, or vetting evidence; treat state queries as p | ||
| > | llected or generated data, followed by structured outbound n | > | eriodic observations rather than real-time events. Correlate | ||
| > | etwork communication that does not align with expected appli | > | Application Permission via Android Enterprise DPC / Applica | ||
| > | cation behavior, particularly when occurring in the backgrou | > | tion Vetting [DevicePolicyManager.getPermissionGrantState(); | ||
| > | nd or without user interaction. Detection correlates crypto | > | PackageManager manifest/requested-permission review]; Appli | ||
| > | API usage + data staging + application state + network trans | > | cation State via Android Enterprise / EMM [Managed package i | ||
| > | mission patterns. | > | nventory/status and package metadata]; File Creation via App | ||
| > | lication Vetting / Forensic Acquisition [Dynamic filesystem | ||||
| > | trace or acquired app-container/filesystem artifacts: App wr | ||||
| > | ites high-entropy blob (Shannon entropy > $EntropyThreshold$ | ||||
| > | ) to local staging path immediately before outbound transmis | ||||
| > | sion \u2014 encrypted staging artifact confirms app-layer encrypt | ||||
| > | ion occurred]. Alert on a sequence or state change inconsist | ||||
| > | ent with the device/app baseline, approved management policy | ||||
| > | , or expected user workflow; do not infer unobserved API cal | ||||
| > | ls, file/process activity, or payload content from managemen | ||||
| > | t state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) application interaction with elevation contro | t | 1 | For Android, detect Abuse Elevation Control Mechanism from d |
| > | l mechanisms (e.g., Accessibility Service, Device Admin, ove | > | ocumented management, network, or vetting evidence; treat st | ||
| > | rlay permissions, package installer flows), (2) rapid transi | > | ate queries as periodic observations rather than real-time e | ||
| > | tion to elevated capability state without expected user inte | > | vents. Correlate Application Permission via Android Enterpri | ||
| > | raction patterns, and (3) immediate privileged actions such | > | se DPC / Application Vetting [DevicePolicyManager.getPermiss | ||
| > | as sensor access, UI manipulation, or background persistence | > | ionGrantState(); PackageManager manifest/requested-permissio | ||
| > | . The defender observes a causal chain where an application | > | n review]; OS API Execution via Application Vetting / Instru | ||
| > | gains elevated privileges through abuse of system-controlled | > | mented Dynamic Analysis [Dynamic API/runtime trace: App invo | ||
| > | consent flows and subsequently performs actions inconsisten | > | kes privileged framework APIs (accessibility performAction, | ||
| > | t with normal user-driven authorization. | > | WindowManager.addView TYPE_APPLICATION_OVERLAY, PackageInsta | ||
| > | ller) immediately after acquiring elevation control mechanis | ||||
| > | m without expected user settings navigation time]. Alert on | ||||
| > | a sequence or state change inconsistent with the device/app | ||||
| > | baseline, approved management policy, or expected user workf | ||||
| > | low; do not infer unobserved API calls, file/process activit | ||||
| > | y, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | From the defender view: an app registers a clipboard listene | t | 1 | For Android, detect Clipboard Data by correlating analyst-vi |
| > | r or calls ClipboardManager getters; the app is (a) foregrou | > | sible device/network evidence and management state; use stre | ||
| > | nd, (b) the default IME, or (c) abusing legacy paths. Shortl | > | aming or batched telemetry only where the documented collect | ||
| > | y after each clipboard change, the app reads the primary cli | > | or is deployed. Correlate API Calls via Application Vetting | ||
| > | p repeatedly, optionally persists content (local file/DB) an | > | / Instrumented Dynamic Analysis [Dynamic API/runtime trace: | ||
| > | d/or exfiltrates it. We correlate: listener/clip-access \u2192 pr | > | ClipboardManager.addOnPrimaryClipChangedListener()]; Applica | ||
| > | ivilege/foreground confirmation \u2192 bursty reads \u2192 local write | > | tion State via Android Enterprise / EMM [Managed package inv | ||
| > | and/or network egress within a tight window. | > | entory/status and package metadata]; Network Connection Crea | ||
| > | tion via Android Enterprise Network Logging / Enterprise VPN | ||||
| > | [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / Conn | ||||
| > | ectEvent; VPN flow metadata]. Alert on a sequence or state c | ||||
| > | hange inconsistent with the device/app baseline, approved ma | ||||
| > | nagement policy, or expected user workflow; do not infer uno | ||||
| > | bserved API calls, file/process activity, or payload content | ||||
| > | from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | From the defender view: an app accesses UIPasteboard content | t | 1 | For iOS, detect Clipboard Data by correlating analyst-visibl |
| > | s, sometimes repeatedly, including in background or immediat | > | e device/network evidence and management state; use streamin | ||
| > | ely after another app copies sensitive text. iOS 14+ shows u | > | g or batched telemetry only where the documented collector i | ||
| > | ser notifications when pasting cross-app; unified logs refle | > | s deployed. Correlate API Calls via Application Vetting / In | ||
| > | ct pasteboard access, notification, and optional subsequent | > | strumented Dynamic Analysis [Dynamic API/runtime trace: UIPa | ||
| > | persistence/exfil. We correlate: pasteboard access \u2192 optiona | > | steboard.general.string property accessed by app]; Network C | ||
| > | l cross-app notification \u2192 local write (cache/DB) and/or net | > | onnection Creation via Apple Network Extension / Enterprise | ||
| > | work egress within a short window. | > | VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow me | ||
| > | tadata]; System Notifications via Managed App Telemetry / Ap | ||||
| > | ple MDM [ManagedApplicationFeedback or application-generated | ||||
| > | telemetry]. Alert on a sequence or state change inconsisten | ||||
| > | t with the device/app baseline, approved management policy, | ||||
| > | or expected user workflow; do not infer unobserved API calls | ||||
| > | , file/process activity, or payload content from management | ||||
| > | state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | From the defender view: a sandboxed process receives/creates | t | 1 | For iOS, detect Software Packing by correlating analyst-visi |
| > | a high-entropy Mach-O/bundle or encrypted segment, performs | > | ble device/network evidence and management state; use stream | ||
| > | in-memory decrypt/unpack (mmap/mprotect RW\u2192RX or RWX), opti | > | ing or batched telemetry only where the documented collector | ||
| > | onally drops a transient image in app-writable dirs, then lo | > | is deployed. Correlate Application Permission via Applicati | ||
| > | ads it through dyld/dlopen or spawns it. We correlate: (1) o | > | on Vetting [Code-signing entitlements and Info.plist privacy | ||
| > | paque blob write/arrival \u2192 (2) kernel memory protection chan | > | usage-description keys]; Network Traffic Flow via Apple Net | ||
| > | ges \u2192 (3) dyld/dlopen from app-writable path or posix_spawn | > | work Extension / Enterprise VPN [NEFilterFlow / per-app VPN | ||
| > | of a recently created image \u2192 (4) (optional) code-sign evalu | > | / secure-web-gateway flow metadata]; Protected Configuration | ||
| > | ation anomalies for the new image. | > | via Apple MDM [DeviceInformation / SecurityInfo / ProfileLi | ||
| > | st / restrictions and compliance queries]. Alert on a sequen | ||||
| > | ce or state change inconsistent with the device/app baseline | ||||
| > | , approved management policy, or expected user workflow; do | ||||
| > | not infer unobserved API calls, file/process activity, or pa | ||||
| > | yload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | From the defender view: a sandboxed app handles a high-entro | t | 1 | For Android, detect Software Packing by correlating analyst- |
| > | py executable blob, performs rapid decode/decrypt in memory | > | visible device/network evidence and management state; use st | ||
| > | (often with RW\u2192RX or execmem friction), optionally emits a t | > | reaming or batched telemetry only where the documented colle | ||
| > | ransient .dex/.so into app-writable paths, then immediately | > | ctor is deployed. Correlate File Metadata via Application Ve | ||
| > | loads/executes it (DexClassLoader/dlopen) or spawns a helper | > | tting / Forensic Acquisition [Dynamic filesystem trace or ac | ||
| > | . We correlate: (1) opaque blob write/arrival \u2192 (2) decode/u | > | quired app-container/filesystem artifacts: DEX file entropy | ||
| > | npack or memory protection change \u2192 (3) new code artifact or | > | > $PackerEntropyThreshold$ at install time for app NOT IN $M | ||
| > | byte[] class definition \u2192 (4) dynamic load/exec within a ti | > | DMApprovedCatalog$]; Module Load via Application Vetting / I | ||
| > | ght window. | > | nstrumented Dynamic Analysis [Dynamic API/runtime trace: Dex | ||
| > | ClassLoader() called at runtime with path NOT matching any f | ||||
| > | ile in original APK manifest within $PackerExecWindow$ of ap | ||||
| > | p launch]; Network Connection Creation via Android Enterpris | ||||
| > | e Network Logging / Enterprise VPN [DevicePolicyManager.retr | ||||
| > | ieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadat | ||||
| > | a]. Alert on a sequence or state change inconsistent with th | ||||
| > | e device/app baseline, approved management policy, or expect | ||||
| > | ed user workflow; do not infer unobserved API calls, file/pr | ||||
| > | ocess activity, or payload content from management state alo | ||||
| > | ne. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A lock-state transition telemetry, special access or privile | t | 1 | For Android, detect Lockscreen Bypass by correlating analyst |
| > | ged interaction capability, security-sensitive framework use | > | -visible device/network evidence and management state; use s | ||
| > | , and immediate downstream activity while the user-interacti | > | treaming or batched telemetry only where the documented coll | ||
| > | on context is weak or inconsistent. This yields stronger cov | > | ector is deployed. Correlate Application Permission via Andr | ||
| > | erage on Android than iOS. | > | oid Enterprise DPC / Application Vetting [DevicePolicyManage | ||
| > | r.getPermissionGrantState(); PackageManager manifest/request | ||||
| > | ed-permission review]; Application State via Android Enterpr | ||||
| > | ise / EMM [Managed package inventory/status and package meta | ||||
| > | data]; Protected Configuration via Android Enterprise DPC [D | ||||
| > | evicePolicyManager policy/compliance/security-state queries | ||||
| > | and SecurityLog events where supported]. Alert on a sequence | ||||
| > | or state change inconsistent with the device/app baseline, | ||||
| > | approved management policy, or expected user workflow; do no | ||||
| > | t infer unobserved API calls, file/process activity, or payl | ||||
| > | oad content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates an iOS-specific reduced-confidence chain | t | 1 | For iOS, detect Lockscreen Bypass from documented management |
| > | where a supervised or managed device transitions from locke | > | , network, or vetting evidence; treat state queries as perio | ||
| > | d or inactive state to interactive or application-active sta | > | dic observations rather than real-time events. Correlate App | ||
| > | te with weak evidence of expected user authentication, often | > | lication State via Apple MDM [InstalledApplicationList / Man | ||
| > | accompanied by abnormal protected posture change, trust-sta | > | agedApplicationList]; Protected Configuration via Apple MDM | ||
| > | te change, unexpected app wake, sensor use, or immediate dow | > | [DeviceInformation / SecurityInfo / ProfileList / restrictio | ||
| > | nstream communication. Because direct visibility into locksc | > | ns and compliance queries]. Alert on a sequence or state cha | ||
| > | reen bypass mechanics on iOS is limited, the analytic priori | > | nge inconsistent with the device/app baseline, approved mana | ||
| > | tizes strong device-state effects and post-unlock behavior r | > | gement policy, or expected user workflow; do not infer unobs | ||
| > | ather than pretending to observe the exact bypass method. | > | erved API calls, file/process activity, or payload content f | ||
| > | rom management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates application TLS trust customization | t | 1 | For Android, detect SSL Pinning by correlating analyst-visib |
| > | activity with subsequent outbound encrypted sessions that by | > | le device/network evidence and management state; use streami | ||
| > | pass enterprise interception visibility or fail only under e | > | ng or batched telemetry only where the documented collector | ||
| > | nterprise inspection conditions. The analytic looks for an a | > | is deployed. Correlate Application Permission via Android En | ||
| > | pp establishing its own certificate or public-key trust logi | > | terprise DPC / Application Vetting [DevicePolicyManager.getP | ||
| > | c, then initiating HTTPS sessions to destinations not aligne | > | ermissionGrantState(); PackageManager manifest/requested-per | ||
| > | d with approved app behavior, especially from background sta | > | mission review]; Application State via Android Enterprise / | ||
| > | te or without recent user interaction. Higher-confidence obs | > | EMM [Managed package inventory/status and package metadata]; | ||
| > | ervations come from Android runtime/framework telemetry show | > | Network Traffic Content via Enterprise Secure Web Gateway / | ||
| > | ing custom trust manager, certificate validation override, o | > | Proxy [DNS/HTTP(S) inspection or proxy transaction metadata | ||
| > | r pin validation logic immediately preceding network connect | > | where enterprise decryption/inspection is deployed]. Alert | ||
| > | ion attempts, combined with network evidence of failed-inspe | > | on a sequence or state change inconsistent with the device/a | ||
| > | ction patterns or opaque direct TLS sessions. | > | pp baseline, approved management policy, or expected user wo | ||
| > | rkflow; do not infer unobserved API calls, file/process acti | ||||
| > | vity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates supervised-device application postur | t | 1 | For iOS, detect SSL Pinning by correlating analyst-visible d |
| > | e and background execution context with network-side evidenc | > | evice/network evidence and management state; use streaming o | ||
| > | e that an app rejects enterprise inspection or performs cert | > | r batched telemetry only where the documented collector is d | ||
| > | ificate/public-key-bound trust behavior during TLS establish | > | eployed. Correlate Application Permission via Application Ve | ||
| > | ment. Because direct app-level pin-validation observability | > | tting [Code-signing entitlements and Info.plist privacy usag | ||
| > | is weaker on iOS, the analytic is anchored primarily to netw | > | e-description keys]; Application State via Apple MDM [Instal | ||
| > | ork control-plane effects: repeated TLS handshake rejection | > | ledApplicationList / ManagedApplicationList]; Network Traffi | ||
| > | under enterprise inspection, destination-specific inspection | > | c Content via Enterprise Secure Web Gateway / Proxy [DNS/HTT | ||
| > | bypass patterns, or persistent opaque app-to-endpoint encry | > | P(S) inspection or proxy transaction metadata where enterpri | ||
| > | pted sessions inconsistent with baseline app behavior. Addit | > | se decryption/inspection is deployed]. Alert on a sequence o | ||
| > | ional confidence comes from managed app identity, background | > | r state change inconsistent with the device/app baseline, ap | ||
| > | execution context, and supervised device policy state. | > | proved management policy, or expected user workflow; do not | ||
| > | infer unobserved API calls, file/process activity, or payloa | ||||
| > | d content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates application registration for system | t | 1 | For Android, detect Event Triggered Execution from documente |
| > | event triggers (e.g., broadcast receivers, WorkManager, JobS | > | d management, network, or vetting evidence; treat state quer | ||
| > | cheduler, SMS/BOOT events) with subsequent execution of appl | > | ies as periodic observations rather than real-time events. C | ||
| > | ication code immediately following the triggering event, wit | > | orrelate Application State via Android Enterprise / EMM [Man | ||
| > | hout direct user interaction. Confidence increases when exec | > | aged package inventory/status and package metadata]; OS API | ||
| > | ution occurs in background or locked state, is tied to sensi | > | Execution via Application Vetting / Instrumented Dynamic Ana | ||
| > | tive triggers (SMS received, boot completed, connectivity ch | > | lysis [Dynamic API/runtime trace: App registers BroadcastRec | ||
| > | ange), and produces follow-on file or network activity incon | > | eiver or schedules job for system events (BOOT_COMPLETED, SM | ||
| > | sistent with the application\u2019s expected role. | > | S_RECEIVED, ACTION_PACKAGE_REPLACED, CONNECTIVITY_CHANGE, AC | ||
| > | TION_USER_PRESENT) NOT IN $ApprovedEventTriggerApps$ \u2014 sensi | ||||
| > | tive system event registration is ]. Alert on a sequence or | ||||
| > | state change inconsistent with the device/app baseline, appr | ||||
| > | oved management policy, or expected user workflow; do not in | ||||
| > | fer unobserved API calls, file/process activity, or payload | ||||
| > | content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates anomalous application package replac | t | 1 | For Android, detect Compromise Application Executable from d |
| > | ement, update, or executable-content drift with subsequent e | > | ocumented management, network, or vetting evidence; treat st | ||
| > | xecution under the trusted application's identity, especiall | > | ate queries as periodic observations rather than real-time e | ||
| > | y when package metadata, signing lineage, install source, fi | > | vents. Correlate Application Permission via Android Enterpri | ||
| > | le integrity, or native/DEX component characteristics change | > | se DPC / Application Vetting [DevicePolicyManager.getPermiss | ||
| > | without a corresponding trusted distribution path. The anal | > | ionGrantState(); PackageManager manifest/requested-permissio | ||
| > | ytic prioritizes Android-observable control-plane effects: p | > | n review]; Application State via Android Enterprise / EMM [M | ||
| > | ackage install/update events, package hash or code-section d | > | anaged package inventory/status and package metadata]; File | ||
| > | rift, signer mismatch or lineage break, unexpected app proce | > | Creation via Application Vetting / Forensic Acquisition [Dyn | ||
| > | ss behavior after replacement, and optional near-term networ | > | amic filesystem trace or acquired app-container/filesystem a | ||
| > | k or sensor activity inconsistent with the legitimate applic | > | rtifacts: APK, DEX, or native library written to app install | ||
| > | ation's baseline. | > | ation path outside MDM-authorized update mechanism \u2014 binary | ||
| > | replacement is the persistence artifact]. Alert on a sequenc | ||||
| > | e or state change inconsistent with the device/app baseline, | ||||
| > | approved management policy, or expected user workflow; do n | ||||
| > | ot infer unobserved API calls, file/process activity, or pay | ||||
| > | load content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Detects indirect evidence of host-side indicator removal by | t | 1 | For iOS, detect Indicator Removal on Host from documented ma |
| > | correlating (1) local artifact creation or compromise-state- | > | nagement, network, or vetting evidence; treat state queries | ||
| > | relevant activity, (2) later disappearance, alteration, or r | > | as periodic observations rather than real-time events. Corre | ||
| > | eporting loss for those artifacts or state indicators, and ( | > | late Application Permission via Application Vetting [Code-si | ||
| > | 3) continued application or device activity under reduced vi | > | gning entitlements and Info.plist privacy usage-description | ||
| > | sibility. Because iOS provides weaker direct visibility into | > | keys]; OS API Execution via Application Vetting / Instrument | ||
| > | some Android-style artifact and jailbreak-indicator manipul | > | ed Dynamic Analysis [Dynamic API/runtime trace: App invokes | ||
| > | ation patterns, the defender relies more on app-private arti | > | file deletion, container-local database truncation, or cache | ||
| > | fact lifecycle changes, managed posture shifts, and continue | > | -clear operations on supervised device within $CleanupWindow | ||
| > | d runtime or network activity after expected evidence disapp | > | $ of prior data access or upload event]; System Settings via | ||
| > | ears. | > | Apple MDM [DeviceInformation / SecurityInfo / ProfileList / | ||
| > | restrictions and compliance queries]. Alert on a sequence o | ||||
| > | r state change inconsistent with the device/app baseline, ap | ||||
| > | proved management policy, or expected user workflow; do not | ||||
| > | infer unobserved API calls, file/process activity, or payloa | ||||
| > | d content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) application activity that creates, modifies, | t | 1 | For Android, detect Indicator Removal on Host by correlating |
| > | or accesses local artifacts relevant to detection or device | > | analyst-visible device/network evidence and management stat | ||
| > | compromise state, (2) subsequent deletion, alteration, renam | > | e; use streaming or batched telemetry only where the documen | ||
| > | ing, relocation, or visibility suppression of those artifact | > | ted collector is deployed. Correlate Application Permission | ||
| > | s, including files, application presence, media, or root-com | > | via Android Enterprise DPC / Application Vetting [DevicePoli | ||
| > | promise indicators, and (3) continued application execution, | > | cyManager.getPermissionGrantState(); PackageManager manifest | ||
| > | reduced telemetry quality, or outbound activity after the a | > | /requested-permission review]; OS API Execution via Applicat | ||
| > | rtifact state changes. The defender observes a causal chain | > | ion Vetting / Instrumented Dynamic Analysis [Dynamic API/run | ||
| > | where host-side evidence is first manipulated and expected v | > | time trace: App invokes file deletion, database truncation, | ||
| > | isibility or reporting degrades while the initiating applica | > | log clearing, or app-data-clear operations within $CleanupWi | ||
| > | tion remains active. | > | ndow$ of prior data access or network exfiltration event \u2014 p | ||
| > | ost-exfil cleanup chain]; System Settings via Android Enterp | ||||
| > | rise DPC [DevicePolicyManager policy/compliance/security-sta | ||||
| > | te queries and SecurityLog events where supported]. Alert on | ||||
| > | a sequence or state change inconsistent with the device/app | ||||
| > | baseline, approved management policy, or expected user work | ||||
| > | flow; do not infer unobserved API calls, file/process activi | ||||
| > | ty, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services may detect when an application | t | 1 | For Android, detect Application Versioning by correlating an |
| > | requests permissions after an application update. Applicatio | > | alyst-visible device/network evidence and management state; | ||
| > | n vetting services may look for indications that the applica | > | use streaming or batched telemetry only where the documented | ||
| > | tion\u2019s update includes malicious code at runtime. Applicati | > | collector is deployed. Correlate File Modification via Appl | ||
| > | on vetting services may be able to list domains and/or IP ad | > | ication Vetting / Forensic Acquisition [Dynamic filesystem t | ||
| > | dresses that applications communicate with. | > | race or acquired app-container/filesystem artifacts: app ver | ||
| > | sion change detected in MDM inventory for app_package \u2014 upda | ||||
| > | te is the binary modification event]; Network Connection Cre | ||||
| > | ation via Android Enterprise Network Logging / Enterprise VP | ||||
| > | N [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / Con | ||||
| > | nectEvent; VPN flow metadata]; Permissions Request via Andro | ||||
| > | id Enterprise DPC / Application Vetting [DevicePolicyManager | ||||
| > | .getPermissionGrantState(); PackageManager manifest/requeste | ||||
| > | d-permission review]. Alert on a sequence or state change in | ||||
| > | consistent with the device/app baseline, approved management | ||||
| > | policy, or expected user workflow; do not infer unobserved | ||||
| > | API calls, file/process activity, or payload content from ma | ||||
| > | nagement state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services may detect when an application | t | 1 | For iOS, detect Application Versioning by correlating analys |
| > | requests permissions after an application update. Applicatio | > | t-visible device/network evidence and management state; use | ||
| > | n vetting services may look for indications that the applica | > | streaming or batched telemetry only where the documented col | ||
| > | tion\u2019s update includes malicious code at runtime. Applicati | > | lector is deployed. Correlate File Modification via Applicat | ||
| > | on vetting services may be able to list domains and/or IP ad | > | ion Vetting / Forensic Acquisition [Dynamic filesystem trace | ||
| > | dresses that applications communicate with. | > | or acquired app-container/filesystem artifacts: app version | ||
| > | change in MDM inventory for bundle_id]; Network Connection | ||||
| > | Creation via Apple Network Extension / Enterprise VPN [NEFil | ||||
| > | terFlow / per-app VPN / secure-web-gateway flow metadata]; P | ||||
| > | ermissions Request via Application Vetting [Code-signing ent | ||||
| > | itlements and Info.plist privacy usage-description keys]. Al | ||||
| > | ert on a sequence or state change inconsistent with the devi | ||||
| > | ce/app baseline, approved management policy, or expected use | ||||
| > | r workflow; do not infer unobserved API calls, file/process | ||||
| > | activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) application access to device- or environment- | t | 1 | For Android, detect Execution Guardrails from documented man |
| > | specific attributes used to validate target conditions, (2) | > | agement, network, or vetting evidence; treat state queries a | ||
| > | suppression of sensitive behavior until those attributes mat | > | s periodic observations rather than real-time events. Correl | ||
| > | ch an expected value, and (3) immediate transition into prot | > | ate Application Permission via Android Enterprise DPC / Appl | ||
| > | ected actions such as sensor use, file access, or network co | > | ication Vetting [DevicePolicyManager.getPermissionGrantState | ||
| > | mmunication only after the condition is satisfied. The defen | > | (); PackageManager manifest/requested-permission review]; Ap | ||
| > | der observes a causal chain where an app repeatedly evaluate | > | plication State via Android Enterprise / EMM [Managed packag | ||
| > | s device state or environment context and withholds executio | > | e inventory/status and package metadata]; OS API Execution v | ||
| > | n until a target-specific match occurs. | > | ia Application Vetting / Instrumented Dynamic Analysis [Dyna | ||
| > | mic API/runtime trace: App performs burst of environmental c | ||||
| > | heck APIs (Build properties, TelephonyManager IMSI, PackageM | ||||
| > | anager security-tool query) at cold launch before user inter | ||||
| > | action \u2014 multi-category environment fingerprint is the guard | ||||
| > | rail setup]. Alert on a sequence or state change inconsisten | ||||
| > | t with the device/app baseline, approved management policy, | ||||
| > | or expected user workflow; do not infer unobserved API calls | ||||
| > | , file/process activity, or payload content from management | ||||
| > | state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Detects conditional execution by correlating (1) application | t | 1 | For iOS, detect Execution Guardrails from documented managem |
| > | access to constrained environment signals such as location, | > | ent, network, or vetting evidence; treat state queries as pe | ||
| > | locale, network context, device state, or user interaction | > | riodic observations rather than real-time events. Correlate | ||
| > | timing, (2) prolonged inactivity or feature suppression desp | > | Application Permission via Application Vetting [Code-signing | ||
| > | ite available permissions, and (3) abrupt initiation of high | > | entitlements and Info.plist privacy usage-description keys] | ||
| > | er-risk behavior only when the expected target context is pr | > | ; Application State via Apple MDM [InstalledApplicationList | ||
| > | esent. Because direct observation of some runtime decision l | > | / ManagedApplicationList]; OS API Execution via Application | ||
| > | ogic is weaker on iOS, the defender relies more heavily on l | > | Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime | ||
| > | ifecycle, sensor, and downstream network effects following t | > | trace: App performs UIDevice model + iOS version + enrollme | ||
| > | arget-condition alignment. | > | nt state checks at cold launch before user interaction \u2014 dev | ||
| > | ice fingerprinting guardrail setup]. Alert on a sequence or | ||||
| > | state change inconsistent with the device/app baseline, appr | ||||
| > | oved management policy, or expected user workflow; do not in | ||||
| > | fer unobserved API calls, file/process activity, or payload | ||||
| > | content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates anomalous modifications to boot-time or logon-tim | t | 1 | For Android, detect Boot or Logon Initialization Scripts by |
| > | e initialization artifacts (for example, init.rc, vendor ini | > | correlating analyst-visible device/network evidence and mana | ||
| > | t scripts, app_process or shell hijacks, and malicious BOOT_ | > | gement state; use streaming or batched telemetry only where | ||
| > | COMPLETED BroadcastReceivers) with subsequent unauthorized s | > | the documented collector is deployed. Correlate Application | ||
| > | cript execution after boot. From the defender\u2019s perspective | > | Permission via Android Enterprise DPC / Application Vetting | ||
| > | this appears as integrity or attestation failures on the sys | > | [DevicePolicyManager.getPermissionGrantState(); PackageManag | ||
| > | tem partition, unexpected writes to protected init paths, ne | > | er manifest/requested-permission review]; Host Status via An | ||
| > | w apps registering for boot events, and privileged processes | > | droid Enterprise DPC [DevicePolicyManager policy/compliance/ | ||
| > | invoking scripts or binaries from non-standard locations sh | > | security-state queries and SecurityLog events where supporte | ||
| > | ortly after the device boots. | > | d]; Network Traffic Flow via Android Enterprise Network Logg | ||
| > | ing / Enterprise VPN [DevicePolicyManager.retrieveNetworkLog | ||||
| > | s(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a | ||||
| > | sequence or state change inconsistent with the device/app b | ||||
| > | aseline, approved management policy, or expected user workfl | ||||
| > | ow; do not infer unobserved API calls, file/process activity | ||||
| > | , or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates unauthorized alterations to launchd configuration | t | 1 | For iOS, detect Boot or Logon Initialization Scripts by corr |
| > | (LaunchDaemons/LaunchAgents plists), background execution e | > | elating analyst-visible device/network evidence and manageme | ||
| > | ntitlements, or sideloaded app containers with suspicious au | > | nt state; use streaming or batched telemetry only where the | ||
| > | to-start behavior during device boot or user unlock. From th | > | documented collector is deployed. Correlate Application Perm | ||
| > | e defender\u2019s view this shows up as new or modified plist fil | > | ission via Application Vetting [Code-signing entitlements an | ||
| > | es in launchd directories, launchd starting binaries from no | > | d Info.plist privacy usage-description keys]; Host Status vi | ||
| > | n-Apple or non-AppStore locations, and apps with unexpected | > | a Apple MDM [DeviceInformation / SecurityInfo / ProfileList | ||
| > | background modes that remain active immediately after boot/u | > | / restrictions and compliance queries]; Network Traffic Flow | ||
| > | nlock. | > | via Apple Network Extension / Enterprise VPN [NEFilterFlow | ||
| > | / per-app VPN / secure-web-gateway flow metadata]. Alert on | ||||
| > | a sequence or state change inconsistent with the device/app | ||||
| > | baseline, approved management policy, or expected user workf | ||||
| > | low; do not infer unobserved API calls, file/process activit | ||||
| > | y, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates app-driven shell or command executio | t | 1 | For Android, detect Command and Scripting Interpreter from d |
| > | n setup with subsequent process creation, command invocation | > | ocumented management, network, or vetting evidence; treat st | ||
| > | , or script-driven follow-on behavior under the same app con | > | ate queries as periodic observations rather than real-time e | ||
| > | text, especially when command execution occurs from backgrou | > | vents. Correlate Command Execution via Application Vetting / | ||
| > | nd state, without recent user interaction, or immediately af | > | Instrumented Dynamic Analysis [Dynamic API/runtime trace: A | ||
| > | ter payload retrieval or local staging. The analytic priorit | > | pp spawns sh, bash, toybox, toolbox, or su child process wit | ||
| > | izes Android-observable control-plane effects: Java Runtime | > | h command arguments within $ShellActivityWindow$ of shell la | ||
| > | or similar command-execution method use, shell or sh-like pr | > | unch \u2014 child shell process with arguments is the script exec | ||
| > | ocess creation, command parameter visibility where available | > | ution signal]; Process Creation via Application Vetting / Ma | ||
| > | , and immediate file or network effects produced by the inte | > | naged Device Telemetry [App invokes Runtime.exec(), ProcessB | ||
| > | rpreter. | > | uilder.start(), or JNI-backed command execution framework to | ||
| > | spawn shell or command interpreter process NOT IN $Approved | ||||
| > | ShellApps$ \u2014 programmatic shell spawn is the interpreter inv | ||||
| > | ocation]. Alert on a sequence or state change inconsistent w | ||||
| > | ith the device/app baseline, approved management policy, or | ||||
| > | expected user workflow; do not infer unobserved API calls, f | ||||
| > | ile/process activity, or payload content from management sta | ||||
| > | te alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates managed-app runtime behavior indicat | t | 1 | For iOS, detect Command and Scripting Interpreter from docum |
| > | ive of command or shell invocation with subsequent spawned p | > | ented management, network, or vetting evidence; treat state | ||
| > | rocess or shell-like execution effects, then raises confiden | > | queries as periodic observations rather than real-time event | ||
| > | ce when the resulting activity produces local artifacts or n | > | s. Correlate Command Execution via Application Vetting / Ins | ||
| > | etwork communication outside expected user context. Because | > | trumented Dynamic Analysis [Dynamic API/runtime trace: Shell | ||
| > | direct shell-process visibility can be weaker on iOS in many | > | process (sh, bash) or command-executing child process spawn | ||
| > | enterprise deployments, the analytic anchors first on proce | > | ed under app context on supervised iOS device \u2014 any shell sp | ||
| > | ss-creation or lower-level OS API effects where mobile telem | > | awn on stock iOS indicates jailbreak or kernel exploit]; Pro | ||
| > | etry can observe them, then on lifecycle context and post-ex | > | cess Creation via Application Vetting / Managed Device Telem | ||
| > | ecution network or file behavior. Confidence is strongest wh | > | etry [Managed iOS app invokes lower-level process-launch beh | ||
| > | en the same app shows command invocation followed by process | > | avior or command-execution-equivalent activity outside sandb | ||
| > | execution and immediate follow-on effects. | > | ox-permitted APIs on supervised device]. Alert on a sequence | ||
| > | or state change inconsistent with the device/app baseline, | ||||
| > | approved management policy, or expected user workflow; do no | ||||
| > | t infer unobserved API calls, file/process activity, or payl | ||||
| > | oad content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes an OAuth/OIDC redirect (ACTION_VIEW) resol | t | 1 | For Android, detect Steal Application Access Token by correl |
| > | ved to a non-allowlisted handler package (logcat:IntentResol | > | ating analyst-visible device/network evidence and management | ||
| > | ver), followed within a short window by that same package ac | > | state; use streaming or batched telemetry only where the do | ||
| > | cessing token material via AccountManager/Keystore or readin | > | cumented collector is deployed. Correlate API Calls via Appl | ||
| > | g application token caches under /data/data/<pkg>/(shared_pr | > | ication Vetting / Instrumented Dynamic Analysis [Dynamic API | ||
| > | efs|databases) (logcat:AccountManager, logcat:Keystore, logc | > | /runtime trace: PackageManager.queryIntentActivities() retur | ||
| > | at:FileIO). Correlate on package/UID/profile and time proxim | > | ns handler_count > 1 for custom URI scheme]; Application Per | ||
| > | ity to indicate token acquisition. | > | mission via Android Enterprise DPC / Application Vetting [De | ||
| > | vicePolicyManager.getPermissionGrantState(); PackageManager | ||||
| > | manifest/requested-permission review]; Network Traffic Conte | ||||
| > | nt via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) in | ||||
| > | spection or proxy transaction metadata where enterprise decr | ||||
| > | yption/inspection is deployed]. Alert on a sequence or state | ||||
| > | change inconsistent with the device/app baseline, approved | ||||
| > | management policy, or expected user workflow; do not infer u | ||||
| > | nobserved API calls, file/process activity, or payload conte | ||||
| > | nt from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | When vetting applications for potential security weaknesses, | t | 1 | For iOS, detect Steal Application Access Token by correlatin |
| > | the vetting process could look for insecure use of Intents. | > | g analyst-visible device/network evidence and management sta | ||
| > | Developers should be encouraged to use techniques to ensure | > | te; use streaming or batched telemetry only where the docume | ||
| > | that the intent can only be sent to an appropriate destinat | > | nted collector is deployed. Correlate Application Permission | ||
| > | ion (e.g., use explicit rather than implicit intents, permis | > | via Application Vetting [Code-signing entitlements and Info | ||
| > | sion checking, checking of the destination app's signing cer | > | .plist privacy usage-description keys]; Network Connection C | ||
| > | tificate, or utilizing the App Links feature). For mobile ap | > | reation via Apple Network Extension / Enterprise VPN [NEFilt | ||
| > | plications using OAuth, encourage use of best practice.(Cita | > | erFlow / per-app VPN / secure-web-gateway flow metadata]; Ne | ||
| > | tion: IETF-OAuthNativeApps)(Citation: Android-AppLinks) On A | > | twork Traffic Content via Enterprise Secure Web Gateway / Pr | ||
| > | ndroid, users may be presented with a popup to select the ap | > | oxy [DNS/HTTP(S) inspection or proxy transaction metadata wh | ||
| > | propriate application to open a URI in. If the user sees an | > | ere enterprise decryption/inspection is deployed]. Alert on | ||
| > | application they do not recognize, they can remove it. | > | a sequence or state change inconsistent with the device/app | ||
| > | baseline, approved management policy, or expected user workf | ||||
| > | low; do not infer unobserved API calls, file/process activit | ||||
| > | y, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A defender correlates a sudden carrier identity/service stat | t | 1 | For Android, detect SIM Card Swap by correlating analyst-vis |
| > | e change (SIM/line identifier change or unexpected loss of c | > | ible device/network evidence and management state; use strea | ||
| > | ellular service) with near-term device messaging/telephony d | > | ming or batched telemetry only where the documented collecto | ||
| > | isruption and a concurrent shift in authentication traffic p | > | r is deployed. Correlate Host Status via Android Enterprise | ||
| > | atterns\u2014such as a spike in SMS-based verification flows or a | > | DPC [DevicePolicyManager policy/compliance/security-state qu | ||
| > | ccount recovery activity from the same user\u2019s identities\u2014ind | > | eries and SecurityLog events where supported]; System Settin | ||
| > | icating the user\u2019s number may have been transferred to a dif | > | gs via Android Enterprise DPC [DevicePolicyManager policy/co | ||
| > | ferent SIM/device (SIM swap impact). | > | mpliance/security-state queries and SecurityLog events where | ||
| > | supported]; User Account Authentication via Application Vet | ||||
| > | ting / Identity Provider Telemetry [App authentication flow | ||||
| > | instrumentation or IdP sign-in/audit events]. Alert on a seq | ||||
| > | uence or state change inconsistent with the device/app basel | ||||
| > | ine, approved management policy, or expected user workflow; | ||||
| > | do not infer unobserved API calls, file/process activity, or | ||||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A defender correlates an unexpected change in cellular subsc | t | 1 | For iOS, detect SIM Card Swap by correlating analyst-visible |
| > | ription state (eSIM/SIM profile change, carrier/operator cha | > | device/network evidence and management state; use streaming | ||
| > | nge, or sudden persistent loss of cellular service) with nea | > | or batched telemetry only where the documented collector is | ||
| > | r-term disruption signals and a rapid increase in authentica | > | deployed. Correlate Host Status via Apple MDM [DeviceInform | ||
| > | tion-related network activity consistent with SMS verificati | > | ation / SecurityInfo / ProfileList / restrictions and compli | ||
| > | on or account recovery flows, suggesting the user\u2019s number h | > | ance queries]; System Settings via Apple MDM [DeviceInformat | ||
| > | as been ported to an adversary-controlled SIM/device (SIM sw | > | ion / SecurityInfo / ProfileList / restrictions and complian | ||
| > | ap impact). | > | ce queries]; User Account Authentication via Application Vet | ||
| > | ting / Identity Provider Telemetry [App authentication flow | ||||
| > | instrumentation or IdP sign-in/audit events]. Alert on a seq | ||||
| > | uence or state change inconsistent with the device/app basel | ||||
| > | ine, approved management policy, or expected user workflow; | ||||
| > | do not infer unobserved API calls, file/process activity, or | ||||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for use of standard | t | 1 | For Android, detect Data Manipulation from documented manage |
| > | APIs (e.g. the clipboard API) that could indicate data manip | > | ment, network, or vetting evidence; treat state queries as p | ||
| > | ulation is occurring. | > | eriodic observations rather than real-time events. Correlate | ||
| > | API Calls via Application Vetting / Instrumented Dynamic An | ||||
| > | alysis [Dynamic API/runtime trace: ContentResolver.update() | ||||
| > | called by writer_app NOT IN $LegitimateIPCPartners$ for targ | ||||
| > | et_app's content provider URI]; Application State via Androi | ||||
| > | d Enterprise / EMM [Managed package inventory/status and pac | ||||
| > | kage metadata]; File Modification via Application Vetting / | ||||
| > | Forensic Acquisition [Dynamic filesystem trace or acquired a | ||||
| > | pp-container/filesystem artifacts: ContentResolver.update() | ||||
| > | or write() to path owned by target_app IN $HighValueAppList$ | ||||
| > | by writer_app != target_app \u2014 cross-app data modification]. | ||||
| > | Alert on a sequence or state change inconsistent with the d | ||||
| > | evice/app baseline, approved management policy, or expected | ||||
| > | user workflow; do not infer unobserved API calls, file/proce | ||||
| > | ss activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates an app acquiring input-capture capabilit | t | 1 | For Android, detect Keylogging by correlating analyst-visibl |
| > | y (AccessibilityService enablement or default IME set) with | > | e device/network evidence and management state; use streamin | ||
| > | high-frequency text-change/IME commit callbacks sourced from | > | g or batched telemetry only where the documented collector i | ||
| > | other packages, followed by local keylog persistence and/or | > | s deployed. Correlate API Calls via Application Vetting / In | ||
| > | small, immediate network egress. Chain: capability/permissi | > | strumented Dynamic Analysis [Dynamic API/runtime trace: Acce | ||
| > | on \u2192 intercept (accessibility \u2018TYPE_VIEW_TEXT_CHANGED\u2019 or IM | > | ssibilityEvent.TYPE_VIEW_TEXT_CHANGED received by listener N | ||
| > | E commitText/onStartInput bursts) \u2192 persist to container \u2192 n | > | OT IN $AccessibilityAllowList$ at rate > $KeystrokeEventThre | ||
| > | ear-term egress. | > | shold$ per minute with source_apps spanning > $AppMonitorCou | ||
| > | ntThreshold$ distinct apps]; Network Traffic Content via Ent | ||||
| > | erprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection o | ||||
| > | r proxy transaction metadata where enterprise decryption/ins | ||||
| > | pection is deployed]; Permissions Request via Android Enterp | ||||
| > | rise DPC / Application Vetting [DevicePolicyManager.getPermi | ||||
| > | ssionGrantState(); PackageManager manifest/requested-permiss | ||||
| > | ion review]. Alert on a sequence or state change inconsisten | ||||
| > | t with the device/app baseline, approved management policy, | ||||
| > | or expected user workflow; do not infer unobserved API calls | ||||
| > | , file/process activity, or payload content from management | ||||
| > | state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates a custom keyboard extension activation ( | t | 1 | For iOS, detect Keylogging by correlating analyst-visible de |
| > | optionally with TCC \u2018Full Access\u2019) or abnormal UI text-entry | > | vice/network evidence and management state; use streaming or | ||
| > | interception with local keylog persistence and/or small egr | > | batched telemetry only where the documented collector is de | ||
| > | ess. Chain: capability/consent (keyboard Full Access/TCC) \u2192 | > | ployed. Correlate Application State via Apple MDM [Installed | ||
| > | intercept (keyboard commit events or repeated secure text en | > | ApplicationList / ManagedApplicationList]; Network Traffic F | ||
| > | try edits) \u2192 persist to container \u2192 near-term egress. | > | low via Apple Network Extension / Enterprise VPN [NEFilterFl | ||
| > | ow / per-app VPN / secure-web-gateway flow metadata]; Permis | ||||
| > | sions Request via Application Vetting [Code-signing entitlem | ||||
| > | ents and Info.plist privacy usage-description keys]. Alert o | ||||
| > | n a sequence or state change inconsistent with the device/ap | ||||
| > | p baseline, approved management policy, or expected user wor | ||||
| > | kflow; do not infer unobserved API calls, file/process activ | ||||
| > | ity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes anomalous signaling network queries target | t | 1 | For Android, detect Impersonate SS7 Nodes by correlating ana |
| > | ing subscriber information associated with a device, includi | > | lyst-visible device/network evidence and management state; u | ||
| > | ng unexpected routing requests, location information exchang | > | se streaming or batched telemetry only where the documented | ||
| > | es, or node-origin inconsistencies indicative of SS7 signali | > | collector is deployed. Correlate Network Communication via A | ||
| > | ng abuse. (Citation: CSRIC5-WG10-FinalReport) The CSRIC also | > | ndroid Enterprise Network Logging / Enterprise VPN [DevicePo | ||
| > | suggests threat information sharing between telecommunicati | > | licyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; | ||
| > | ons industry members. | > | VPN flow metadata]; Network Traffic Content via Enterprise S | ||
| > | ecure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy t | ||||
| > | ransaction metadata where enterprise decryption/inspection i | ||||
| > | s deployed]; Network Traffic Flow via Android Enterprise Net | ||||
| > | work Logging / Enterprise VPN [DevicePolicyManager.retrieveN | ||||
| > | etworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. A | ||||
| > | lert on a sequence or state change inconsistent with the dev | ||||
| > | ice/app baseline, approved management policy, or expected us | ||||
| > | er workflow; do not infer unobserved API calls, file/process | ||||
| > | activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes anomalous signaling interactions involving | t | 1 | For iOS, detect Impersonate SS7 Nodes by correlating analyst |
| > | subscriber identity or location resolution events associate | > | -visible device/network evidence and management state; use s | ||
| > | d with a device, including abnormal routing requests, unexpe | > | treaming or batched telemetry only where the documented coll | ||
| > | cted location information exchanges, or signaling node incon | > | ector is deployed. Correlate Network Communication via Apple | ||
| > | sistencies indicative of SS7 abuse. (Citation: CSRIC5-WG10-F | > | Network Extension / Enterprise VPN [NEFilterFlow / per-app | ||
| > | inalReport) The CSRIC also suggests threat information shari | > | VPN / secure-web-gateway flow metadata]; Network Traffic Con | ||
| > | ng between telecommunications industry members. | > | tent via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) | ||
| > | inspection or proxy transaction metadata where enterprise de | ||||
| > | cryption/inspection is deployed]; Network Traffic Flow via A | ||||
| > | pple Network Extension / Enterprise VPN [NEFilterFlow / per- | ||||
| > | app VPN / secure-web-gateway flow metadata]. Alert on a sequ | ||||
| > | ence or state change inconsistent with the device/app baseli | ||||
| > | ne, approved management policy, or expected user workflow; d | ||||
| > | o not infer unobserved API calls, file/process activity, or | ||||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes a mobile device initiating abnormal or exp | t | 1 | For Android, detect Exploitation of Remote Services by corre |
| > | loit-like network interactions with internal or remote servi | > | lating analyst-visible device/network evidence and managemen | ||
| > | ces, followed by process-level instability, privilege bounda | > | t state; use streaming or batched telemetry only where the d | ||
| > | ry shifts, or unexpected execution behaviors indicative of s | > | ocumented collector is deployed. Correlate Application Permi | ||
| > | ervice exploitation outcomes. | > | ssion via Android Enterprise DPC / Application Vetting [Devi | ||
| > | cePolicyManager.getPermissionGrantState(); PackageManager ma | ||||
| > | nifest/requested-permission review]; Application State via A | ||||
| > | ndroid Enterprise / EMM [Managed package inventory/status an | ||||
| > | d package metadata]; Network Connection Creation via Android | ||||
| > | Enterprise Network Logging / Enterprise VPN [DevicePolicyMa | ||||
| > | nager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN fl | ||||
| > | ow metadata]. Alert on a sequence or state change inconsiste | ||||
| > | nt with the device/app baseline, approved management policy, | ||||
| > | or expected user workflow; do not infer unobserved API call | ||||
| > | s, file/process activity, or payload content from management | ||||
| > | state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes a mobile device engaging remote or interna | t | 1 | For iOS, detect Network Service Scanning by correlating anal |
| > | l services with traffic characteristics inconsistent with no | > | yst-visible device/network evidence and management state; us | ||
| > | rmal application behavior, followed by execution anomalies, | > | e streaming or batched telemetry only where the documented c | ||
| > | application instability, or security context deviations cons | > | ollector is deployed. Correlate Application Permission via A | ||
| > | istent with exploitation effects. | > | pplication Vetting [Code-signing entitlements and Info.plist | ||
| > | privacy usage-description keys]; Network Connection Creatio | ||||
| > | n via Apple Network Extension / Enterprise VPN [NEFilterFlow | ||||
| > | / per-app VPN / secure-web-gateway flow metadata]; Network | ||||
| > | Traffic Content via Enterprise Secure Web Gateway / Proxy [D | ||||
| > | NS/HTTP(S) inspection or proxy transaction metadata where en | ||||
| > | terprise decryption/inspection is deployed]. Alert on a sequ | ||||
| > | ence or state change inconsistent with the device/app baseli | ||||
| > | ne, approved management policy, or expected user workflow; d | ||||
| > | o not infer unobserved API calls, file/process activity, or | ||||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | From the defender\u2019s perspective, this strategy correlates si | t | 1 | For Android, detect Exploitation for Privilege Escalation by |
| > | gnals that a previously unprivileged Android app or process | > | correlating analyst-visible device/network evidence and man | ||
| > | has gained higher privileges through exploitation rather tha | > | agement state; use streaming or batched telemetry only where | ||
| > | n normal OS or MDM flows. Observable behaviors include: (1 | > | the documented collector is deployed. Correlate Application | ||
| > | ) unprivileged app processes issuing sensitive syscalls or a | > | Permission via Android Enterprise DPC / Application Vetting | ||
| > | ccessing privileged device interfaces, (2) bursts of SELinu | > | [DevicePolicyManager.getPermissionGrantState(); PackageMana | ||
| > | x denials followed by an unexpected domain or permission cha | > | ger manifest/requested-permission review]; Host Status via A | ||
| > | nge, (3) creation of new processes running with system or r | > | ndroid Enterprise DPC [DevicePolicyManager policy/compliance | ||
| > | oot UID whose lineage traces back to an app sandbox path, an | > | /security-state queries and SecurityLog events where support | ||
| > | d (4) crashes or abnormal restarts of privileged system ser | > | ed]; Network Traffic Flow via Android Enterprise Network Log | ||
| > | vices followed shortly by a new connection or binder interac | > | ging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLo | ||
| > | tion from the same low-privileged app. The focus is on unusu | > | gs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on | ||
| > | al privilege transitions, anomalous process ancestry, and OS | > | a sequence or state change inconsistent with the device/app | ||
| > | security policy violations, not on specific exploit binarie | > | baseline, approved management policy, or expected user workf | ||
| > | s or CVE signatures. | > | low; do not infer unobserved API calls, file/process activit | ||
| > | y, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates app sandbox escape attempts via unsigned binary e | t | 1 | For iOS, detect Exploitation for Privilege Escalation by cor |
| > | xecution, mmap memory permission changes (RWX), and sandbox | > | relating analyst-visible device/network evidence and managem | ||
| > | profile violations. Detection chain includes app leveraging | > | ent state; use streaming or batched telemetry only where the | ||
| > | JIT/JSC to execute shellcode or triggering kernel exploit vi | > | documented collector is deployed. Correlate Host Status via | ||
| > | a crafted IOKit or Mach port abuse. | > | Apple MDM [DeviceInformation / SecurityInfo / ProfileList / | ||
| > | restrictions and compliance queries]; Network Traffic Flow | ||||
| > | via Apple Network Extension / Enterprise VPN [NEFilterFlow / | ||||
| > | per-app VPN / secure-web-gateway flow metadata]; OS API Exe | ||||
| > | cution via Application Vetting / Instrumented Dynamic Analys | ||||
| > | is [Dynamic API/runtime trace: Unified Log entry at level=fa | ||||
| > | ult in subsystem com.apple.kernel or com.apple.sandbox withi | ||||
| > | n $KernelFaultWindow$ of integrity_check failure \u2014 kernel-le | ||||
| > | vel fault coincident with integrity failure is the exploit-e | ||||
| > | xecution signal; requires super]. Alert on a sequence or sta | ||||
| > | te change inconsistent with the device/app baseline, approve | ||||
| > | d management policy, or expected user workflow; do not infer | ||||
| > | unobserved API calls, file/process activity, or payload con | ||||
| > | tent from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Mobile security products can often alert the user if their d | t | 1 | For Android, detect Exploitation for Initial Access by corre |
| > | evice is vulnerable to known exploits. | > | lating analyst-visible device/network evidence and managemen | ||
| > | t state; use streaming or batched telemetry only where the d | ||||
| > | ocumented collector is deployed. Correlate Host Status via A | ||||
| > | ndroid Enterprise DPC [DevicePolicyManager policy/compliance | ||||
| > | /security-state queries and SecurityLog events where support | ||||
| > | ed]; Network Connection Creation via Android Enterprise Netw | ||||
| > | ork Logging / Enterprise VPN [DevicePolicyManager.retrieveNe | ||||
| > | tworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]; Pr | ||||
| > | ocess Creation via Application Vetting / Managed Device Tele | ||||
| > | metry [execve()]. Alert on a sequence or state change incons | ||||
| > | istent with the device/app baseline, approved management pol | ||||
| > | icy, or expected user workflow; do not infer unobserved API | ||||
| > | calls, file/process activity, or payload content from manage | ||||
| > | ment state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Mobile security products can often alert the user if their d | t | 1 | For iOS, detect Exploitation for Initial Access by correlati |
| > | evice is vulnerable to known exploits. | > | ng analyst-visible device/network evidence and management st | ||
| > | ate; use streaming or batched telemetry only where the docum | ||||
| > | ented collector is deployed. Correlate Host Status via Apple | ||||
| > | MDM [DeviceInformation / SecurityInfo / ProfileList / restr | ||||
| > | ictions and compliance queries]; Network Connection Creation | ||||
| > | via Apple Network Extension / Enterprise VPN [NEFilterFlow | ||||
| > | / per-app VPN / secure-web-gateway flow metadata]; Process C | ||||
| > | reation via Application Vetting / Managed Device Telemetry [ | ||||
| > | kernel fault or unexpected child spawn in subsystem IN (com. | ||||
| > | apple.WebKit, com.apple.imtransferagent, com.apple.imagent) | ||||
| > | at level=fault in Unified Log]. Alert on a sequence or state | ||||
| > | change inconsistent with the device/app baseline, approved | ||||
| > | management policy, or expected user workflow; do not infer u | ||||
| > | nobserved API calls, file/process activity, or payload conte | ||||
| > | nt from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An application generates, imports, or accesses asymmetric ke | t | 1 | For Android, detect Asymmetric Cryptography from documented |
| > | ypairs (e.g., RSA/ECC), uses a public key to encrypt outboun | > | management, network, or vetting evidence; treat state querie | ||
| > | d data or establish encrypted sessions, and transmits result | > | s as periodic observations rather than real-time events. Cor | ||
| > | ing ciphertext in structured communication patterns. Detecti | > | relate Application Permission via Android Enterprise DPC / A | ||
| > | on correlates keypair lifecycle activity + asymmetric crypto | > | pplication Vetting [DevicePolicyManager.getPermissionGrantSt | ||
| > | API usage + data transformation + background execution cont | > | ate(); PackageManager manifest/requested-permission review]; | ||
| > | ext + network transmission, especially when inconsistent wit | > | Application State via Android Enterprise / EMM [Managed pac | ||
| > | h expected application functionality. | > | kage inventory/status and package metadata]; File Creation v | ||
| > | ia Application Vetting / Forensic Acquisition [Dynamic files | ||||
| > | ystem trace or acquired app-container/filesystem artifacts: | ||||
| > | App writes asymmetric-encrypted blob or encoded ciphertext t | ||||
| > | o local staging path before network transmission \u2014 encrypted | ||||
| > | staging artifact]. Alert on a sequence or state change inco | ||||
| > | nsistent with the device/app baseline, approved management p | ||||
| > | olicy, or expected user workflow; do not infer unobserved AP | ||||
| > | I calls, file/process activity, or payload content from mana | ||||
| > | gement state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates Android screen-capture-capable behav | t | 1 | For Android, detect Screen Capture from documented managemen |
| > | ior from an app identity with runtime context showing that f | > | t, network, or vetting evidence; treat state queries as peri | ||
| > | oreground content from another app is being captured outside | > | odic observations rather than real-time events. Correlate Ap | ||
| > | expected user-driven workflows. The strongest Android evide | > | plication Permission via Android Enterprise DPC / Applicatio | ||
| > | nce is MediaProjection-like capture initiation, accessibilit | > | n Vetting [DevicePolicyManager.getPermissionGrantState(); Pa | ||
| > | y-assisted observation of foreground UI content, or privileg | > | ckageManager manifest/requested-permission review]; Applicat | ||
| > | ed screencap or screenrecord behavior, followed by screensho | > | ion State via Android Enterprise / EMM [Managed package inve | ||
| > | t or video artifact creation, buffer growth, or outbound tra | > | ntory/status and package metadata]; OS API Execution via App | ||
| > | nsfer. The detection is strengthened when the capturing app | > | lication Vetting / Instrumented Dynamic Analysis [Dynamic AP | ||
| > | is backgrounded, operates as a foreground service without cl | > | I/runtime trace: MediaProjection capture session, accessibil | ||
| > | ear user-driven recording intent, captures while another sen | > | ity-based foreground content observation, or privileged scre | ||
| > | sitive app is foregrounded, runs with accessibility or eleva | > | encap/screenrecord invocation from app while different app i | ||
| > | ted access inconsistent with its role, or performs capture w | > | s foregrounded \u2014 cross-app screen content access]. Alert on | ||
| > | ithout recent user interaction. | > | a sequence or state change inconsistent with the device/app | ||
| > | baseline, approved management policy, or expected user workf | ||||
| > | low; do not infer unobserved API calls, file/process activit | ||||
| > | y, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for pseudo-randomly generated domain names based on | t | 1 | For Android, detect Domain Generation Algorithms by correlat |
| > | frequency analysis, Markov chains, entropy, proportion of di | > | ing analyst-visible device/network evidence and management s | ||
| > | ctionary words, ratio of vowels to other characters, and mor | > | tate; use streaming or batched telemetry only where the docu | ||
| > | e.(Citation: Data Driven Security DGA) Additionally, check i | > | mented collector is deployed. Correlate Application Permissi | ||
| > | f the suspicious domain has been recently registered, if it | > | on via Android Enterprise DPC / Application Vetting [DeviceP | ||
| > | has been rarely visited, or if the domain had a spike in act | > | olicyManager.getPermissionGrantState(); PackageManager manif | ||
| > | ivity after being dormant.(Citation: unit42_strat_aged_domai | > | est/requested-permission review]; Network Traffic Content vi | ||
| > | n_det) Content delivery network (CDN) domains may trigger th | > | a Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspect | ||
| > | ese detections due to the format of their domain names. | > | ion or proxy transaction metadata where enterprise decryptio | ||
| > | n/inspection is deployed]; Network Traffic Flow via Android | ||||
| > | Enterprise Network Logging / Enterprise VPN [DevicePolicyMan | ||||
| > | ager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flo | ||||
| > | w metadata]. Alert on a sequence or state change inconsisten | ||||
| > | t with the device/app baseline, approved management policy, | ||||
| > | or expected user workflow; do not infer unobserved API calls | ||||
| > | , file/process activity, or payload content from management | ||||
| > | state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for pseudo-randomly generated domain names based on | t | 1 | For iOS, detect Domain Generation Algorithms by correlating |
| > | frequency analysis, Markov chains, entropy, proportion of di | > | analyst-visible device/network evidence and management state | ||
| > | ctionary words, ratio of vowels to other characters, and mor | > | ; use streaming or batched telemetry only where the document | ||
| > | e.(Citation: Data Driven Security DGA) Additionally, check i | > | ed collector is deployed. Correlate Application Permission v | ||
| > | f the suspicious domain has been recently registered, if it | > | ia Application Vetting [Code-signing entitlements and Info.p | ||
| > | has been rarely visited, or if the domain had a spike in act | > | list privacy usage-description keys]; Network Traffic Conten | ||
| > | ivity after being dormant.(Citation: unit42_strat_aged_domai | > | t via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) ins | ||
| > | n_det) Content delivery network (CDN) domains may trigger th | > | pection or proxy transaction metadata where enterprise decry | ||
| > | ese detections due to the format of their domain names. | > | ption/inspection is deployed]; Network Traffic Flow via Appl | ||
| > | e Network Extension / Enterprise VPN [NEFilterFlow / per-app | ||||
| > | VPN / secure-web-gateway flow metadata]. Alert on a sequenc | ||||
| > | e or state change inconsistent with the device/app baseline, | ||||
| > | approved management policy, or expected user workflow; do n | ||||
| > | ot infer unobserved API calls, file/process activity, or pay | ||||
| > | load content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates recent access to locally collected o | t | 1 | For Android, detect Archive Collected Data from documented m |
| > | r protected data with subsequent compression, packaging, or | > | anagement, network, or vetting evidence; treat state queries | ||
| > | encryption behavior inside the same app context, followed by | > | as periodic observations rather than real-time events. Corr | ||
| > | creation of archive-like or high-entropy output and optiona | > | elate Application Permission via Android Enterprise DPC / Ap | ||
| > | l near-term network transmission. The analytic prioritizes A | > | plication Vetting [DevicePolicyManager.getPermissionGrantSta | ||
| > | ndroid runtime and storage effects: application data access | > | te(); PackageManager manifest/requested-permission review]; | ||
| > | or sensor-derived collection, compression/encryption framewo | > | File Creation via Application Vetting / Forensic Acquisition | ||
| > | rk use, archive/blob creation in app-accessible storage, and | > | [Dynamic filesystem trace or acquired app-container/filesys | ||
| > | background or device-locked execution inconsistent with the | > | tem artifacts: App reads files across multiple directories o | ||
| > | app\u2019s declared function. | > | r databases in background state (collection phase) then invo | ||
| > | kes archive or compression routines on collected content \u2014 r | ||||
| > | ead-then-archive sequence is the staging chain]; File Creati | ||||
| > | on via Application Vetting / Forensic Acquisition [Dynamic f | ||||
| > | ilesystem trace or acquired app-container/filesystem artifac | ||||
| > | ts: App writes archive-like container, high-entropy packaged | ||||
| > | blob, or .zip/.gz output to app-private or cache path after | ||||
| > | bulk data collection \u2014 archive artifact in private storage | ||||
| > | is the staging evidence]. Alert on a sequence or state chang | ||||
| > | e inconsistent with the device/app baseline, approved manage | ||||
| > | ment policy, or expected user workflow; do not infer unobser | ||||
| > | ved API calls, file/process activity, or payload content fro | ||||
| > | m management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates managed-app data access and lifecycl | t | 1 | For iOS, detect Archive Collected Data from documented manag |
| > | e context with indirect evidence of packaging or encryption | > | ement, network, or vetting evidence; treat state queries as | ||
| > | prior to outbound transfer. Because direct archive/compressi | > | periodic observations rather than real-time events. Correlat | ||
| > | on visibility is generally weaker on iOS, the analytic ancho | > | e Application Permission via Application Vetting [Code-signi | ||
| > | rs on app lifecycle state, file/output effects observable by | > | ng entitlements and Info.plist privacy usage-description key | ||
| > | mobile EDR where available, managed app role via MDM, and d | > | s]; Application State via Apple MDM [InstalledApplicationLis | ||
| > | ownstream network uploads that closely follow creation of ne | > | t / ManagedApplicationList]; File Creation via Application V | ||
| > | w large or high-entropy local artifacts. Confidence is lower | > | etting / Forensic Acquisition [Dynamic filesystem trace or a | ||
| > | when only network effects are available. | > | cquired app-container/filesystem artifacts: App writes large | ||
| > | container, temp package, or high-entropy blob to container- | ||||
| > | local storage after clustered data access \u2014 staged archive a | ||||
| > | rtifact]. Alert on a sequence or state change inconsistent w | ||||
| > | ith the device/app baseline, approved management policy, or | ||||
| > | expected user workflow; do not infer unobserved API calls, f | ||||
| > | ile/process activity, or payload content from management sta | ||||
| > | te alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The user may view applications with administrator access thr | t | 1 | For Android, detect Data Destruction from documented managem |
| > | ough the device settings and may also notice if user data is | > | ent, network, or vetting evidence; treat state queries as pe | ||
| > | inexplicably missing. Command-line activities can potentia | > | riodic observations rather than real-time events. Correlate | ||
| > | lly be detected through Mobile Threat Defense (MTD) integrat | > | Command Execution via Application Vetting / Instrumented Dyn | ||
| > | ions with lower-level OS APIs. This could grant the MTD agen | > | amic Analysis [Dynamic API/runtime trace: pm uninstall OR rm | ||
| > | ts access to running processes and their parameters, potenti | > | -f called by process NOT IN $MDMAgentPackageList$ for packa | ||
| > | ally detecting file deletion processes. The user is prompt | > | ge_count > $BulkUninstallThreshold$ within $DestructionWindo | ||
| > | ed for approval when an application requests device administ | > | w$ \u2014 command-line destruction activity]; File Deletion via A | ||
| > | rator permissions. Application vetting services may detect A | > | pplication Vetting / Forensic Acquisition [Dynamic filesyste | ||
| > | PI calls for deleting files. Mobile security products can | > | m trace or acquired app-container/filesystem artifacts: unli | ||
| > | detect which applications can request device administrator p | > | nk() or rmdir() on path IN /data/data/ OR /data/user/ OR /sd | ||
| > | ermissions. Application vetting services could be extra scru | > | card/ by process NOT IN $MDMAgentPackageList$ at rate > $Del | ||
| > | tinous of applications that request device administrator per | > | etionRateThreshold$ within $DestructionWindow$]; Process Cre | ||
| > | missions. | > | ation via Application Vetting / Managed Device Telemetry [sh | ||
| > | or cmd process spawned with arguments containing 'pm uninst | ||||
| > | all' or 'rm' by parent NOT IN $MDMAgentPackageList$ \u2014 shell | ||||
| > | invocation for destruction commands]. Alert on a sequence or | ||||
| > | state change inconsistent with the device/app baseline, app | ||||
| > | roved management policy, or expected user workflow; do not i | ||||
| > | nfer unobserved API calls, file/process activity, or payload | ||||
| > | content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates outbound communication from an appli | t | 1 | For Android, detect Web Service by correlating analyst-visib |
| > | cation or service to legitimate external web platforms with | > | le device/network evidence and management state; use streami | ||
| > | mobile runtime context showing that the communication is inc | > | ng or batched telemetry only where the documented collector | ||
| > | onsistent with the app's approved role, expected destination | > | is deployed. Correlate Application Permission via Android En | ||
| > | s, user interaction pattern, or device state. The strongest | > | terprise DPC / Application Vetting [DevicePolicyManager.getP | ||
| > | Android evidence is a managed or installed app communicating | > | ermissionGrantState(); PackageManager manifest/requested-per | ||
| > | with cloud storage, social, messaging, code-hosting, or gen | > | mission review]; Application State via Android Enterprise / | ||
| > | eric HTTPS web-service infrastructure shortly after backgrou | > | EMM [Managed package inventory/status and package metadata]; | ||
| > | nd activation, protected-resource use, or local staging acti | > | File Creation via Application Vetting / Forensic Acquisitio | ||
| > | vity, especially when the device is locked, user interaction | > | n [Dynamic filesystem trace or acquired app-container/filesy | ||
| > | is absent, or the app's historical network baseline does no | > | stem artifacts: App stages or caches content retrieved from | ||
| > | t include that service class. | > | web-service platform locally before initiating secondary net | ||
| > | work connection]. Alert on a sequence or state change incons | ||||
| > | istent with the device/app baseline, approved management pol | ||||
| > | icy, or expected user workflow; do not infer unobserved API | ||||
| > | calls, file/process activity, or payload content from manage | ||||
| > | ment state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates communication to legitimate external | t | 1 | For iOS, detect Web Service by correlating analyst-visible d |
| > | web-service platforms with supervised managed-app context a | > | evice/network evidence and management state; use streaming o | ||
| > | nd device-state information showing that the traffic is inco | > | r batched telemetry only where the documented collector is d | ||
| > | nsistent with the app's expected role, background-refresh pr | > | eployed. Correlate Application Permission via Application Ve | ||
| > | ofile, or user interaction timing. On iOS, the strongest rel | > | tting [Code-signing entitlements and Info.plist privacy usag | ||
| > | iable evidence is network telemetry tied to a managed app or | > | e-description keys]; Application State via Apple MDM [Instal | ||
| > | device plus app state and supervision context, especially w | > | ledApplicationList / ManagedApplicationList]; Network Traffi | ||
| > | hen traffic to social, collaboration, cloud-storage, or gene | > | c Content via Enterprise Secure Web Gateway / Proxy [DNS/HTT | ||
| > | ric HTTPS platforms occurs shortly after background activity | > | P(S) inspection or proxy transaction metadata where enterpri | ||
| > | , while the device is locked, or without expected user-drive | > | se decryption/inspection is deployed]. Alert on a sequence o | ||
| > | n foreground execution. Direct low-level framework visibilit | > | r state change inconsistent with the device/app baseline, ap | ||
| > | y is weaker than Android, so primary analytic confidence sho | > | proved management policy, or expected user workflow; do not | ||
| > | uld be anchored to supervised app context plus network behav | > | infer unobserved API calls, file/process activity, or payloa | ||
| > | ior rather than assumed host-level proof. | > | d content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A defender observes an application holding microphone captur | t | 1 | For Android, detect Audio Capture by correlating analyst-vis |
| > | e capability transitioning into active microphone resource u | > | ible device/network evidence and management state; use strea | ||
| > | sage through Android audio APIs (e.g., MediaRecorder or Audi | > | ming or batched telemetry only where the documented collecto | ||
| > | oRecord), followed by sustained capture while the applicatio | > | r is deployed. Correlate API Calls via Application Vetting / | ||
| > | n is backgrounded or the device is locked, and subsequent ou | > | Instrumented Dynamic Analysis [Dynamic API/runtime trace: A | ||
| > | tbound network traffic suggesting potential audio exfiltrati | > | udioRecord.startRecording() or MediaRecorder.start() called | ||
| > | on or streaming. | > | by app NOT IN $AudioAllowList$]; File Creation via Applicati | ||
| > | on Vetting / Forensic Acquisition [Dynamic filesystem trace | ||||
| > | or acquired app-container/filesystem artifacts: open() with | ||||
| > | O_CREAT for file with audio MIME type (audio/mp4, audio/aac, | ||||
| > | audio/3gpp) in /data/data/<app>/files/ within $AudioCapture | ||||
| > | Window$ of recording API start]; Network Traffic Flow via An | ||||
| > | droid Enterprise Network Logging / Enterprise VPN [DevicePol | ||||
| > | icyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; V | ||||
| > | PN flow metadata]. Alert on a sequence or state change incon | ||||
| > | sistent with the device/app baseline, approved management po | ||||
| > | licy, or expected user workflow; do not infer unobserved API | ||||
| > | calls, file/process activity, or payload content from manag | ||||
| > | ement state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A defender observes an application with declared microphone | t | 1 | For iOS, detect Audio Capture by correlating analyst-visible |
| > | capability initiating microphone resource use through iOS au | > | device/network evidence and management state; use streaming | ||
| > | dio frameworks, potentially during background execution or s | > | or batched telemetry only where the documented collector is | ||
| > | hortly after a silent wake event, followed by sustained audi | > | deployed. Correlate Application Permission via Application | ||
| > | o capture and outbound encrypted traffic suggesting audio st | > | Vetting [Code-signing entitlements and Info.plist privacy us | ||
| > | reaming or upload activity. | > | age-description keys]; Network Traffic Flow via Apple Networ | ||
| > | k Extension / Enterprise VPN [NEFilterFlow / per-app VPN / s | ||||
| > | ecure-web-gateway flow metadata]; Permissions Request via Ap | ||||
| > | plication Vetting [Code-signing entitlements and Info.plist | ||||
| > | privacy usage-description keys]. Alert on a sequence or stat | ||||
| > | e change inconsistent with the device/app baseline, approved | ||||
| > | management policy, or expected user workflow; do not infer | ||||
| > | unobserved API calls, file/process activity, or payload cont | ||||
| > | ent from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | OLD: Application vetting services could look for `android.p | t | 1 | For Android, detect Calendar Entries by correlating analyst- |
| > | ermission.READ_CALENDAR` or `android.permission.WRITE_CALEND | > | visible device/network evidence and management state; use st | ||
| > | AR` in an Android application\u2019s manifest, or `NSCalendarsUsa | > | reaming or batched telemetry only where the documented colle | ||
| > | geDescription` in an iOS application\u2019s `Info.plist` file. Mo | > | ctor is deployed. Correlate API Calls via Application Vettin | ||
| > | st applications do not need calendar access, so extra scruti | > | g / Instrumented Dynamic Analysis [Dynamic API/runtime trace | ||
| > | ny could be applied to those that request it. On both Andro | > | : ContentResolver.query(CalendarContract) with query_count > | ||
| > | id and iOS, the user can manage which applications have perm | > | $CalendarQueryThreshold$ by app NOT IN $ApprovedCalendarApp | ||
| > | ission to access calendar information through the device set | > | s$]; Network Traffic Flow via Android Enterprise Network Log | ||
| > | tings screen, revoke the permission if necessary. NEW: A d | > | ging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLo | ||
| > | efender observes an Android application requesting for `andr | > | gs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permissio | ||
| > | oid.permission.READ_CALENDAR` or `android.permission.WRITE_C | > | ns Request via Android Enterprise DPC / Application Vetting | ||
| > | ALENDAR`, which may also be listed in the application\u2019s Mani | > | [DevicePolicyManager.getPermissionGrantState(); PackageManag | ||
| > | fest. | > | er manifest/requested-permission review]. Alert on a sequenc | ||
| > | e or state change inconsistent with the device/app baseline, | ||||
| > | approved management policy, or expected user workflow; do n | ||||
| > | ot infer unobserved API calls, file/process activity, or pay | ||||
| > | load content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for `android.permiss | t | 1 | For iOS, detect Calendar Entries by correlating analyst-visi |
| > | ion.READ_CALENDAR` or `android.permission.WRITE_CALENDAR` in | > | ble device/network evidence and management state; use stream | ||
| > | an Android application\u2019s manifest, or `NSCalendarsUsageDesc | > | ing or batched telemetry only where the documented collector | ||
| > | ription` in an iOS application\u2019s `Info.plist` file. Most app | > | is deployed. Correlate API Calls via Application Vetting / | ||
| > | lications do not need calendar access, so extra scrutiny cou | > | Instrumented Dynamic Analysis [Dynamic API/runtime trace: EK | ||
| > | ld be applied to those that request it. On both Android and | > | EventStore.fetchEvents() or enumerateEvents() with date_rang | ||
| > | iOS, the user can manage which applications have permission | > | e > $CalendarDateRangeThreshold$ days by app NOT IN $Approve | ||
| > | to access calendar information through the device settings | > | dCalendarApps$]; Network Traffic Flow via Apple Network Exte | ||
| > | screen, revoke the permission if necessary. | > | nsion / Enterprise VPN [NEFilterFlow / per-app VPN / secure- | ||
| > | web-gateway flow metadata]; Permissions Request via Applicat | ||||
| > | ion Vetting [Code-signing entitlements and Info.plist privac | ||||
| > | y usage-description keys]. Alert on a sequence or state chan | ||||
| > | ge inconsistent with the device/app baseline, approved manag | ||||
| > | ement policy, or expected user workflow; do not infer unobse | ||||
| > | rved API calls, file/process activity, or payload content fr | ||||
| > | om management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates an application gaining/retaining fine or | t | 1 | For Android, detect Location Tracking by correlating analyst |
| > | background location capability with subsequent location sen | > | -visible device/network evidence and management state; use s | ||
| > | sor sessions that occur while the app is backgrounded or the | > | treaming or batched telemetry only where the documented coll | ||
| > | device is locked, followed by repeated location reads at a | > | ector is deployed. Correlate API Calls via Application Vetti | ||
| > | periodic cadence and near-term outbound connections to domai | > | ng / Instrumented Dynamic Analysis [Dynamic API/runtime trac | ||
| > | ns not typical for fleet navigation/MDM services, indicating | > | e: LocationManager.requestLocationUpdates() called with minT | ||
| > | covert location tracking. | > | ime < $LocationUpdateFreqThreshold$ by app NOT IN $LocationA | ||
| > | llowList$]; Network Traffic Content via Enterprise Secure We | ||||
| > | b Gateway / Proxy [DNS/HTTP(S) inspection or proxy transacti | ||||
| > | on metadata where enterprise decryption/inspection is deploy | ||||
| > | ed]; Permissions Request via Android Enterprise DPC / Applic | ||||
| > | ation Vetting [DevicePolicyManager.getPermissionGrantState() | ||||
| > | ; PackageManager manifest/requested-permission review]. Aler | ||||
| > | t on a sequence or state change inconsistent with the device | ||||
| > | /app baseline, approved management policy, or expected user | ||||
| > | workflow; do not infer unobserved API calls, file/process ac | ||||
| > | tivity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates an application\u2019s location authorization | t | 1 | For iOS, detect Location Tracking by correlating analyst-vis |
| > | level (When-In-Use vs Always) and entitlement posture with o | > | ible device/network evidence and management state; use strea | ||
| > | bserved location sensor activity that occurs without proxima | > | ming or batched telemetry only where the documented collecto | ||
| > | te user interaction, including background updates, followed | > | r is deployed. Correlate Application Permission via Applicat | ||
| > | by periodic outbound network sessions aligned to location up | > | ion Vetting [Code-signing entitlements and Info.plist privac | ||
| > | date timing\u2014suggesting covert or policy-violating location t | > | y usage-description keys]; Network Traffic Flow via Apple Ne | ||
| > | racking. | > | twork Extension / Enterprise VPN [NEFilterFlow / per-app VPN | ||
| > | / secure-web-gateway flow metadata]; Permissions Request vi | ||||
| > | a Application Vetting [Code-signing entitlements and Info.pl | ||||
| > | ist privacy usage-description keys]. Alert on a sequence or | ||||
| > | state change inconsistent with the device/app baseline, appr | ||||
| > | oved management policy, or expected user workflow; do not in | ||||
| > | fer unobserved API calls, file/process activity, or payload | ||||
| > | content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates an app preparing to phish (gaining overl | t | 1 | For Android, detect GUI Input Capture by correlating analyst |
| > | ay/notification/accessibility capability) with precise foreg | > | -visible device/network evidence and management state; use s | ||
| > | round targeting (reading activity in front via accessibility | > | treaming or batched telemetry only where the documented coll | ||
| > | /focus) and then presenting a look-alike UI (overlay window | > | ector is deployed. Correlate Application State via Android E | ||
| > | or activity-on-top) immediately before local storage or smal | > | nterprise / EMM [Managed package inventory/status and packag | ||
| > | l-burst egress of entered data. Chain: capability/permission | > | e metadata]; Network Traffic Content via Enterprise Secure W | ||
| > | \u2192 target app in foreground detected \u2192 overlay/activity-on-t | > | eb Gateway / Proxy [DNS/HTTP(S) inspection or proxy transact | ||
| > | op or fake notification tap \u2192 local prompt input write \u2192 nea | > | ion metadata where enterprise decryption/inspection is deplo | ||
| > | r-term network egress. | > | yed]; Permissions Request via Android Enterprise DPC / Appli | ||
| > | cation Vetting [DevicePolicyManager.getPermissionGrantState( | ||||
| > | ); PackageManager manifest/requested-permission review]. Ale | ||||
| > | rt on a sequence or state change inconsistent with the devic | ||||
| > | e/app baseline, approved management policy, or expected user | ||||
| > | workflow; do not infer unobserved API calls, file/process a | ||||
| > | ctivity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates a look-alike prompt inside an app (e.g., | t | 1 | For iOS, detect GUI Input Capture by correlating analyst-vis |
| > | faux Apple ID password view, webview of brand login) with t | > | ible device/network evidence and management state; use strea | ||
| > | iming against scene/foreground activation, optional push not | > | ming or batched telemetry only where the documented collecto | ||
| > | ification bait, then local form cache writes and/or small eg | > | r is deployed. Correlate Application Permission via Applicat | ||
| > | ress. Chain: scene activation around sensitive UI \u2192 suspicio | > | ion Vetting [Code-signing entitlements and Info.plist privac | ||
| > | us prompt creation (UIKit events without expected auth contr | > | y usage-description keys]; Application State via Apple MDM [ | ||
| > | oller) or webview navigated to look-alike domain \u2192 local cac | > | InstalledApplicationList / ManagedApplicationList]; Network | ||
| > | he write \u2192 near-term egress | > | Traffic Content via Enterprise Secure Web Gateway / Proxy [D | ||
| > | NS/HTTP(S) inspection or proxy transaction metadata where en | ||||
| > | terprise decryption/inspection is deployed]. Alert on a sequ | ||||
| > | ence or state change inconsistent with the device/app baseli | ||||
| > | ne, approved management policy, or expected user workflow; d | ||||
| > | o not infer unobserved API calls, file/process activity, or | ||||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates an app's opaque media ingress (download/ | t | 1 | For Android, detect Steganography by correlating analyst-vis |
| > | IPC) with high-entropy or anomalous edits to image/audio/vid | > | ible device/network evidence and management state; use strea | ||
| > | eo files in app-writable storage (e.g., bursts of bitmap/cod | > | ming or batched telemetry only where the documented collecto | ||
| > | ec operations, EXIF/IPTC/XMP mutation, suspicious container | > | r is deployed. Correlate File Creation via Application Vetti | ||
| > | growth), followed by decoding/extraction behavior (new non-m | > | ng / Forensic Acquisition [Dynamic filesystem trace or acqui | ||
| > | edia artifact derived from the edited media) and optional ex | > | red app-container/filesystem artifacts: open() with O_CREAT | ||
| > | filtration/sharing of the stego media. Focus is on: (1) opaq | > | on binary-typed path in /data/data/<app>/ within $StegoExecW | ||
| > | ue media arrival \u2192 (2) rapid metadata or pixel-domain mutati | > | indow$ of media file download from same session]; Module Loa | ||
| > | ons with atypical size/entropy deltas \u2192 (3a) decoded payload | > | d via Application Vetting / Instrumented Dynamic Analysis [D | ||
| > | creation or dynamic load from decoded path, and/or (3b) upl | > | ynamic API/runtime trace: DexClassLoader() or dlopen() on pa | ||
| > | oad/share of the modified media within a tight window. | > | th written within $StegoExecWindow$ of media download event | ||
| > | \u2014 download-write-load chain confirms steganographic payload | ||||
| > | delivery]; Network Connection Creation via Android Enterpris | ||||
| > | e Network Logging / Enterprise VPN [DevicePolicyManager.retr | ||||
| > | ieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadat | ||||
| > | a]. Alert on a sequence or state change inconsistent with th | ||||
| > | e device/app baseline, approved management policy, or expect | ||||
| > | ed user workflow; do not infer unobserved API calls, file/pr | ||||
| > | ocess activity, or payload content from management state alo | ||||
| > | ne. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An application with access to broad file scopes or sensitive | t | 1 | For Android, detect Data Encrypted for Impact by correlating |
| > | storage areas becomes active, performs abnormal burst file | > | analyst-visible device/network evidence and management stat | ||
| > | reads and writes across many user or shared-storage location | > | e; use streaming or batched telemetry only where the documen | ||
| > | s, transforms file content or extensions at scale in a short | > | ted collector is deployed. Correlate Application Permission | ||
| > | window, and causes rapid file inaccessibility, rewrite, or | > | via Android Enterprise DPC / Application Vetting [DevicePoli | ||
| > | replacement inconsistent with normal sync, backup, media pro | > | cyManager.getPermissionGrantState(); PackageManager manifest | ||
| > | cessing, or document-editing behavior. The defender correlat | > | /requested-permission review]; Application State via Android | ||
| > | es capability state, app lifecycle, framework use, bulk file | > | Enterprise / EMM [Managed package inventory/status and pack | ||
| > | -write effects, and optional network communications to disti | > | age metadata]; OS API Execution via Application Vetting / In | ||
| > | nguish encrypt-for-impact behavior from benign bulk file ope | > | strumented Dynamic Analysis [Dynamic API/runtime trace: Cont | ||
| > | rations. | > | entResolver, DocumentProvider, StorageAccessFramework, or bu | ||
| > | lk stream I/O invocations exceed $FileModificationRateThresh | ||||
| > | old$ operations per minute across distinct file paths \u2014 API- | ||||
| > | level operation rate distinguishes ransomware from norma]. A | ||||
| > | lert on a sequence or state change inconsistent with the dev | ||||
| > | ice/app baseline, approved management policy, or expected us | ||||
| > | er workflow; do not infer unobserved API calls, file/process | ||||
| > | activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | OLD: Application vetting services could look for `android.pe | t | 1 | For Android, detect Contact List by correlating analyst-visi |
| > | rmission.READ_CONTACTS` in an Android application\u2019s manifest | > | ble device/network evidence and management state; use stream | ||
| > | , or `NSContactsUsageDescription` in an iOS application\u2019s `I | > | ing or batched telemetry only where the documented collector | ||
| > | nfo.plist` file. Most applications do not need contact list | > | is deployed. Correlate API Calls via Application Vetting / | ||
| > | access, so extra scrutiny could be applied to those that req | > | Instrumented Dynamic Analysis [Dynamic API/runtime trace: Co | ||
| > | uest it. On both Android and iOS, the user can manage which | > | ntentResolver.query(ContactsContract) with projection=all_fi | ||
| > | applications have permission to access the contact list thro | > | elds]; Network Traffic Flow via Android Enterprise Network L | ||
| > | ugh the device settings screen, revoking the permission if n | > | ogging / Enterprise VPN [DevicePolicyManager.retrieveNetwork | ||
| > | ecessary. NEW: A defender observes an Android application | > | Logs(): DnsEvent / ConnectEvent; VPN flow metadata]; Permiss | ||
| > | requesting for android.permission.READ_CONTACTS, which may a | > | ions Request via Android Enterprise DPC / Application Vettin | ||
| > | lso be listed in the application's manifest file. | > | g [DevicePolicyManager.getPermissionGrantState(); PackageMan | ||
| > | ager manifest/requested-permission review]. Alert on a seque | ||||
| > | nce or state change inconsistent with the device/app baselin | ||||
| > | e, approved management policy, or expected user workflow; do | ||||
| > | not infer unobserved API calls, file/process activity, or p | ||||
| > | ayload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for `android.permiss | t | 1 | For iOS, detect Contact List by correlating analyst-visible |
| > | ion.READ_CONTACTS` in an Android application\u2019s manifest, or | > | device/network evidence and management state; use streaming | ||
| > | `NSContactsUsageDescription` in an iOS application\u2019s `Info.p | > | or batched telemetry only where the documented collector is | ||
| > | list` file. Most applications do not need contact list acces | > | deployed. Correlate API Calls via Application Vetting / Inst | ||
| > | s, so extra scrutiny could be applied to those that request | > | rumented Dynamic Analysis [Dynamic API/runtime trace: CNCont | ||
| > | it. On both Android and iOS, the user can manage which appli | > | actStore.enumerateContacts with CNContactFetchRequest.keysTo | ||
| > | cations have permission to access the contact list through t | > | Fetch containing all contact keys by app NOT IN $ApprovedCon | ||
| > | he device settings screen, revoking the permission if necess | > | tactsApps$]; Network Traffic Flow via Apple Network Extensio | ||
| > | ary. | > | n / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web- | ||
| > | gateway flow metadata]; Permissions Request via Application | ||||
| > | Vetting [Code-signing entitlements and Info.plist privacy us | ||||
| > | age-description keys]. Alert on a sequence or state change i | ||||
| > | nconsistent with the device/app baseline, approved managemen | ||||
| > | t policy, or expected user workflow; do not infer unobserved | ||||
| > | API calls, file/process activity, or payload content from m | ||||
| > | anagement state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes an app enumerating installed security/mana | t | 1 | For Android, detect Security Software Discovery by correlati |
| > | gement controls (AV/EDR/MDM/VPN/Play Protect) via PackageMan | > | ng analyst-visible device/network evidence and management st | ||
| > | ager, DevicePolicyManager, AppOps, and Settings queries or s | > | ate; use streaming or batched telemetry only where the docum | ||
| > | hell \u2018pm list\u2019 usage, optionally probing Accessibility/Devic | > | ented collector is deployed. Correlate API Calls via Applica | ||
| > | e Admin state. Enumeration is followed by local inventory ar | > | tion Vetting / Instrumented Dynamic Analysis [Dynamic API/ru | ||
| > | tifact creation and/or small egress. Chain: capability to qu | > | ntime trace: PackageManager.getPackageInfo() called for pack | ||
| > | ery \u2192 burst of security-focused checks (packages/permissions | > | age names IN $SecurityToolPackageList$ by app NOT IN $AppEnu | ||
| > | /policies) \u2192 optional foreground targeting \u2192 artifact write | > | mAllowList$]; Application State via Android Enterprise / EMM | ||
| > | \u2192 quick POST. | > | [Managed package inventory/status and package metadata]; Ne | ||
| > | twork Connection Creation via Android Enterprise Network Log | ||||
| > | ging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLo | ||||
| > | gs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on | ||||
| > | a sequence or state change inconsistent with the device/app | ||||
| > | baseline, approved management policy, or expected user workf | ||||
| > | low; do not infer unobserved API calls, file/process activit | ||||
| > | y, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates app attempts to enumerate or infer secur | t | 1 | For iOS, detect Security Software Discovery by correlating a |
| > | ity/management tooling (ManagedConfiguration/MDM presence, V | > | nalyst-visible device/network evidence and management state; | ||
| > | PN/NEFilter config, AV/EDR app presence via LaunchServices o | > | use streaming or batched telemetry only where the documente | ||
| > | r URL-scheme probing, private APIs) with local inventory per | > | d collector is deployed. Correlate API Calls via Application | ||
| > | sistence and egress. Chain: probe (MDM/NE/VPN/AV presence) \u2192 | > | Vetting / Instrumented Dynamic Analysis [Dynamic API/runtim | ||
| > | burst of LS/canOpenURL/ManagedConfiguration calls \u2192 invento | > | e trace: UIApplication.canOpenURL() called with schemes IN $ | ||
| > | ry cache write \u2192 small POST. | > | MDMToolSchemeList$ by app NOT IN $AppEnumAllowList$]; Applic | ||
| > | ation Permission via Application Vetting [Code-signing entit | ||||
| > | lements and Info.plist privacy usage-description keys]; Netw | ||||
| > | ork Connection Creation via Apple Network Extension / Enterp | ||||
| > | rise VPN [NEFilterFlow / per-app VPN / secure-web-gateway fl | ||||
| > | ow metadata]. Alert on a sequence or state change inconsiste | ||||
| > | nt with the device/app baseline, approved management policy, | ||||
| > | or expected user workflow; do not infer unobserved API call | ||||
| > | s, file/process activity, or payload content from management | ||||
| > | state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The user can view permissions granted to an application in d | t | 1 | For Android, detect Protected User Data by correlating analy |
| > | evice settings. Application vetting services typically flag | > | st-visible device/network evidence and management state; use | ||
| > | permissions requested by an application, which can be revie | > | streaming or batched telemetry only where the documented co | ||
| > | wed by an administrator. Certain dangerous permissions, such | > | llector is deployed. Correlate API Calls via Application Vet | ||
| > | as `RECEIVE_SMS`, could receive additional scrutiny. | > | ting / Instrumented Dynamic Analysis [Dynamic API/runtime tr | ||
| > | ace: ContentResolver.query() to sensitive provider URI (cont | ||||
| > | acts, calendar, call_log, sms) with query_count > $ContentQu | ||||
| > | eryThreshold$ by app NOT IN $ApprovedDataApps$]; Network Tra | ||||
| > | ffic Flow via Android Enterprise Network Logging / Enterpris | ||||
| > | e VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / | ||||
| > | ConnectEvent; VPN flow metadata]; Permissions Request via A | ||||
| > | ndroid Enterprise DPC / Application Vetting [DevicePolicyMan | ||||
| > | ager.getPermissionGrantState(); PackageManager manifest/requ | ||||
| > | ested-permission review]. Alert on a sequence or state chang | ||||
| > | e inconsistent with the device/app baseline, approved manage | ||||
| > | ment policy, or expected user workflow; do not infer unobser | ||||
| > | ved API calls, file/process activity, or payload content fro | ||||
| > | m management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The user can view permissions granted to an application in d | t | 1 | For iOS, detect Protected User Data by correlating analyst-v |
| > | evice settings. Application vetting services typically flag | > | isible device/network evidence and management state; use str | ||
| > | permissions requested by an application, which can be revie | > | eaming or batched telemetry only where the documented collec | ||
| > | wed by an administrator. Certain dangerous permissions, such | > | tor is deployed. Correlate API Calls via Application Vetting | ||
| > | as `RECEIVE_SMS`, could receive additional scrutiny. | > | / Instrumented Dynamic Analysis [Dynamic API/runtime trace: | ||
| > | CNContactStore.enumerateContacts or EKEventStore.fetchEvent | ||||
| > | s or CLLocationManager.startUpdatingLocation called with bro | ||||
| > | ad scope by app NOT IN $ApprovedDataApps$]; Network Traffic | ||||
| > | Flow via Apple Network Extension / Enterprise VPN [NEFilterF | ||||
| > | low / per-app VPN / secure-web-gateway flow metadata]; Permi | ||||
| > | ssions Request via Application Vetting [Code-signing entitle | ||||
| > | ments and Info.plist privacy usage-description keys]. Alert | ||||
| > | on a sequence or state change inconsistent with the device/a | ||||
| > | pp baseline, approved management policy, or expected user wo | ||||
| > | rkflow; do not infer unobserved API calls, file/process acti | ||||
| > | vity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes an app (package/UID) issuing high-rate dir | t | 1 | For Android, detect File and Directory Discovery by correlat |
| > | ectory or content-index enumerations against external/shared | > | ing analyst-visible device/network evidence and management s | ||
| > | storage or other apps\u2019 Documents/Media providers (logcat:Co | > | tate; use streaming or batched telemetry only where the docu | ||
| > | ntentResolver, logcat:StorageAccessFramework), followed with | > | mented collector is deployed. Correlate Application State vi | ||
| > | in a short window by bulk READ handles or stat/list calls ov | > | a Android Enterprise / EMM [Managed package inventory/status | ||
| > | er many distinct paths (logcat:FileIO). Activity occurs with | > | and package metadata]; File Access via Application Vetting | ||
| > | out foreground UI or exceeds typical per-app baseline, indic | > | / Forensic Acquisition [Dynamic filesystem trace or acquired | ||
| > | ating automated file/dir discovery rather than user-driven b | > | app-container/filesystem artifacts: opendir() or File.listF | ||
| > | rowsing. Correlate on package/UID/profile and time proximity | > | iles() on path IN $ExternalStoragePaths$ called > $FileEnumT | ||
| > | . | > | hreshold$ times within $EnumWindow$ by app NOT IN $FileEnumA | ||
| > | llowList$]; Network Traffic Flow via Android Enterprise Netw | ||||
| > | ork Logging / Enterprise VPN [DevicePolicyManager.retrieveNe | ||||
| > | tworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Al | ||||
| > | ert on a sequence or state change inconsistent with the devi | ||||
| > | ce/app baseline, approved management policy, or expected use | ||||
| > | r workflow; do not infer unobserved API calls, file/process | ||||
| > | activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes an app (bundle/process) performing large-s | t | 1 | For iOS, detect File and Directory Discovery by correlating |
| > | cope directory listings or metadata reads via FileProvider/N | > | analyst-visible device/network evidence and management state | ||
| > | SFileManager against user-visible containers (Files app loca | > | ; use streaming or batched telemetry only where the document | ||
| > | tions, iCloud/On-My-iPhone) or external providers, with rapi | > | ed collector is deployed. Correlate Application State via Ap | ||
| > | d traversal across many folders while the app is backgrounde | > | ple MDM [InstalledApplicationList / ManagedApplicationList]; | ||
| > | d or without corresponding UI activity (unifiedlogs:FileProv | > | Host Status via Apple MDM [DeviceInformation / SecurityInfo | ||
| > | ider, unifiedlogs:FileIO). Optional signals include Photo li | > | / ProfileList / restrictions and compliance queries]; Netwo | ||
| > | brary or document picker bulk enumeration absent recent user | > | rk Traffic Flow via Apple Network Extension / Enterprise VPN | ||
| > | gesture. Correlate on bundle/process/profile and path volum | > | [NEFilterFlow / per-app VPN / secure-web-gateway flow metad | ||
| > | e within a bounded window. | > | ata]. Alert on a sequence or state change inconsistent with | ||
| > | the device/app baseline, approved management policy, or expe | ||||
| > | cted user workflow; do not infer unobserved API calls, file/ | ||||
| > | process activity, or payload content from management state a | ||||
| > | lone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Applications could be vetted for their use of the clipboard | t | 1 | For Android, detect Transmitted Data Manipulation by correla |
| > | manager APIs with extra scrutiny given to application that m | > | ting analyst-visible device/network evidence and management | ||
| > | ake use of them. | > | state; use streaming or batched telemetry only where the doc | ||
| > | umented collector is deployed. Correlate API Calls via Appli | ||||
| > | cation Vetting / Instrumented Dynamic Analysis [Dynamic API/ | ||||
| > | runtime trace: ClipboardManager.addOnPrimaryClipChangedListe | ||||
| > | ner() registered]; Application State via Android Enterprise | ||||
| > | / EMM [Managed package inventory/status and package metadata | ||||
| > | ]; System Notifications via Android Enterprise / Managed App | ||||
| > | Telemetry [Documented DPC/admin callbacks or managed-app ge | ||||
| > | nerated event telemetry]. Alert on a sequence or state chang | ||||
| > | e inconsistent with the device/app baseline, approved manage | ||||
| > | ment policy, or expected user workflow; do not infer unobser | ||||
| > | ved API calls, file/process activity, or payload content fro | ||||
| > | m management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Mobile security products may provide URL inspection services | t | 1 | For Android, detect Phishing by correlating analyst-visible |
| > | that could determine if a domain being visited is malicious | > | device/network evidence and management state; use streaming | ||
| > | . Enterprises may be able to detect anomalous traffic origin | > | or batched telemetry only where the documented collector is | ||
| > | ating from mobile devices, which could indicate compromise. | > | deployed. Correlate File Creation via Application Vetting / | ||
| > | Forensic Acquisition [Dynamic filesystem trace or acquired a | ||||
| > | pp-container/filesystem artifacts: open() with O_CREAT for A | ||||
| > | PK file in /sdcard/ or /data/local/tmp/ within $PhishingWind | ||||
| > | ow$ of navigation to flagged URL \u2014 APK drop confirms malware | ||||
| > | delivery phase]; Network Traffic Content via Enterprise Sec | ||||
| > | ure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy tra | ||||
| > | nsaction metadata where enterprise decryption/inspection is | ||||
| > | deployed]; Process Creation via Application Vetting / Manage | ||||
| > | d Device Telemetry [execve() from APK installed within $Phis | ||||
| > | hingWindow$ of navigation to flagged URL \u2014 first execution c | ||||
| > | onfirms malware activation]. Alert on a sequence or state ch | ||||
| > | ange inconsistent with the device/app baseline, approved man | ||||
| > | agement policy, or expected user workflow; do not infer unob | ||||
| > | served API calls, file/process activity, or payload content | ||||
| > | from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Mobile security products may provide URL inspection services | t | 1 | For iOS, detect Phishing by correlating analyst-visible devi |
| > | that could determine if a domain being visited is malicious | > | ce/network evidence and management state; use streaming or b | ||
| > | . Enterprises may be able to detect anomalous traffic origin | > | atched telemetry only where the documented collector is depl | ||
| > | ating from mobile devices, which could indicate compromise. | > | oyed. Correlate Network Traffic Content via Enterprise Secur | ||
| > | e Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy trans | ||||
| > | action metadata where enterprise decryption/inspection is de | ||||
| > | ployed]; Network Traffic Flow via Apple Network Extension / | ||||
| > | Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gate | ||||
| > | way flow metadata]; Protected Configuration via Apple MDM [D | ||||
| > | eviceInformation / SecurityInfo / ProfileList / restrictions | ||||
| > | and compliance queries]. Alert on a sequence or state chang | ||||
| > | e inconsistent with the device/app baseline, approved manage | ||||
| > | ment policy, or expected user workflow; do not infer unobser | ||||
| > | ved API calls, file/process activity, or payload content fro | ||||
| > | m management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A defender observes an application establishing application- | t | 1 | For Android, detect Exfiltration Over Alternative Protocol b |
| > | layer network sessions (e.g., HTTP(S), WebSocket, DNS, SMTP/ | > | y correlating analyst-visible device/network evidence and ma | ||
| > | IMAP) with destinations and request patterns that deviate fr | > | nagement state; use streaming or batched telemetry only wher | ||
| > | om the enterprise baseline for that app category, especially | > | e the documented collector is deployed. Correlate Applicatio | ||
| > | when sessions occur during background execution or while th | > | n Permission via Android Enterprise DPC / Application Vettin | ||
| > | e device is locked and exhibit beacon-like periodicity, anom | > | g [DevicePolicyManager.getPermissionGrantState(); PackageMan | ||
| > | alous SNI/Host patterns, or suspicious request/response size | > | ager manifest/requested-permission review]; Application Stat | ||
| > | symmetry consistent with command polling and tasking over l | > | e via Android Enterprise / EMM [Managed package inventory/st | ||
| > | egitimate-looking protocols. | > | atus and package metadata]; Network Connection Creation via | ||
| > | Android Enterprise Network Logging / Enterprise VPN [DeviceP | ||||
| > | olicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; | ||||
| > | VPN flow metadata]. Alert on a sequence or state change inc | ||||
| > | onsistent with the device/app baseline, approved management | ||||
| > | policy, or expected user workflow; do not infer unobserved A | ||||
| > | PI calls, file/process activity, or payload content from man | ||||
| > | agement state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A defender observes an application generating application-la | t | 1 | For iOS, detect Application Layer Protocol by correlating an |
| > | yer communications that blend with normal traffic (HTTP(S), | > | alyst-visible device/network evidence and management state; | ||
| > | WebSocket, DNS, mail protocols) but show deviations from ent | > | use streaming or batched telemetry only where the documented | ||
| > | erprise baselines for that bundle ID\u2014such as persistent back | > | collector is deployed. Correlate Application Permission via | ||
| > | ground network sessions, regular low-volume polling interval | > | Application Vetting [Code-signing entitlements and Info.pli | ||
| > | s, anomalous SNI/Host destinations, uncommon DNS patterns, o | > | st privacy usage-description keys]; Application State via Ap | ||
| > | r uniform request/response sizing\u2014suggesting command and con | > | ple MDM [InstalledApplicationList / ManagedApplicationList]; | ||
| > | trol over legitimate-looking protocols without relying on to | > | Network Connection Creation via Apple Network Extension / E | ||
| > | ol signatures. | > | nterprise VPN [NEFilterFlow / per-app VPN / secure-web-gatew | ||
| > | ay flow metadata]. Alert on a sequence or state change incon | ||||
| > | sistent with the device/app baseline, approved management po | ||||
| > | licy, or expected user workflow; do not infer unobserved API | ||||
| > | calls, file/process activity, or payload content from manag | ||||
| > | ement state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | OLD: Application vetting services could look for `android.pe | t | 1 | For Android, detect SMS Messages by correlating analyst-visi |
| > | rmission.READ_SMS` in an Android application\u2019s manifest. Mos | > | ble device/network evidence and management state; use stream | ||
| > | t applications do not need access to SMS messages, so extra | > | ing or batched telemetry only where the documented collector | ||
| > | scrutiny could be applied to those that request it. On Andr | > | is deployed. Correlate API Calls via Application Vetting / | ||
| > | oid, the user can manage which applications have permission | > | Instrumented Dynamic Analysis [Dynamic API/runtime trace: Co | ||
| > | to access SMS messages through the device settings screen, r | > | ntentResolver.query(Telephony.Sms) including both inbox]; Ne | ||
| > | evoking the permission if necessary. NEW: A defender observ | > | twork Traffic Flow via Android Enterprise Network Logging / | ||
| > | es an Android application requesting for `android.permission | > | Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): D | ||
| > | . READ_SMS` and/or ` android.permission. RECEIVE_SMS `, whic | > | nsEvent / ConnectEvent; VPN flow metadata]; Permissions Requ | ||
| > | h may also be listed in the application's manifest file. | > | est via Android Enterprise DPC / Application Vetting [Device | ||
| > | PolicyManager.getPermissionGrantState(); PackageManager mani | ||||
| > | fest/requested-permission review]. Alert on a sequence or st | ||||
| > | ate change inconsistent with the device/app baseline, approv | ||||
| > | ed management policy, or expected user workflow; do not infe | ||||
| > | r unobserved API calls, file/process activity, or payload co | ||||
| > | ntent from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for `android.permiss | t | 1 | For iOS, detect SMS Messages by correlating analyst-visible |
| > | ion.READ_SMS` in an Android application\u2019s manifest. Most app | > | device/network evidence and management state; use streaming | ||
| > | lications do not need access to SMS messages, so extra scrut | > | or batched telemetry only where the documented collector is | ||
| > | iny could be applied to those that request it. On Android, | > | deployed. Correlate Application State via Apple MDM [Install | ||
| > | the user can manage which applications have permission to ac | > | edApplicationList / ManagedApplicationList]; Host Status via | ||
| > | cess SMS messages through the device settings screen, revoki | > | Apple MDM [DeviceInformation / SecurityInfo / ProfileList / | ||
| > | ng the permission if necessary. | > | restrictions and compliance queries]; Network Traffic Flow | ||
| > | via Apple Network Extension / Enterprise VPN [NEFilterFlow / | ||||
| > | per-app VPN / secure-web-gateway flow metadata]. Alert on a | ||||
| > | sequence or state change inconsistent with the device/app b | ||||
| > | aseline, approved management policy, or expected user workfl | ||||
| > | ow; do not infer unobserved API calls, file/process activity | ||||
| > | , or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) application-driven modification of device sec | t | 1 | For Android, detect Impair Defenses from documented manageme |
| > | urity posture or monitoring capability (e.g., accessibility | > | nt, network, or vetting evidence; treat state queries as per | ||
| > | abuse, disabling security app components, altering monitorin | > | iodic observations rather than real-time events. Correlate A | ||
| > | g configuration), (2) immediate degradation or cessation of | > | pplication Permission via Android Enterprise DPC / Applicati | ||
| > | expected telemetry sources such as mobile EDR, sensor visibi | > | on Vetting [DevicePolicyManager.getPermissionGrantState(); P | ||
| > | lity, or system monitoring, and (3) subsequent application a | > | ackageManager manifest/requested-permission review]; OS API | ||
| > | ctivity continuing with reduced observability. The defender | > | Execution via Application Vetting / Instrumented Dynamic Ana | ||
| > | observes a causal chain where defensive visibility or enforc | > | lysis [Dynamic API/runtime trace: App invokes package manage | ||
| > | ement is altered first, followed by continued execution unde | > | ment, DevicePolicyManager, or settings operations capable of | ||
| > | r reduced monitoring conditions. | > | disabling security tooling \u2014 API invocation to disable secu | ||
| > | rity control]. Alert on a sequence or state change inconsist | ||||
| > | ent with the device/app baseline, approved management policy | ||||
| > | , or expected user workflow; do not infer unobserved API cal | ||||
| > | ls, file/process activity, or payload content from managemen | ||||
| > | t state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | If the user sees a notification with text they do not recogn | t | 1 | For Android, detect Out of Band Data by correlating analyst- |
| > | ize, they should review their list of installed applications | > | visible device/network evidence and management state; use st | ||
| > | . | > | reaming or batched telemetry only where the documented colle | ||
| > | ctor is deployed. Correlate API Calls via Application Vettin | ||||
| > | g / Instrumented Dynamic Analysis [Dynamic API/runtime trace | ||||
| > | : NotificationListenerService.onNotificationPosted() receivi | ||||
| > | ng notifications from source_app IN $HighValueNotifApps$ by | ||||
| > | listener NOT IN $NotificationAllowList$]; Network Traffic Co | ||||
| > | ntent via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) | ||||
| > | inspection or proxy transaction metadata where enterprise d | ||||
| > | ecryption/inspection is deployed]; System Notifications via | ||||
| > | Android Enterprise / Managed App Telemetry [Documented DPC/a | ||||
| > | dmin callbacks or managed-app generated event telemetry]. Al | ||||
| > | ert on a sequence or state change inconsistent with the devi | ||||
| > | ce/app baseline, approved management policy, or expected use | ||||
| > | r workflow; do not infer unobserved API calls, file/process | ||||
| > | activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | If the user sees a notification with text they do not recogn | t | 1 | For iOS, detect Out of Band Data by correlating analyst-visi |
| > | ize, they should review their list of installed applications | > | ble device/network evidence and management state; use stream | ||
| > | . | > | ing or batched telemetry only where the documented collector | ||
| > | is deployed. Correlate Application Permission via Applicati | ||||
| > | on Vetting [Code-signing entitlements and Info.plist privacy | ||||
| > | usage-description keys]; Network Traffic Flow via Apple Net | ||||
| > | work Extension / Enterprise VPN [NEFilterFlow / per-app VPN | ||||
| > | / secure-web-gateway flow metadata]; Protected Configuration | ||||
| > | via Apple MDM [DeviceInformation / SecurityInfo / ProfileLi | ||||
| > | st / restrictions and compliance queries]. Alert on a sequen | ||||
| > | ce or state change inconsistent with the device/app baseline | ||||
| > | , approved management policy, or expected user workflow; do | ||||
| > | not infer unobserved API calls, file/process activity, or pa | ||||
| > | yload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) modification or replacement of system runtime | t | 1 | For Android, detect System Runtime API Hijacking primarily d |
| > | libraries or API resolution paths, (2) repeated invocation | > | uring application vetting or controlled analysis rather than | ||
| > | of hijacked APIs across multiple applications, and (3) incon | > | assuming a live device SOC feed. Correlate OS API Execution | ||
| > | sistent or suppressed outputs from those APIs compared to ex | > | via Application Vetting / Instrumented Dynamic Analysis [Dy | ||
| > | pected OS-enforced behavior. The defender observes a causal | > | namic API/runtime trace: Multiple applications invoking core | ||
| > | chain where system-level API behavior is altered, resulting | > | system APIs (sensor, permission, telephony, PackageManager) | ||
| > | in multiple applications exhibiting consistent anomalies in | > | show inconsistent, suppressed, or modified return values co | ||
| > | sensor access, permission checks, or system state reporting. | > | mpared to OS-expected behavior \u2014 cross-app API result incons | ||
| > | istency is the runtime hi]; OS API Execution via Application | ||||
| > | Vetting / Instrumented Dynamic Analysis [Dynamic API/runtim | ||||
| > | e trace: Device integrity degradation (root detected, system | ||||
| > | partition modification, SafetyNet/Play Integrity failure) c | ||||
| > | oincident with anomalous system API behavior affecting runti | ||||
| > | me resolution]. Alert on a sequence or state change inconsis | ||||
| > | tent with the device/app baseline, approved management polic | ||||
| > | y, or expected user workflow; do not infer unobserved API ca | ||||
| > | lls, file/process activity, or payload content from manageme | ||||
| > | nt state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) a malicious application gaining or using a re | t | 1 | For Android, detect Uninstall Malicious Application from doc |
| > | moval-capable control path, such as device owner or delegate | > | umented management, network, or vetting evidence; treat stat | ||
| > | d app-management authority, accessibility service control ov | > | e queries as periodic observations rather than real-time eve | ||
| > | er uninstall UI, or rooted filesystem access, (2) initiation | > | nts. Correlate Application Permission via Android Enterprise | ||
| > | of uninstall or package-removal behavior, and (3) disappear | > | DPC / Application Vetting [DevicePolicyManager.getPermissio | ||
| > | ance of the application from installed-state inventory or ap | > | nGrantState(); PackageManager manifest/requested-permission | ||
| > | p runtime immediately afterward, often with a short-lived fi | > | review]; File Deletion via Application Vetting / Forensic Ac | ||
| > | nal burst of local cleanup or outbound communication. The de | > | quisition [Dynamic filesystem trace or acquired app-containe | ||
| > | fender observes a causal chain where the application first e | > | r/filesystem artifacts: App deletes package files or local s | ||
| > | stablishes the ability to remove itself, then triggers unins | > | tate immediately before package inventory disappearance \u2014 pr | ||
| > | tall or deletion, and then vanishes from expected app presen | > | e-removal evidence cleanup]; OS API Execution via Applicatio | ||
| > | ce while device activity continues. | > | n Vetting / Instrumented Dynamic Analysis [Dynamic API/runti | ||
| > | me trace: App invokes PackageInstaller uninstall or pm unins | ||||
| > | tall for own package or companion package NOT IN $ProtectedP | ||||
| > | ackageList$ without user-initiated UI flow matching]. Alert | ||||
| > | on a sequence or state change inconsistent with the device/a | ||||
| > | pp baseline, approved management policy, or expected user wo | ||||
| > | rkflow; do not infer unobserved API calls, file/process acti | ||||
| > | vity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates a causal chain where a device transition | t | 1 | For Android, detect Replication Through Removable Media by c |
| > | s into USB debugging or file transfer mode after a physical | > | orrelating analyst-visible device/network evidence and manag | ||
| > | connection event, followed by application installation, file | > | ement state; use streaming or batched telemetry only where t | ||
| > | replication, or execution originating from the USB interfac | > | he documented collector is deployed. Correlate Application P | ||
| > | e rather than the application store ecosystem. | > | ermission via Android Enterprise DPC / Application Vetting [ | ||
| > | DevicePolicyManager.getPermissionGrantState(); PackageManage | ||||
| > | r manifest/requested-permission review]; File Creation via A | ||||
| > | pplication Vetting / Forensic Acquisition [Dynamic filesyste | ||||
| > | m trace or acquired app-container/filesystem artifacts: File | ||||
| > | with binary signature (.apk, .dex, .so, .sh) written to app | ||||
| > | storage or /data/local/tmp/ from USB-mounted path or extern | ||||
| > | al storage within $USBInstallWindow$]; Process Creation via | ||||
| > | Application Vetting / Managed Device Telemetry [Application | ||||
| > | installed with install_source=adb or install_source=sideload | ||||
| > | from USB-connected host within $USBInstallWindow$ of USB mo | ||||
| > | de change]. Alert on a sequence or state change inconsistent | ||||
| > | with the device/app baseline, approved management policy, o | ||||
| > | r expected user workflow; do not infer unobserved API calls, | ||||
| > | file/process activity, or payload content from management s | ||||
| > | tate alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates a chain where a device establishes a new | t | 1 | For iOS, detect Replication Through Removable Media from doc |
| > | trusted USB host pairing or enters developer/debug configur | > | umented management, network, or vetting evidence; treat stat | ||
| > | ation state, followed by device data extraction activity, co | > | e queries as periodic observations rather than real-time eve | ||
| > | nfiguration manipulation, or abnormal application behavior s | > | nts. Correlate Host Status via Apple MDM [DeviceInformation | ||
| > | hortly after the pairing event. | > | / SecurityInfo / ProfileList / restrictions and compliance q | ||
| > | ueries]; Protected Configuration via Apple MDM [DeviceInform | ||||
| > | ation / SecurityInfo / ProfileList / restrictions and compli | ||||
| > | ance queries]; System Settings via Apple MDM [DeviceInformat | ||||
| > | ion / SecurityInfo / ProfileList / restrictions and complian | ||||
| > | ce queries]. Alert on a sequence or state change inconsisten | ||||
| > | t with the device/app baseline, approved management policy, | ||||
| > | or expected user workflow; do not infer unobserved API calls | ||||
| > | , file/process activity, or payload content from management | ||||
| > | state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes an app/package attempting to enumerate run | t | 1 | For Android, detect Process Discovery by correlating analyst |
| > | ning processes by triggering restricted process visibility m | > | -visible device/network evidence and management state; use s | ||
| > | echanisms (e.g., repeated queries for running tasks/services | > | treaming or batched telemetry only where the documented coll | ||
| > | , rapid iteration over process identifiers, or access attemp | > | ector is deployed. Correlate File Access via Application Vet | ||
| > | ts against /proc entries) that are atypical for its declared | > | ting / Forensic Acquisition [Dynamic filesystem trace or acq | ||
| > | function and occur without an associated user-facing diagno | > | uired app-container/filesystem artifacts: opendir('/proc/') | ||
| > | stic workflow. The detection relies on correlating (1) OS/AP | > | with recursive listdir by app NOT IN $ProcessDiscoveryAllowL | ||
| > | I calls or shell/system utility execution indicative of proc | > | ist$ on device with android_version < $HidepidVersion$]; Net | ||
| > | ess listing or /proc traversal, (2) app privilege context (r | > | work Connection Creation via Android Enterprise Network Logg | ||
| > | oot, debug build, device owner/profile owner, accessibility/ | > | ing / Enterprise VPN [DevicePolicyManager.retrieveNetworkLog | ||
| > | IME status), (3) background execution state, and (4) optiona | > | s(): DnsEvent / ConnectEvent; VPN flow metadata]; Process Me | ||
| > | l follow-on behaviors consistent with automated discovery (s | > | tadata via Application Vetting / Instrumented Dynamic Analys | ||
| > | hort bursts of local IPC probes, network beacons immediately | > | is [Dynamic API/runtime trace: running process names read fr | ||
| > | after enumeration, or rapid targeting of specific high-valu | > | om /proc/<PID>/status or /proc/<PID>/cmdline by app NOT IN $ | ||
| > | e package/process names). The analytic should describe what | > | ProcessDiscoveryAllowList$]. Alert on a sequence or state ch | ||
| > | is observable: repeated enumeration signals + privilege cont | > | ange inconsistent with the device/app baseline, approved man | ||
| > | ext + timing relationship, not the adversary\u2019s intent. | > | agement policy, or expected user workflow; do not infer unob | ||
| > | served API calls, file/process activity, or payload content | ||||
| > | from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes signals consistent with attempted process | t | 1 | For iOS, detect Process Discovery by correlating analyst-vis |
| > | listing on iOS where modern OS protections generally prevent | > | ible device/network evidence and management state; use strea | ||
| > | broad process enumeration for non-root apps. Detections the | > | ming or batched telemetry only where the documented collecto | ||
| > | refore focus on: (1) feasibility gating via integrity/jailbr | > | r is deployed. Correlate Application State via Apple MDM [In | ||
| > | eak posture, and (2) observable security/log anomalies consi | > | stalledApplicationList / ManagedApplicationList]; Host Statu | ||
| > | stent with attempts to query process tables or restricted sy | > | s via Apple MDM [DeviceInformation / SecurityInfo / ProfileL | ||
| > | stem interfaces (e.g., repeated sandbox denials, suspicious | > | ist / restrictions and compliance queries]; Network Traffic | ||
| > | sysctl-like access attempts, or abnormal use of private fram | > | Flow via Apple Network Extension / Enterprise VPN [NEFilterF | ||
| > | eworks). Correlate integrity compromise indicators with repe | > | low / per-app VPN / secure-web-gateway flow metadata]. Alert | ||
| > | ated restricted-access events and optional follow-on behavio | > | on a sequence or state change inconsistent with the device/ | ||
| > | rs (rapid targeting of specific bundles/services or immediat | > | app baseline, approved management policy, or expected user w | ||
| > | e network beacons) to raise confidence that process discover | > | orkflow; do not infer unobserved API calls, file/process act | ||
| > | y is occurring. | > | ivity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) application acquisition or use of elevated co | t | 1 | For Android, detect Disable or Modify Tools from documented |
| > | ntrol paths capable of altering defensive tooling or protect | > | management, network, or vetting evidence; treat state querie | ||
| > | ed system state, such as device administration, root-enabled | > | s as periodic observations rather than real-time events. Cor | ||
| > | modification, or security-setting manipulation, (2) direct | > | relate Application Permission via Android Enterprise DPC / A | ||
| > | changes to security-tool configuration, service state, packa | > | pplication Vetting [DevicePolicyManager.getPermissionGrantSt | ||
| > | ge state, or protected enforcement settings such as SELinux- | > | ate(); PackageManager manifest/requested-permission review]; | ||
| > | relevant files or security-app components, and (3) immediate | > | File Creation via Application Vetting / Forensic Acquisitio | ||
| > | degradation, suppression, or disappearance of expected secu | > | n [Dynamic filesystem trace or acquired app-container/filesy | ||
| > | rity telemetry while the device and initiating application r | > | stem artifacts: App writes to or modifies protected configur | ||
| > | emain active. The defender observes a causal chain where a s | > | ation files or local control structures of deployed security | ||
| > | ecurity control is modified first, then monitoring or protec | > | tools]; OS API Execution via Application Vetting / Instrume | ||
| > | tion weakens, and subsequent activity continues under reduce | > | nted Dynamic Analysis [Dynamic API/runtime trace: App invoke | ||
| > | d defensive visibility. | > | s package manager operations (disable component, clear data, | ||
| > | request uninstall) or settings modifications targeting secu | ||||
| > | rity tool packages IN $SecurityToolPackageList$]. Alert on a | ||||
| > | sequence or state change inconsistent with the device/app b | ||||
| > | aseline, approved management policy, or expected user workfl | ||||
| > | ow; do not infer unobserved API calls, file/process activity | ||||
| > | , or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) abnormal application or system resource resol | t | 1 | For Android, detect Hijack Execution Flow from documented ma |
| > | ution behavior (e.g., library loading, path resolution, or i | > | nagement, network, or vetting evidence; treat state queries | ||
| > | ntent redirection), (2) execution of code or resources not a | > | as periodic observations rather than real-time events. Corre | ||
| > | ligned with the originating application\u2019s package identity o | > | late File Access via Application Vetting / Forensic Acquisit | ||
| > | r expected runtime context, and (3) follow-on execution or n | > | ion [Dynamic filesystem trace or acquired app-container/file | ||
| > | etwork activity originating from the hijacked flow. The defe | > | system artifacts: App loads executable or library from writa | ||
| > | nder observes a causal chain where execution is redirected f | > | ble external directory (/sdcard/, app cache, /data/local/tmp | ||
| > | rom an expected code path to an alternate resource or payloa | > | /) \u2014 writable-path library load is exploitable hijack vector | ||
| > | d, resulting in execution under a trusted context but with u | > | ]; OS API Execution via Application Vetting / Instrumented D | ||
| > | ntrusted origin. | > | ynamic Analysis [Dynamic API/runtime trace: App loads librar | ||
| > | y or executes component]; Process Creation via Application V | ||||
| > | etting / Managed Device Telemetry [App execution triggered w | ||||
| > | ith unexpected parent context or via indirect invocation (in | ||||
| > | tent redirect, implicit intent resolution to unexpected hand | ||||
| > | ler) \u2014 indirect invocation path is the flow hijack confirmat | ||||
| > | ion]. Alert on a sequence or state change inconsistent with | ||||
| > | the device/app baseline, approved management policy, or expe | ||||
| > | cted user workflow; do not infer unobserved API calls, file/ | ||||
| > | process activity, or payload content from management state a | ||||
| > | lone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A defender correlates an application being granted accessibi | t | 1 | For Android, detect Abuse Accessibility Features by correlat |
| > | lity service control with subsequent consumption of high-vol | > | ing analyst-visible device/network evidence and management s | ||
| > | ume accessibility events, interaction with sensitive UI elem | > | tate; use streaming or batched telemetry only where the docu | ||
| > | ents or text-entry fields, optional overlay/window presentat | > | mented collector is deployed. Correlate API Calls via Applic | ||
| > | ion over other applications, and near-term local buffering o | > | ation Vetting / Instrumented Dynamic Analysis [Dynamic API/r | ||
| > | r outbound network transmission, indicating abuse of accessi | > | untime trace: AccessibilityService receiving events from dc( | ||
| > | bility features for input capture, credential theft, or auto | > | source_app) > $AccessibilityTargetThreshold$ distinct apps I | ||
| > | mated interaction. | > | NCLUDING apps IN $TargetAppList$ \u2014 broad monitoring across a | ||
| > | pps distinguishes malware from single-purpose assistive tech | ||||
| > | ]; Network Traffic Content via Enterprise Secure Web Gateway | ||||
| > | / Proxy [DNS/HTTP(S) inspection or proxy transaction metada | ||||
| > | ta where enterprise decryption/inspection is deployed]; Perm | ||||
| > | issions Request via Android Enterprise DPC / Application Vet | ||||
| > | ting [DevicePolicyManager.getPermissionGrantState(); Package | ||||
| > | Manager manifest/requested-permission review]. Alert on a se | ||||
| > | quence or state change inconsistent with the device/app base | ||||
| > | line, approved management policy, or expected user workflow; | ||||
| > | do not infer unobserved API calls, file/process activity, o | ||||
| > | r payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) continuous or repeated use of motion or inter | t | 1 | For Android, detect User Evasion from documented management, |
| > | action-inference signals that do not require overt user-faci | > | network, or vetting evidence; treat state queries as period | ||
| > | ng privilege prompts, (2) suppression of higher-risk behavio | > | ic observations rather than real-time events. Correlate Appl | ||
| > | r while user presence or active handling is inferred, and (3 | > | ication State via Android Enterprise / EMM [Managed package | ||
| > | ) resumption of background execution, sensor use, local data | > | inventory/status and package metadata]; OS API Execution via | ||
| > | handling, or network activity only when device interaction | > | Application Vetting / Instrumented Dynamic Analysis [Dynami | ||
| > | falls below a threshold. The defender observes a causal chai | > | c API/runtime trace: App invokes SensorManager.registerListe | ||
| > | n where an application senses user/device interaction state | > | ner() for TYPE_ACCELEROMETER or TYPE_GYROSCOPE NOT IN $Appro | ||
| > | and intentionally gates malicious behavior to user-inactive | > | vedMotionApps$ followed by conditional execution branching c | ||
| > | periods. | > | orrelated with sensor readings \u2014 motion sensing followed by | ||
| > | behavioral conditiona]. Alert on a sequence or state change | ||||
| > | inconsistent with the device/app baseline, approved manageme | ||||
| > | nt policy, or expected user workflow; do not infer unobserve | ||||
| > | d API calls, file/process activity, or payload content from | ||||
| > | management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates repeated inbound retrieval and outbo | t | 1 | For Android, detect Bidirectional Communication by correlati |
| > | und submission activity by the same Android app identity to | > | ng analyst-visible device/network evidence and management st | ||
| > | the same legitimate public web-service class within a short | > | ate; use streaming or batched telemetry only where the docum | ||
| > | operational window, where the two-way exchange is inconsiste | > | ented collector is deployed. Correlate Application Permissio | ||
| > | nt with the app's approved role, interaction model, or backg | > | n via Android Enterprise DPC / Application Vetting [DevicePo | ||
| > | round behavior baseline. The strongest Android evidence is a | > | licyManager.getPermissionGrantState(); PackageManager manife | ||
| > | pp-attributed communication to collaboration, social, cloud | > | st/requested-permission review]; Application State via Andro | ||
| > | storage, code-hosting, messaging, or generic HTTPS platforms | > | id Enterprise / EMM [Managed package inventory/status and pa | ||
| > | where requests that retrieve content are followed by app-at | > | ckage metadata]; File Creation via Application Vetting / For | ||
| > | tributed posts, uploads, document updates, API writes, or re | > | ensic Acquisition [Dynamic filesystem trace or acquired app- | ||
| > | peated small bidirectional exchanges, especially when they o | > | container/filesystem artifacts: Local file write between inb | ||
| > | ccur while the app is backgrounded, while the device is lock | > | ound retrieval]. Alert on a sequence or state change inconsi | ||
| > | ed, without recent user interaction, or shortly after local | > | stent with the device/app baseline, approved management poli | ||
| > | staging or protected-resource access. | > | cy, or expected user workflow; do not infer unobserved API c | ||
| > | alls, file/process activity, or payload content from managem | ||||
| > | ent state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates repeated retrieval and outbound subm | t | 1 | For iOS, detect Bidirectional Communication by correlating a |
| > | ission activity from a supervised device or managed iOS app | > | nalyst-visible device/network evidence and management state; | ||
| > | to the same legitimate public web-service class where the tw | > | use streaming or batched telemetry only where the documente | ||
| > | o-way exchange does not fit the bundle's approved role or ex | > | d collector is deployed. Correlate Application Permission vi | ||
| > | pected background-refresh model. The strongest iOS evidence | > | a Application Vetting [Code-signing entitlements and Info.pl | ||
| > | is managed-app or device-attributed communication to collabo | > | ist privacy usage-description keys]; Application State via A | ||
| > | ration, storage, messaging, social, or generic HTTPS platfor | > | pple MDM [InstalledApplicationList / ManagedApplicationList] | ||
| > | ms where inbound content fetches are followed by outbound wr | > | ; Network Traffic Content via Enterprise Secure Web Gateway | ||
| > | ites, uploads, updates, or message submissions within a shor | > | / Proxy [DNS/HTTP(S) inspection or proxy transaction metadat | ||
| > | t window, especially when occurring during background refres | > | a where enterprise decryption/inspection is deployed]. Alert | ||
| > | h, while the device is locked, or without recent user intera | > | on a sequence or state change inconsistent with the device/ | ||
| > | ction. Because direct local runtime visibility is weaker tha | > | app baseline, approved management policy, or expected user w | ||
| > | n Android, the primary analytic is anchored on network direc | > | orkflow; do not infer unobserved API calls, file/process act | ||
| > | tionality plus supervised managed-app and device-state conte | > | ivity, or payload content from management state alone. | ||
| > | xt. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes anomalous access to remote device manageme | t | 1 | For Android, detect Remote Device Management Services by cor |
| > | nt or enterprise mobility management control planes followed | > | relating analyst-visible device/network evidence and managem | ||
| > | by device-state queries, location requests, or management a | > | ent state; use streaming or batched telemetry only where the | ||
| > | ctions inconsistent with user role, historical behavior, or | > | documented collector is deployed. Correlate Cloud Service E | ||
| > | device ownership context. | > | numeration via Application Vetting / Cloud Service Audit [In | ||
| > | strumented app API trace and corresponding cloud-service aud | ||||
| > | it/API telemetry]; Protected Configuration via Android Enter | ||||
| > | prise DPC [DevicePolicyManager policy/compliance/security-st | ||||
| > | ate queries and SecurityLog events where supported]; User Ac | ||||
| > | count Authentication via Application Vetting / Identity Prov | ||||
| > | ider Telemetry [App authentication flow instrumentation or I | ||||
| > | dP sign-in/audit events]. Alert on a sequence or state chang | ||||
| > | e inconsistent with the device/app baseline, approved manage | ||||
| > | ment policy, or expected user workflow; do not infer unobser | ||||
| > | ved API calls, file/process activity, or payload content fro | ||||
| > | m management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes anomalous authentication or session activi | t | 1 | For iOS, detect Remote Device Management Services by correla |
| > | ty targeting remote device management services followed by d | > | ting analyst-visible device/network evidence and management | ||
| > | evice-tracking queries, device-state requests, or remote act | > | state; use streaming or batched telemetry only where the doc | ||
| > | ions inconsistent with established user-device relationships | > | umented collector is deployed. Correlate Application State v | ||
| > | or operational patterns. | > | ia Apple MDM [InstalledApplicationList / ManagedApplicationL | ||
| > | ist]; Cloud Service Enumeration via Application Vetting / Cl | ||||
| > | oud Service Audit [Instrumented app API trace and correspond | ||||
| > | ing cloud-service audit/API telemetry]; User Account Authent | ||||
| > | ication via Application Vetting / Identity Provider Telemetr | ||||
| > | y [App authentication flow instrumentation or IdP sign-in/au | ||||
| > | dit events]. Alert on a sequence or state change inconsisten | ||||
| > | t with the device/app baseline, approved management policy, | ||||
| > | or expected user workflow; do not infer unobserved API calls | ||||
| > | , file/process activity, or payload content from management | ||||
| > | state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates call-control capability or telecom r | t | 1 | For Android, detect Call Control from documented management, |
| > | ole state with subsequent unauthorized call initiation, answ | > | network, or vetting evidence; treat state queries as period | ||
| > | er, block, redirect, or concealment behavior by an applicati | > | ic observations rather than real-time events. Correlate Appl | ||
| > | on outside expected telephony workflows. The analytic priori | > | ication Permission via Android Enterprise DPC / Application | ||
| > | tizes Android-observable control-plane effects: dangerous or | > | Vetting [DevicePolicyManager.getPermissionGrantState(); Pack | ||
| > | role-gated call-control permissions, default dialer or Conn | > | ageManager manifest/requested-permission review]; File Modif | ||
| > | ectionService-related role changes, telecom framework invoca | > | ication via Application Vetting / Forensic Acquisition [Dyna | ||
| > | tion for call placement or handling, write activity against | > | mic filesystem trace or acquired app-container/filesystem ar | ||
| > | call-log records, and call-control activity occurring from b | > | tifacts: App inserts, updates, or deletes call log records v | ||
| > | ackground or locked-device context without recent user inter | > | ia CallLog.Calls ContentProvider immediately after call-cont | ||
| > | action. | > | rol action \u2014 call log tampering to conceal interception]; OS | ||
| > | API Execution via Application Vetting / Instrumented Dynami | ||||
| > | c Analysis [Dynamic API/runtime trace: App invokes TelecomMa | ||||
| > | nager.answerCall(), placeCall(), endCall(), or ConnectionSer | ||||
| > | vice call-handling operations without corresponding user-ini | ||||
| > | tiated call UI interaction]. Alert on a sequence or state ch | ||||
| > | ange inconsistent with the device/app baseline, approved man | ||||
| > | agement policy, or expected user workflow; do not infer unob | ||||
| > | served API calls, file/process activity, or payload content | ||||
| > | from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A legitimate-seeming application or update is installed thro | t | 1 | For Android, detect Compromise Software Dependencies and Dev |
| > | ugh an expected or previously trusted path, but shortly afte | > | elopment Tools by correlating analyst-visible device/network | ||
| > | r first run or update the application exhibits new runtime b | > | evidence and management state; use streaming or batched tel | ||
| > | ehavior, sensor use, file staging, or network communications | > | emetry only where the documented collector is deployed. Corr | ||
| > | inconsistent with its historical baseline, documented role, | > | elate Application Permission via Android Enterprise DPC / Ap | ||
| > | or prior version. The defender specifically looks for behav | > | plication Vetting [DevicePolicyManager.getPermissionGrantSta | ||
| > | iors commonly introduced by compromised third-party librarie | > | te(); PackageManager manifest/requested-permission review]; | ||
| > | s or manipulated build tooling, such as unexpected backgroun | > | Application State via Android Enterprise / EMM [Managed pack | ||
| > | d service activation, first-seen framework use, new permissi | > | age inventory/status and package metadata]; OS API Execution | ||
| > | ons exercised, novel network destinations, or dropped local | > | via Application Vetting / Instrumented Dynamic Analysis [Dy | ||
| > | artifacts not aligned to the app's expected function. | > | namic API/runtime trace: App begins first-seen network conne | ||
| > | ctions to destinations matching known-malicious SDK C2 patte | ||||
| > | rns or outside $SDKBaselineEndpoints$ for embedded SDK names | ||||
| > | pace]. Alert on a sequence or state change inconsistent with | ||||
| > | the device/app baseline, approved management policy, or exp | ||||
| > | ected user workflow; do not infer unobserved API calls, file | ||||
| > | /process activity, or payload content from management state | ||||
| > | alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A legitimate-seeming app or update arrives through an expect | t | 1 | For iOS, detect Compromise Software Dependencies and Develop |
| > | ed or trusted distribution path, but the delivered applicati | > | ment Tools from documented management, network, or vetting e | ||
| > | on begins showing new entitlement exercise, background activ | > | vidence; treat state queries as periodic observations rather | ||
| > | ity, framework use, sensor access, or network behavior incon | > | than real-time events. Correlate Application Permission via | ||
| > | sistent with its prior baseline or documented role. Because | > | Application Vetting [Code-signing entitlements and Info.pli | ||
| > | direct inspection of compromised dependencies or developer t | > | st privacy usage-description keys]; Application State via Ap | ||
| > | ooling is weaker on iOS, the defender emphasizes supervised- | > | ple MDM [InstalledApplicationList / ManagedApplicationList]; | ||
| > | device app inventory, post-update behavior drift, new first- | > | OS API Execution via Application Vetting / Instrumented Dyn | ||
| > | run or background patterns, and downstream communications th | > | amic Analysis [Dynamic API/runtime trace: Known app begins f | ||
| > | at suggest compromised embedded libraries or manipulated bui | > | irst-seen use of protected categories (analytics, location, | ||
| > | ld outputs. | > | contacts) matching known-SDK behavior patterns post-update]. | ||
| > | Alert on a sequence or state change inconsistent with the d | ||||
| > | evice/app baseline, approved management policy, or expected | ||||
| > | user workflow; do not infer unobserved API calls, file/proce | ||||
| > | ss activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes an app gaining input-observation capabilit | t | 1 | For Android, detect Input Capture by correlating analyst-vis |
| > | y (AccessibilityService enablement, default IME set, draw-ov | > | ible device/network evidence and management state; use strea | ||
| > | er-apps permission), then creating an intercept surface (ove | > | ming or batched telemetry only where the documented collecto | ||
| > | rlay window, accessibility event stream consumption or IME k | > | r is deployed. Correlate API Calls via Application Vetting / | ||
| > | eystroke callbacks), followed by persistence (local keylog/c | > | Instrumented Dynamic Analysis [Dynamic API/runtime trace: A | ||
| > | lipboard dump) and/or small, frequent network egress. Chain: | > | ccessibilityEvent.TYPE_VIEW_TEXT_CHANGED received by listene | ||
| > | capability/permission \u2192 listener/overlay activation \u2192 burst | > | r_app NOT IN $AccessibilityAllowList$]; Network Traffic Flow | ||
| > | y input read events \u2192 local write \u2192 near-term exfil. | > | via Android Enterprise Network Logging / Enterprise VPN [De | ||
| > | vicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectE | ||||
| > | vent; VPN flow metadata]; Permissions Request via Android En | ||||
| > | terprise DPC / Application Vetting [DevicePolicyManager.getP | ||||
| > | ermissionGrantState(); PackageManager manifest/requested-per | ||||
| > | mission review]. Alert on a sequence or state change inconsi | ||||
| > | stent with the device/app baseline, approved management poli | ||||
| > | cy, or expected user workflow; do not infer unobserved API c | ||||
| > | alls, file/process activity, or payload content from managem | ||||
| > | ent state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender observes an app enabling or using input-capture sur | t | 1 | For iOS, detect Input Capture by correlating analyst-visible |
| > | faces (custom keyboard extension with Full Access, abnormal | > | device/network evidence and management state; use streaming | ||
| > | UI text entry interception, pasteboard polling adjacent to l | > | or batched telemetry only where the documented collector is | ||
| > | ogin screens), then persisting and/or exfiltrating captured | > | deployed. Correlate Application State via Apple MDM [Instal | ||
| > | input. Chain: capability/consent (TCC for keyboard Full Acce | > | ledApplicationList / ManagedApplicationList]; Network Traffi | ||
| > | ss or input privacy domains) \u2192 intercept behavior (keyboard | > | c Flow via Apple Network Extension / Enterprise VPN [NEFilte | ||
| > | extension active, repeated text field \u2018editingChanged\u2019/secur | > | rFlow / per-app VPN / secure-web-gateway flow metadata]; Per | ||
| > | e entry focus, background pasteboard reads) \u2192 local write \u2192 | > | missions Request via Application Vetting [Code-signing entit | ||
| > | near-term egress. | > | lements and Info.plist privacy usage-description keys]. Aler | ||
| > | t on a sequence or state change inconsistent with the device | ||||
| > | /app baseline, approved management policy, or expected user | ||||
| > | workflow; do not infer unobserved API calls, file/process ac | ||||
| > | tivity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates app-attributed outbound sessions whe | t | 1 | For Android, detect Non-Standard Port by correlating analyst |
| > | re protocol indicators such as TLS handshake, HTTP method an | > | -visible device/network evidence and management state; use s | ||
| > | d header patterns, DNS semantics, or other application-layer | > | treaming or batched telemetry only where the documented coll | ||
| > | characteristics are observed over a destination port outsid | > | ector is deployed. Correlate Application Permission via Andr | ||
| > | e the approved baseline for that protocol and app role. The | > | oid Enterprise DPC / Application Vetting [DevicePolicyManage | ||
| > | strongest Android evidence is repeated or persistent app-att | > | r.getPermissionGrantState(); PackageManager manifest/request | ||
| > | ributed traffic using HTTPS-, HTTP-, DNS-, WebSocket-, or ot | > | ed-permission review]; Application State via Android Enterpr | ||
| > | her recognizable application behavior over uncommon destinat | > | ise / EMM [Managed package inventory/status and package meta | ||
| > | ion ports, especially when the app is backgrounded, while th | > | data]; Network Traffic Content via Enterprise Secure Web Gat | ||
| > | e device is locked, without recent user interaction, or when | > | eway / Proxy [DNS/HTTP(S) inspection or proxy transaction me | ||
| > | the app is unmanaged or not approved for that protocol-to-p | > | tadata where enterprise decryption/inspection is deployed]. | ||
| > | ort pairing. | > | Alert on a sequence or state change inconsistent with the de | ||
| > | vice/app baseline, approved management policy, or expected u | ||||
| > | ser workflow; do not infer unobserved API calls, file/proces | ||||
| > | s activity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates managed-app or supervised-device out | t | 1 | For iOS, detect Non-Standard Port by correlating analyst-vis |
| > | bound sessions where protocol indicators such as TLS handsha | > | ible device/network evidence and management state; use strea | ||
| > | ke, HTTP semantics, or other application-layer behaviors are | > | ming or batched telemetry only where the documented collecto | ||
| > | observed over destination ports outside the approved baseli | > | r is deployed. Correlate Application Permission via Applicat | ||
| > | ne for that protocol and bundle role. The strongest iOS evid | > | ion Vetting [Code-signing entitlements and Info.plist privac | ||
| > | ence is network telemetry showing repeated or persistent ses | > | y usage-description keys]; Application State via Apple MDM [ | ||
| > | sions using recognizable application protocols over uncommon | > | InstalledApplicationList / ManagedApplicationList]; Network | ||
| > | ports, particularly during background refresh, while the de | > | Traffic Content via Enterprise Secure Web Gateway / Proxy [D | ||
| > | vice is locked, or without recent user interaction. Because | > | NS/HTTP(S) inspection or proxy transaction metadata where en | ||
| > | direct local runtime attribution is weaker than Android, the | > | terprise decryption/inspection is deployed]. Alert on a sequ | ||
| > | primary iOS analytic should be anchored on network protocol | > | ence or state change inconsistent with the device/app baseli | ||
| > | -versus-port mismatch plus supervised managed-app context an | > | ne, approved management policy, or expected user workflow; d | ||
| > | d device-state enrichment. | > | o not infer unobserved API calls, file/process activity, or | ||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates creation or registration of deferred | t | 1 | For Android, detect Scheduled Task/Job primarily during appl |
| > | , repeating, or constraint-based background work with later | > | ication vetting or controlled analysis rather than assuming | ||
| > | task execution in the same app context, especially when the | > | a live device SOC feed. Correlate OS API Execution via Appli | ||
| > | task executes without recent user interaction, from backgrou | > | cation Vetting / Instrumented Dynamic Analysis [Dynamic API/ | ||
| > | nd state, or with follow-on file, sensor, or network behavio | > | runtime trace: App enqueues WorkManager work, schedules JobS | ||
| > | r inconsistent with the app's declared role. The analytic pr | > | cheduler job, or sets AlarmManager with repeating interval N | ||
| > | ioritizes Android-observable control-plane effects: WorkMana | > | OT IN $ApprovedSchedulerApps$]; Scheduled Job Creation via A | ||
| > | ger enqueue operations, JobScheduler or AlarmManager schedul | > | pplication Vetting / Forensic Acquisition [Dynamic filesyste | ||
| > | ing, later wake or execution of the scheduled work, and post | > | m trace or acquired app-container/filesystem artifacts: Sche | ||
| > | -trigger activity such as network sessions, local staging, o | > | duled task execution creates file, accesses sensor, or initi | ||
| > | r sensor access. | > | ates network connection immediately after firing, with no re | ||
| > | cent user interaction triggering the task]. Alert on a seque | ||||
| > | nce or state change inconsistent with the device/app baselin | ||||
| > | e, approved management policy, or expected user workflow; do | ||||
| > | not infer unobserved API calls, file/process activity, or p | ||||
| > | ayload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates creation of background scheduler act | t | 1 | For iOS, detect Scheduled Task/Job primarily during applicat |
| > | ivity with later execution of repeating or deferred work by | > | ion vetting or controlled analysis rather than assuming a li | ||
| > | the same managed app, then raises confidence when the trigge | > | ve device SOC feed. Correlate OS API Execution via Applicati | ||
| > | red activity produces network, local-write, or other app beh | > | on Vetting / Instrumented Dynamic Analysis [Dynamic API/runt | ||
| > | avior that occurs outside expected user context. Because iOS | > | ime trace: Managed app creates NSBackgroundActivityScheduler | ||
| > | exposes weaker direct scheduling observability in many ente | > | activity or registers BGTask with repeating=true or deferre | ||
| > | rprise environments, the analytic anchors first on managed a | > | d interval outside $ApprovedSchedulerApps$ function]; Schedu | ||
| > | pp posture and lifecycle-to-network or lifecycle-to-file eff | > | led Job Creation via Application Vetting / Forensic Acquisit | ||
| > | ects, with NSBackgroundActivityScheduler-related behavior tr | > | ion [Dynamic filesystem trace or acquired app-container/file | ||
| > | eated as strongest when runtime telemetry can observe backgr | > | system artifacts: Scheduled task execution produces network, | ||
| > | ound scheduler usage or execution callbacks. | > | local-write, or sensor artifact while app_state=background | ||
| > | or device_locked=true without user trigger]. Alert on a sequ | ||||
| > | ence or state change inconsistent with the device/app baseli | ||||
| > | ne, approved management policy, or expected user workflow; d | ||||
| > | o not infer unobserved API calls, file/process activity, or | ||||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for usage of the `RE | t | 1 | For Android, detect Internet Connection Discovery by correla |
| > | AD_PRIVILEGED_PHONE_STATE` Android permission. This could in | > | ting analyst-visible device/network evidence and management | ||
| > | dicate that non-system apps are attempting to access informa | > | state; use streaming or batched telemetry only where the doc | ||
| > | tion that they do not have access to. | > | umented collector is deployed. Correlate API Calls via Appli | ||
| > | cation Vetting / Instrumented Dynamic Analysis [Dynamic API/ | ||||
| > | runtime trace: ConnectivityManager.getActiveNetworkInfo() or | ||||
| > | InetAddress.isReachable() called by app NOT IN $Connectivit | ||||
| > | yAllowList$ at app launch or on schedule without user action | ||||
| > | ]; Application State via Android Enterprise / EMM [Managed p | ||||
| > | ackage inventory/status and package metadata]; Network Conne | ||||
| > | ction Creation via Android Enterprise Network Logging / Ente | ||||
| > | rprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEv | ||||
| > | ent / ConnectEvent; VPN flow metadata]. Alert on a sequence | ||||
| > | or state change inconsistent with the device/app baseline, a | ||||
| > | pproved management policy, or expected user workflow; do not | ||||
| > | infer unobserved API calls, file/process activity, or paylo | ||||
| > | ad content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for usage of the `RE | t | 1 | For iOS, detect Internet Connection Discovery by correlating |
| > | AD_PRIVILEGED_PHONE_STATE` Android permission. This could in | > | analyst-visible device/network evidence and management stat | ||
| > | dicate that non-system apps are attempting to access informa | > | e; use streaming or batched telemetry only where the documen | ||
| > | tion that they do not have access to. | > | ted collector is deployed. Correlate API Calls via Applicati | ||
| > | on Vetting / Instrumented Dynamic Analysis [Dynamic API/runt | ||||
| > | ime trace: NWPathMonitor.start() or SCNetworkReachabilityGet | ||||
| > | Flags() called by app NOT IN $ConnectivityAllowList$ at laun | ||||
| > | ch or on background schedule]; Application State via Apple M | ||||
| > | DM [InstalledApplicationList / ManagedApplicationList]; Netw | ||||
| > | ork Connection Creation via Apple Network Extension / Enterp | ||||
| > | rise VPN [NEFilterFlow / per-app VPN / secure-web-gateway fl | ||||
| > | ow metadata]. Alert on a sequence or state change inconsiste | ||||
| > | nt with the device/app baseline, approved management policy, | ||||
| > | or expected user workflow; do not infer unobserved API call | ||||
| > | s, file/process activity, or payload content from management | ||||
| > | state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for usage of the `RE | t | 1 | For Android, detect Wi-Fi Discovery by correlating analyst-v |
| > | AD_PRIVILEGED_PHONE_STATE` Android permission. This could in | > | isible device/network evidence and management state; use str | ||
| > | dicate that non-system apps are attempting to access informa | > | eaming or batched telemetry only where the documented collec | ||
| > | tion that they do not have access to. | > | tor is deployed. Correlate API Calls via Application Vetting | ||
| > | / Instrumented Dynamic Analysis [Dynamic API/runtime trace: | ||||
| > | WifiManager.getScanResults()]; Network Traffic Content via | ||||
| > | Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspectio | ||||
| > | n or proxy transaction metadata where enterprise decryption/ | ||||
| > | inspection is deployed]; Permissions Request via Android Ent | ||||
| > | erprise DPC / Application Vetting [DevicePolicyManager.getPe | ||||
| > | rmissionGrantState(); PackageManager manifest/requested-perm | ||||
| > | ission review]. Alert on a sequence or state change inconsis | ||||
| > | tent with the device/app baseline, approved management polic | ||||
| > | y, or expected user workflow; do not infer unobserved API ca | ||||
| > | lls, file/process activity, or payload content from manageme | ||||
| > | nt state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could look for usage of the `RE | t | 1 | For iOS, detect Wi-Fi Discovery by correlating analyst-visib |
| > | AD_PRIVILEGED_PHONE_STATE` Android permission. This could in | > | le device/network evidence and management state; use streami | ||
| > | dicate that non-system apps are attempting to access informa | > | ng or batched telemetry only where the documented collector | ||
| > | tion that they do not have access to. | > | is deployed. Correlate API Calls via Application Vetting / I | ||
| > | nstrumented Dynamic Analysis [Dynamic API/runtime trace: CNC | ||||
| > | opyCurrentNetworkInfo() or NEHotspotHelper.register() called | ||||
| > | by app NOT IN $WiFiAllowList$]; Network Traffic Content via | ||||
| > | Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspecti | ||||
| > | on or proxy transaction metadata where enterprise decryption | ||||
| > | /inspection is deployed]; Permissions Request via Applicatio | ||||
| > | n Vetting [Code-signing entitlements and Info.plist privacy | ||||
| > | usage-description keys]. Alert on a sequence or state change | ||||
| > | inconsistent with the device/app baseline, approved managem | ||||
| > | ent policy, or expected user workflow; do not infer unobserv | ||||
| > | ed API calls, file/process activity, or payload content from | ||||
| > | management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) application registration or activation of bro | t | 1 | For Android, detect Broadcast Receivers primarily during app |
| > | adcast receivers tied to system or app-generated intents, (2 | > | lication vetting or controlled analysis rather than assuming | ||
| > | ) event-triggered execution while the application is not in | > | a live device SOC feed. Correlate OS API Execution via Appl | ||
| > | the foreground, and (3) immediate follow-on actions such as | > | ication Vetting / Instrumented Dynamic Analysis [Dynamic API | ||
| > | network communication or data access. The defender observes | > | /runtime trace: Application registers BroadcastReceiver via | ||
| > | a causal chain where an external event (e.g., BOOT_COMPLETED | > | registerReceiver() or manifest-declared receiver for sensiti | ||
| > | , SMS_RECEIVED, USER_PRESENT, CONNECTIVITY_CHANGE) triggers | > | ve system intents (BOOT_COMPLETED, SMS_RECEIVED, ACTION_PACK | ||
| > | application execution that bypasses normal user-driven lifec | > | AGE_REPLACED, CONNECTIVITY_CHANGE, USER_PRESENT) NOT IN $App | ||
| > | ycle expectations, followed by background processing or outb | > | rovedReceiverApp]. Alert on a sequence or state change incon | ||
| > | ound activity. | > | sistent with the device/app baseline, approved management po | ||
| > | licy, or expected user workflow; do not infer unobserved API | ||||
| > | calls, file/process activity, or payload content from manag | ||||
| > | ement state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could detect applications tryin | t | 1 | For Android, detect Compromise Client Software Binary from d |
| > | g to modify files in protected parts of the operating system | > | ocumented management, network, or vetting evidence; treat st | ||
| > | . Verified Boot can detect unauthorized modifications to the | > | ate queries as periodic observations rather than real-time e | ||
| > | system partition.(Citation: Android-VerifiedBoot) Android\u2019s | > | vents. Correlate File Metadata via Application Vetting / For | ||
| > | SafetyNet API provides remote attestation capabilities, whi | > | ensic Acquisition [Dynamic filesystem trace or acquired app- | ||
| > | ch could potentially be used to identify and respond to comp | > | container/filesystem artifacts: file hash changes for binary | ||
| > | romised devices. Samsung Knox provides a similar remote atte | > | at $SystemBinaryPaths$ relative to known-good baseline \u2014 ha | ||
| > | station capability on supported Samsung devices. | > | sh deviation confirms modification]; File Modification via A | ||
| > | pplication Vetting / Forensic Acquisition [Dynamic filesyste | ||||
| > | m trace or acquired app-container/filesystem artifacts: writ | ||||
| > | e() to path IN $SystemBinaryPaths$ by process NOT IN $Truste | ||||
| > | dUpdateSources$]; Process Creation via Application Vetting / | ||||
| > | Managed Device Telemetry [execve() of modified binary (hash | ||||
| > | != baseline) \u2014 execution of modified binary is the persiste | ||||
| > | nce activation]. Alert on a sequence or state change inconsi | ||||
| > | stent with the device/app baseline, approved management poli | ||||
| > | cy, or expected user workflow; do not infer unobserved API c | ||||
| > | alls, file/process activity, or payload content from managem | ||||
| > | ent state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Application vetting services could detect applications tryin | t | 1 | For iOS, detect Compromise Client Software Binary by correla |
| > | g to modify files in protected parts of the operating system | > | ting analyst-visible device/network evidence and management | ||
| > | . Verified Boot can detect unauthorized modifications to the | > | state; use streaming or batched telemetry only where the doc | ||
| > | system partition.(Citation: Android-VerifiedBoot) Android\u2019s | > | umented collector is deployed. Correlate File Metadata via A | ||
| > | SafetyNet API provides remote attestation capabilities, whi | > | pplication Vetting / Forensic Acquisition [Dynamic filesyste | ||
| > | ch could potentially be used to identify and respond to comp | > | m trace or acquired app-container/filesystem artifacts: MDM | ||
| > | romised devices. Samsung Knox provides a similar remote atte | > | supervised integrity_check=fail following jailbreak detectio | ||
| > | station capability on supported Samsung devices. | > | n \u2014 integrity check failure on supervised Jamf/Intune enroll | ||
| > | ed device indicates filesystem modifications beyond passive | ||||
| > | jailbreak presence]; Host Status via Apple MDM [DeviceInform | ||||
| > | ation / SecurityInfo / ProfileList / restrictions and compli | ||||
| > | ance queries]; Network Traffic Flow via Apple Network Extens | ||||
| > | ion / Enterprise VPN [NEFilterFlow / per-app VPN / secure-we | ||||
| > | b-gateway flow metadata]. Alert on a sequence or state chang | ||||
| > | e inconsistent with the device/app baseline, approved manage | ||||
| > | ment policy, or expected user workflow; do not infer unobser | ||||
| > | ved API calls, file/process activity, or payload content fro | ||||
| > | m management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates newly granted or recently exercised | t | 1 | For Android, detect Data from Local System from documented m |
| > | storage- or privilege-relevant access with burst reads of lo | > | anagement, network, or vetting evidence; treat state queries | ||
| > | cal files, local databases, or protected records from operat | > | as periodic observations rather than real-time events. Corr | ||
| > | ing-system or external-storage locations, especially when th | > | elate Application Permission via Android Enterprise DPC / Ap | ||
| > | e reads are inconsistent with app role, occur in background | > | plication Vetting [DevicePolicyManager.getPermissionGrantSta | ||
| > | or locked-device context, or are followed by temporary data | > | te(); PackageManager manifest/requested-permission review]; | ||
| > | staging or network transmission. The analytic emphasizes And | > | File Access via Application Vetting / Forensic Acquisition [ | ||
| > | roid-specific observables such as external storage access, a | > | Dynamic filesystem trace or acquired app-container/filesyste | ||
| > | pp-private database reads where visible to the sensor, and r | > | m artifacts: App reads files across $MinDirectoryCount$+ dis | ||
| > | epeated enumeration/read activity against local paths associ | > | tinct parent directories with file_read_count > $FileReadRat | ||
| > | ated with media, tokens, caches, or exported application dat | > | eThreshold$ within $DataCollectionWindow$ in background or l | ||
| > | a. | > | ow-interaction state \u2014 bulk cross-directory read is the coll | ||
| > | ection signal]; OS API Execution via Application Vetting / I | ||||
| > | nstrumented Dynamic Analysis [Dynamic API/runtime trace: App | ||||
| > | invokes ContentResolver or SAF (Storage Access Framework) q | ||||
| > | ueries across multiple user-data paths outside its own sandb | ||||
| > | ox in background state]. Alert on a sequence or state change | ||||
| > | inconsistent with the device/app baseline, approved managem | ||||
| > | ent policy, or expected user workflow; do not infer unobserv | ||||
| > | ed API calls, file/process activity, or payload content from | ||||
| > | management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates supervised-device app posture and li | t | 1 | For iOS, detect Data from Local System primarily during appl |
| > | fecycle context with repeated local file or local-database a | > | ication vetting or controlled analysis rather than assuming | ||
| > | ccess effects, especially when a managed app reads browser, | > | a live device SOC feed. Correlate Application Permission via | ||
| > | messaging, keychain-adjacent, or application-container data | > | Application Vetting [Code-signing entitlements and Info.pli | ||
| > | outside its expected role and then stages or uploads the res | > | st privacy usage-description keys]; File Access via Applicat | ||
| > | ult. Because direct low-level local system access visibility | > | ion Vetting / Forensic Acquisition [Dynamic filesystem trace | ||
| > | is weaker on iOS, the primary analytic is effect-based: man | > | or acquired app-container/filesystem artifacts: App reads m | ||
| > | aged app identity, file/database access where visible to the | > | ultiple files from Photos library, Files provider, or iCloud | ||
| > | mobile sensor, background execution context, and near-term | > | Drive in background or lock-adjacent state exceeding $FileR | ||
| > | outbound communication. | > | eadRateThreshold$ within $DataCollectionWindow$]; OS API Exe | ||
| > | cution via Application Vetting / Instrumented Dynamic Analys | ||||
| > | is [Dynamic API/runtime trace: Managed app accesses broad lo | ||||
| > | cal data scope without user-initiated document picker intera | ||||
| > | ction on supervised device]. Alert on a sequence or state ch | ||||
| > | ange inconsistent with the device/app baseline, approved man | ||||
| > | agement policy, or expected user workflow; do not infer unob | ||||
| > | served API calls, file/process activity, or payload content | ||||
| > | from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) suppression or disablement of launcher-visibl | t | 1 | For Android, detect Suppress Application Icon from documente |
| > | e application components or effective reduction of user-faci | > | d management, network, or vetting evidence; treat state quer | ||
| > | ng launcher presence, (2) persistence of installed applicati | > | ies as periodic observations rather than real-time events. C | ||
| > | on state after icon suppression, and (3) continued runtime a | > | orrelate Application Permission via Android Enterprise DPC / | ||
| > | ctivity such as background execution, framework use, sensor | > | Application Vetting [DevicePolicyManager.getPermissionGrant | ||
| > | access, or network communication after the icon becomes unav | > | State(); PackageManager manifest/requested-permission review | ||
| > | ailable or is replaced by reduced-discoverability launcher b | > | ]; OS API Execution via Application Vetting / Instrumented D | ||
| > | ehavior. The defender observes a causal chain where an app r | > | ynamic Analysis [Dynamic API/runtime trace: App invokes Pack | ||
| > | emoves or reduces its launcher visibility while remaining op | > | ageManager.setComponentEnabledSetting() to COMPONENT_ENABLED | ||
| > | erational and continuing meaningful activity. | > | _STATE_DISABLED on its own LAUNCHER activity while continuin | ||
| > | g active background or foreground-service execution]. Alert | ||||
| > | on a sequence or state change inconsistent with the device/a | ||||
| > | pp baseline, approved management policy, or expected user wo | ||||
| > | rkflow; do not infer unobserved API calls, file/process acti | ||||
| > | vity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Unexpected behavior from an application could be an indicato | t | 1 | For Android, detect Masquerading from documented management, |
| > | r of masquerading. Application vetting services may potentia | > | network, or vetting evidence; treat state queries as period | ||
| > | lly determine if an application contains suspicious code and | > | ic observations rather than real-time events. Correlate Appl | ||
| > | /or metadata. | > | ication Permission via Android Enterprise DPC / Application | ||
| > | Vetting [DevicePolicyManager.getPermissionGrantState(); Pack | ||||
| > | ageManager manifest/requested-permission review]; File Creat | ||||
| > | ion via Application Vetting / Forensic Acquisition [Dynamic | ||||
| > | filesystem trace or acquired app-container/filesystem artifa | ||||
| > | cts: app binary written to device storage as part of install | ||||
| > | \u2014 confirms impersonating app is being persisted]; File Meta | ||||
| > | data via Application Vetting / Forensic Acquisition [Dynamic | ||||
| > | filesystem trace or acquired app-container/filesystem artif | ||||
| > | acts: installed app package_name Levenshtein distance <= $Na | ||||
| > | meDistanceThreshold$ to entry in $KnownAppCatalog$]. Alert o | ||||
| > | n a sequence or state change inconsistent with the device/ap | ||||
| > | p baseline, approved management policy, or expected user wor | ||||
| > | kflow; do not infer unobserved API calls, file/process activ | ||||
| > | ity, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Unexpected behavior from an application could be an indicato | t | 1 | For iOS, detect Masquerading by correlating analyst-visible |
| > | r of masquerading. Application vetting services may potentia | > | device/network evidence and management state; use streaming | ||
| > | lly determine if an application contains suspicious code and | > | or batched telemetry only where the documented collector is | ||
| > | /or metadata. | > | deployed. Correlate Application Permission via Application V | ||
| > | etting [Code-signing entitlements and Info.plist privacy usa | ||||
| > | ge-description keys]; File Metadata via Application Vetting | ||||
| > | / Forensic Acquisition [Dynamic filesystem trace or acquired | ||||
| > | app-container/filesystem artifacts: bundle_id LIKE $KnownSy | ||||
| > | stemNamespace$]; Network Traffic Flow via Apple Network Exte | ||||
| > | nsion / Enterprise VPN [NEFilterFlow / per-app VPN / secure- | ||||
| > | web-gateway flow metadata]. Alert on a sequence or state cha | ||||
| > | nge inconsistent with the device/app baseline, approved mana | ||||
| > | gement policy, or expected user workflow; do not infer unobs | ||||
| > | erved API calls, file/process activity, or payload content f | ||||
| > | rom management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The OS may show a notification to the user that the Signal o | t | 1 | For Android, detect Linked Devices by correlating analyst-vi |
| > | r WhatsApp account has been linked to a new device. | > | sible device/network evidence and management state; use stre | ||
| > | aming or batched telemetry only where the documented collect | ||||
| > | or is deployed. Correlate API Calls via Application Vetting | ||||
| > | / Instrumented Dynamic Analysis [Dynamic API/runtime trace: | ||||
| > | camera activated within app IN $MessagingAppList$ \u2014 QR scan | ||||
| > | requires camera access; activation in messaging app context | ||||
| > | is the trigger signal]; Network Connection Creation via Andr | ||||
| > | oid Enterprise Network Logging / Enterprise VPN [DevicePolic | ||||
| > | yManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN | ||||
| > | flow metadata]; Network Traffic Content via Enterprise Secu | ||||
| > | re Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy tran | ||||
| > | saction metadata where enterprise decryption/inspection is d | ||||
| > | eployed]. Alert on a sequence or state change inconsistent w | ||||
| > | ith the device/app baseline, approved management policy, or | ||||
| > | expected user workflow; do not infer unobserved API calls, f | ||||
| > | ile/process activity, or payload content from management sta | ||||
| > | te alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The OS may show a notification to the user that the Signal o | t | 1 | For iOS, detect Linked Devices by correlating analyst-visibl |
| > | r WhatsApp account has been linked to a new device. | > | e device/network evidence and management state; use streamin | ||
| > | g or batched telemetry only where the documented collector i | ||||
| > | s deployed. Correlate Network Connection Creation via Apple | ||||
| > | Network Extension / Enterprise VPN [NEFilterFlow / per-app V | ||||
| > | PN / secure-web-gateway flow metadata]; Network Traffic Cont | ||||
| > | ent via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) i | ||||
| > | nspection or proxy transaction metadata where enterprise dec | ||||
| > | ryption/inspection is deployed]; Permissions Request via App | ||||
| > | lication Vetting [Code-signing entitlements and Info.plist p | ||||
| > | rivacy usage-description keys]. Alert on a sequence or state | ||||
| > | change inconsistent with the device/app baseline, approved | ||||
| > | management policy, or expected user workflow; do not infer u | ||||
| > | nobserved API calls, file/process activity, or payload conte | ||||
| > | nt from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates application loading or invoking nati | t | 1 | For Android, detect Native API from documented management, n |
| > | ve libraries through JNI or NDK-backed execution paths with | > | etwork, or vetting evidence; treat state queries as periodic | ||
| > | subsequent lower-level activity such as native thread creati | > | observations rather than real-time events. Correlate Applic | ||
| > | on, sensor access, file operations, or outbound network comm | > | ation Permission via Android Enterprise DPC / Application Ve | ||
| > | unication that is inconsistent with the app's declared role | > | tting [DevicePolicyManager.getPermissionGrantState(); Packag | ||
| > | or recent user interaction. The analytic prioritizes defende | > | eManager manifest/requested-permission review]; Application | ||
| > | r-observable control-plane effects: native library load or J | > | State via Android Enterprise / EMM [Managed package inventor | ||
| > | NI bridge use, transition into native execution context, and | > | y/status and package metadata]; OS API Execution via Applica | ||
| > | immediate post-load behavior occurring from background stat | > | tion Vetting / Instrumented Dynamic Analysis [Dynamic API/ru | ||
| > | e, locked-device state, or non-baselined app categories. | > | ntime trace: App loads native library (.so) or resolves JNI | ||
| > | bridge NOT IN $ApprovedNativeLibraries$ immediately before s | ||||
| > | uspicious lower-level activity (sensor access, file write, n | ||||
| > | etwork connection) \u2014 native code loading before anomalous ac | ||||
| > | tivity is the]. Alert on a sequence or state change inconsis | ||||
| > | tent with the device/app baseline, approved management polic | ||||
| > | y, or expected user workflow; do not infer unobserved API ca | ||||
| > | lls, file/process activity, or payload content from manageme | ||||
| > | nt state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates an application establishing outbound | t | 1 | For Android, detect Ingress Tool Transfer by correlating ana |
| > | retrieval to a non-baselined external source with immediate | > | lyst-visible device/network evidence and management state; u | ||
| > | local creation of a new executable, module, staged payload, | > | se streaming or batched telemetry only where the documented | ||
| > | overlay asset, or secondary file in app-controlled or share | > | collector is deployed. Correlate Application Permission via | ||
| > | d storage, followed by optional load, invocation, handoff, o | > | Android Enterprise DPC / Application Vetting [DevicePolicyMa | ||
| > | r repeat retrieval behavior. The analytic prioritizes Androi | > | nager.getPermissionGrantState(); PackageManager manifest/req | ||
| > | d-observable effects: network download activity, DownloadMan | > | uested-permission review]; Application State via Android Ent | ||
| > | ager or direct HTTP retrieval, file creation in package-spec | > | erprise / EMM [Managed package inventory/status and package | ||
| > | ific or external paths, and execution context inconsistent w | > | metadata]; File Creation via Application Vetting / Forensic | ||
| > | ith recent user interaction or the app\u2019s declared role. | > | Acquisition [Dynamic filesystem trace or acquired app-contai | ||
| > | ner/filesystem artifacts: App writes newly retrieved binary, | ||||
| > | archive, native library (.so), DEX, or script to /data/data | ||||
| > | /<app>/files/, cache, or shared storage within $IngressWrite | ||||
| > | Window$ of network retrieval from non-CDN source]. Alert on | ||||
| > | a sequence or state change inconsistent with the device/app | ||||
| > | baseline, approved management policy, or expected user workf | ||||
| > | low; do not infer unobserved API calls, file/process activit | ||||
| > | y, or payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates managed-app network retrieval from a | t | 1 | For iOS, detect Ingress Tool Transfer by correlating analyst |
| > | non-baselined external source with immediate creation of a | > | -visible device/network evidence and management state; use s | ||
| > | new local artifact, staged resource, module-like file, or op | > | treaming or batched telemetry only where the documented coll | ||
| > | aque payload inside the app container, followed by optional | > | ector is deployed. Correlate Application Permission via Appl | ||
| > | dynamic loading, handoff, or repeat retrieval behavior. Beca | > | ication Vetting [Code-signing entitlements and Info.plist pr | ||
| > | use iOS offers weaker direct visibility into tool staging in | > | ivacy usage-description keys]; Application State via Apple M | ||
| > | ternals than Android in many environments, the analytic anch | > | DM [InstalledApplicationList / ManagedApplicationList]; File | ||
| > | ors first on network acquisition plus managed app identity a | > | Creation via Application Vetting / Forensic Acquisition [Dy | ||
| > | nd then strengthens confidence with file creation or process | > | namic filesystem trace or acquired app-container/filesystem | ||
| > | -activity effects where mobile telemetry is available. | > | artifacts: Managed app writes newly retrieved container-loca | ||
| > | l file, dylib-like resource, or opaque payload after downloa | ||||
| > | d from non-CDN source]. Alert on a sequence or state change | ||||
| > | inconsistent with the device/app baseline, approved manageme | ||||
| > | nt policy, or expected user workflow; do not infer unobserve | ||||
| > | d API calls, file/process activity, or payload content from | ||||
| > | management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Correlates (1) device posture changes indicating root or ele | t | 1 | For Android, detect Hooking from documented management, netw |
| > | vated privilege state, (2) runtime framework manipulation or | > | ork, or vetting evidence; treat state queries as periodic ob | ||
| > | injection into application processes, and (3) anomalous API | > | servations rather than real-time events. Correlate Applicati | ||
| > | behavior or suppressed security signals. The defender obser | > | on Permission via Android Enterprise DPC / Application Vetti | ||
| > | ves a causal chain where an application gains privileged exe | > | ng [DevicePolicyManager.getPermissionGrantState(); PackageMa | ||
| > | cution context, interacts with system frameworks (e.g., ART/ | > | nager manifest/requested-permission review]; OS API Executio | ||
| > | Zygote), and modifies expected API outputs or suppresses sec | > | n via Application Vetting / Instrumented Dynamic Analysis [D | ||
| > | urity-relevant signals such as permission checks, sensor acc | > | ynamic API/runtime trace: App process loads external code mo | ||
| > | ess reporting, or process visibility. | > | dule or native library from non-system path injected into zy | ||
| > | gote or app_process runtime \u2014 abnormal library injection pat | ||||
| > | h is the hooking mechanism indicator]. Alert on a sequence o | ||||
| > | r state change inconsistent with the device/app baseline, ap | ||||
| > | proved management policy, or expected user workflow; do not | ||||
| > | infer unobserved API calls, file/process activity, or payloa | ||||
| > | d content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates a sandboxed app writing high-entropy or | t | 1 | For Android, detect Obfuscated Files or Information by corre |
| > | encoded artifacts (often in app-private or shared storage), | > | lating analyst-visible device/network evidence and managemen | ||
| > | performing decode/decompress/reassembly, then dynamically lo | > | t state; use streaming or batched telemetry only where the d | ||
| > | ading/execing the resulting code (DexClassLoader/JNI dlopen) | > | ocumented collector is deployed. Correlate File Creation via | ||
| > | or spawning a helper process. Sequence: high-entropy file w | > | Application Vetting / Forensic Acquisition [Dynamic filesys | ||
| > | rites \u2192 decode/unpack bursts \u2192 new .dex/.so/.jar creation in | > | tem trace or acquired app-container/filesystem artifacts: op | ||
| > | temp/obfuscated paths \u2192 dynamic load or shell spawn within | > | en() with O_CREAT on path LIKE '/data/data/%/files/%' for bi | ||
| > | a tight window. | > | nary or dex content by app_package NOT IN $LegitDynamicLoade | ||
| > | rs$]; Module Load via Application Vetting / Instrumented Dyn | ||||
| > | amic Analysis [Dynamic API/runtime trace: DexClassLoader() o | ||||
| > | r dlopen() called with path argument matching file written i | ||||
| > | n preceding $DecryptExecWindow$]; Network Connection Creatio | ||||
| > | n via Android Enterprise Network Logging / Enterprise VPN [D | ||||
| > | evicePolicyManager.retrieveNetworkLogs(): DnsEvent / Connect | ||||
| > | Event; VPN flow metadata]. Alert on a sequence or state chan | ||||
| > | ge inconsistent with the device/app baseline, approved manag | ||||
| > | ement policy, or expected user workflow; do not infer unobse | ||||
| > | rved API calls, file/process activity, or payload content fr | ||||
| > | om management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Defender correlates a sandboxed app downloading or receiving | t | 1 | For iOS, detect Obfuscated Files or Information by correlati |
| > | opaque/encoded blobs, writing high-entropy content into con | > | ng analyst-visible device/network evidence and management st | ||
| > | tainer/tmp, performing decode/decompress/reassembly, and the | > | ate; use streaming or batched telemetry only where the docum | ||
| > | n executing/loaded as Mach-O or bundle (dlopen) or leveragin | > | ented collector is deployed. Correlate Application Permissio | ||
| > | g JIT/RWX pages to run the decoded payload. Sequence: opaque | > | n via Application Vetting [Code-signing entitlements and Inf | ||
| > | download or IPC \u2192 high-entropy writes/split-file bursts \u2192 d | > | o.plist privacy usage-description keys]; Network Traffic Con | ||
| > | ecode/unarchive \u2192 new Mach-O/bundle in tmp \u2192 dlopen/posix_sp | > | tent via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) | ||
| > | awn or RWX region activity. | > | inspection or proxy transaction metadata where enterprise de | ||
| > | cryption/inspection is deployed]; Network Traffic Flow via A | ||||
| > | pple Network Extension / Enterprise VPN [NEFilterFlow / per- | ||||
| > | app VPN / secure-web-gateway flow metadata]. Alert on a sequ | ||||
| > | ence or state change inconsistent with the device/app baseli | ||||
| > | ne, approved management policy, or expected user workflow; d | ||||
| > | o not infer unobserved API calls, file/process activity, or | ||||
| > | payload content from management state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The defender correlates the arrival, installation, or update | t | 1 | For Android, detect Compromise Software Supply Chain from do |
| > | of a trusted or expected application with a subsequent devi | > | cumented management, network, or vetting evidence; treat sta | ||
| > | ation in package trust characteristics, permission posture, | > | te queries as periodic observations rather than real-time ev | ||
| > | protected-resource use, framework behavior, or network commu | > | ents. Correlate Application Permission via Android Enterpris | ||
| > | nication that is inconsistent with the known-good role of th | > | e DPC / Application Vetting [DevicePolicyManager.getPermissi | ||
| > | at app. The strongest Android evidence is a managed or trust | > | onGrantState(); PackageManager manifest/requested-permission | ||
| > | ed package whose first-run or post-update behavior introduce | > | review]; Application State via Android Enterprise / EMM [Ma | ||
| > | s unexpected special access, sensitive sensor use, unusual b | > | naged package inventory/status and package metadata]; File C | ||
| > | ackground execution, privileged framework interaction, or ou | > | reation via Application Vetting / Forensic Acquisition [Dyna | ||
| > | tbound communication to destinations outside the app's basel | > | mic filesystem trace or acquired app-container/filesystem ar | ||
| > | ine shortly after installation or update. | > | tifacts: Compromised app writes staging, cache, or export ar | ||
| > | tifacts inconsistent with its declared function within $Post | ||||
| > | InstallWindow$]. Alert on a sequence or state change inconsi | ||||
| > | stent with the device/app baseline, approved management poli | ||||
| > | cy, or expected user workflow; do not infer unobserved API c | ||||
| > | alls, file/process activity, or payload content from managem | ||||
| > | ent state alone. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Anchor on supervised managed-app install/update or version d | t | 1 | For iOS, detect Compromise Software Supply Chain from docume |
| > | rift, then correlate with unexpected background activity, ma | > | nted management, network, or vetting evidence; treat state q | ||
| > | naged-app state changes, or egress inconsistent with the app | > | ueries as periodic observations rather than real-time events | ||
| > | 's historical and policy baseline. | > | . Correlate Application Permission via Application Vetting [ | ||
| > | Code-signing entitlements and Info.plist privacy usage-descr | ||||
| > | iption keys]; Application State via Apple MDM [InstalledAppl | ||||
| > | icationList / ManagedApplicationList]; OS API Execution via | ||||
| > | Application Vetting / Instrumented Dynamic Analysis [Dynamic | ||||
| > | API/runtime trace: Launch services, extension-handling, or | ||||
| > | framework subsystem anomalies occur near install or first la | ||||
| > | unch of recently updated trusted app on supervised device]. | ||||
| > | Alert on a sequence or state change inconsistent with the de | ||||
| > | vice/app baseline, approved management policy, or expected u | ||||
| > | ser workflow; do not infer unobserved API calls, file/proces | ||||
| > | s activity, or payload content from management state alone. |
Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).\n\nPowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.\n\nPowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)\n\nWithin industrial control system networks, adversaries may abuse the use of PowerShell on overlap assets that run on Microsoft Windows operating systems (Workstations, Data Historians, Human Machine Interfaces, Application Servers, Jump Hosts, etc.).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-ics-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1701/001",
"external_id": "T1701.001"
},
{
"source_name": "Microsoft PSfromCsharp APR 2014",
"description": "Babinec, K. (2014, April 28). Executing PowerShell scripts from C#. Retrieved April 22, 2019.",
"url": "https://blogs.msdn.microsoft.com/kebab/2014/04/28/executing-powershell-scripts-from-c/"
},
{
"source_name": "SilentBreak Offensive PS Dec 2015",
"description": "Christensen, L.. (2015, December 28). The Evolution of Offensive PowerShell Invocation. Retrieved December 8, 2018.",
"url": "https://web.archive.org/web/20190508170150/https://silentbreaksecurity.com/powershell-jobs-without-powershell-exe/"
},
{
"source_name": "TechNet PowerShell",
"description": "Microsoft. (n.d.). Windows PowerShell Scripting. Retrieved April 28, 2016.",
"url": "https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx"
},
{
"source_name": "Sixdub PowerPick Jan 2016",
"description": "Warner, J.. (2015, January 6). Inexorable PowerShell \u2013 A Red Teamer\u2019s Tale of Overcoming Simple AppLocker Policies. Retrieved December 8, 2018.",
"url": "https://web.archive.org/web/20160327101330/http://www.sixdub.net/?p=367"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-26 01:52:11.220000+00:00",
"modified": "2026-10-07 21:24:33.641000+00:00",
"name": "Python",
"description": "Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020)\n\nPython comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Within industrial control system environments, Python libraries have been developed to implement multiple ICS protocols to establish communications with field devices. Adversaries can use these libraries or develop their own to execute commands on workstation, control server assets or send remote command messages to manipulate the industrial process through exisiting ICS protocols. \n\n",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-ics-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1701/005",
"external_id": "T1701.005"
},
{
"source_name": "Zscaler APT31 Covid-19 October 2020",
"description": "Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.",
"url": "https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-25 20:09:19.593000+00:00",
"modified": "2026-10-07 20:34:55.625000+00:00",
"name": "Unix Shell",
"description": "Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.\n\nUnix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.\n\nAdversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [Remote Services](https://attack.mitre.org/techniques/T0886). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.\n\nWithin Industrial control system networks, workstations, control servers, hypervisors, networking devices, and embedded devices that run on linux platforms may allow for Unix command shell access or stripped-down shells to implement a subset of commands. Industrial automation equipment generally does not offer command shells as a native user interface.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-ics-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1701/003",
"external_id": "T1701.003"
},
{
"source_name": "Apple ZShell",
"description": "Apple. (2020, January 28). Use zsh as the default shell on your Mac. Retrieved June 12, 2020.",
"url": "https://support.apple.com/HT208050"
},
{
"source_name": "DieNet Bash",
"description": "die.net. (n.d.). bash(1) - Linux man page. Retrieved June 12, 2020.",
"url": "https://linux.die.net/man/1/bash"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-25 20:25:54.269000+00:00",
"modified": "2026-10-09 17:48:25.598000+00:00",
"name": "Visual Basic",
"description": "Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft)\n\nDerivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of [JavaScript](https://attack.mitre.org/techniques/T1701/006) on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript)\n\nAdversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) payloads (which may also involve [Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005) to enable execution).\n\nWithin industrial control system networks, adversaries may abuse the use of VB and VBScript on overlap assets that run on Microsoft Windows operating systems, especially in cases where legacy versions are still used in operations (Workstations, Data Historians, Human Machine Interfaces, Application Servers, Jump Hosts, etc.). ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-ics-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1701/004",
"external_id": "T1701.004"
},
{
"source_name": "VB .NET Mar 2020",
"description": ".NET Team. (2020, March 11). Visual Basic support planned for .NET 5.0. Retrieved June 23, 2020.",
"url": "https://devblogs.microsoft.com/vbteam/visual-basic-support-planned-for-net-5-0/"
},
{
"source_name": "Microsoft VBScript",
"description": "Microsoft. (2011, April 19). What Is VBScript?. Retrieved March 28, 2020.",
"url": "https://docs.microsoft.com/previous-versions//1kw29xwf(v=vs.85)"
},
{
"source_name": "Microsoft VBA",
"description": "Microsoft. (2019, June 11). Office VBA Reference. Retrieved June 23, 2020.",
"url": "https://docs.microsoft.com/office/vba/api/overview/"
},
{
"source_name": "VB Microsoft",
"description": "Microsoft. (n.d.). Visual Basic documentation. Retrieved June 23, 2020.",
"url": "https://docs.microsoft.com/dotnet/visual-basic/"
},
{
"source_name": "Wikipedia VBA",
"description": "Wikipedia. (n.d.). Visual Basic for Applications. Retrieved August 13, 2020.",
"url": "https://en.wikipedia.org/wiki/Visual_Basic_for_Applications"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-25 19:12:31.330000+00:00",
"modified": "2026-10-09 17:29:41.220000+00:00",
"name": "Windows Command Shell",
"description": "Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems which is used in industrial control system environments. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T0886) (e.g., Telnet, SSH, RDP, etc.) \n\nBatch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems. \n\nAdversaries may leverage [cmd](https://attack.mitre.org/software/S0106) to execute various commands and payloads. Common uses include [cmd](https://attack.mitre.org/software/S0106) to execute a single command, or abusing [cmd](https://attack.mitre.org/software/S0106) interactively with input and output forwarded over a command and control channel. \n\nWithin industrial control system networks, adversaries may abuse the use of Windows Command Shell on overlap assets that run on Microsoft Windows operating systems (Workstations, Data Historians, Human Machine Interfaces, Application Servers, Jump Hosts, etc.). ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-ics-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1701/002",
"external_id": "T1701.002"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-26 02:55:07.994000+00:00",
"modified": "2026-10-09 18:14:56.779000+00:00",
"name": "DNS",
"description": "Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.\nThe DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling)\n\nDNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. Protocol Tunneling). The commands may be embedded into different DNS records, for example, TXT or A records.(Citation: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government)\n DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.(Citation: DNS Beacons) Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.\n\nAdversaries may also use DNS over TLS (DoT) or HTTPS (DoH) for resolving C2 servers. This encrypts the DNS requests and allows the malware to lookup C2 servers without being detected by security systems (e.g., DNS filtering based on indicators of compromise). \n",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-ics-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T0869/001",
"external_id": "T0869.001"
},
{
"source_name": "Medium DnsTunneling",
"description": "Galobardes, R. (2018, October 30). Learn how easy is to bypass firewalls using DNS tunneling (and also how to block it). Retrieved March 15, 2020.",
"url": "https://medium.com/@galolbardes/learn-how-easy-is-to-bypass-firewalls-using-dns-tunneling-and-also-how-to-block-it-3ed652f4a000"
},
{
"source_name": "OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government",
"description": "Kyle Wilhoit, Robert Falcone. (2018, September 12). OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government. Retrieved July 21, 2025.",
"url": "https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/"
},
{
"source_name": "PAN DNS Tunneling",
"description": "Palo Alto Networks. (n.d.). What Is DNS Tunneling?. Retrieved March 15, 2020.",
"url": "https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunneling"
},
{
"source_name": "DNS Beacons",
"description": "Vercara. (n.d.). Retrieved July 21, 2025.",
"url": "https://vercara.digicert.com/resources/dns-beacons#page_top"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0"
},
{
"type": "attack-pattern",
"id": "attack-pattern--4b5c5ba1-46a6-4e10-b99b-7e0892368c06",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-09-26 03:33:15.757000+00:00",
"modified": "2026-10-07 21:51:02.824000+00:00",
"name": "Publish/Subscribe Protocols",
"description": "Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and broker.\n\nProtocols such as MQTT are widely used in Internet-of-Things (IoT) and operational technology environments where devices are resource constrained and there is limited or unreliable network bandwidth. The protocol follows a publish/subscribe design, with message distribution managed by a centralized broker. Publishers categorize their messages by topics, while subscribers receive messages according to their subscribed topics. An adversary may abuse publish/subscribe protocols to communicate with systems under their control from behind a message broker while also blending in with normal, expected traffic.\n",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-ics-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T0869/002",
"external_id": "T0869.002"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_version": "1.0"
}
],
"major_version_changes": [
{
"type": "attack-pattern",
"id": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2026-04-20 20:54:17.053000+00:00",
"modified": "2026-10-13 17:48:51.581000+00:00",
"name": "Command Message",
"description": "Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an [Impact](https://attack.mitre.org/tactics/TA0105).(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011). An adversary could also misuse control system devices to store data collected from the network for later use.\n\nIn the Dallas Siren incident, adversaries were able to send command messages to activate tornado alarm systems across the city without an impending tornado or other disaster.(Citation: Zack Whittaker April 2017)(Citation: Benjamin Freed March 2019)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-ics-attack",
"phase_name": "evasion"
},
{
"kill_chain_name": "mitre-ics-attack",
"phase_name": "impair-process-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1692/001",
"external_id": "T1692.001"
},
{
"source_name": "Benjamin Freed March 2019",
"description": "Benjamin Freed 2019, March 13 Tornado sirens in Dallas suburbs deactivated after being hacked and set off Retrieved. 2020/11/06 ",
"url": "https://statescoop.com/tornado-sirens-in-dallas-suburbs-deactivated-after-being-hacked-and-set-off/"
},
{
"source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
"description": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011 A Taxonomy of Cyber Attacks on SCADA Systems Retrieved. 2018/01/12 ",
"url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
},
{
"source_name": "Zack Whittaker April 2017",
"description": "Zack Whittaker 2017, April 12 Dallas' emergency sirens were hacked with a rogue radio signal Retrieved. 2020/11/06 ",
"url": "https://www.zdnet.com/article/experts-think-they-know-how-dallas-emergency-sirens-were-hacked/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.3.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"ics-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Embedded",
"Windows",
"Linux"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_platforms']\": [\"Embedded\", \"Windows\", \"Linux\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2026-10-13 17:48:51.581000+00:00\", \"old_value\": \"2026-05-12 15:12:00.629000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an [Impact](https://attack.mitre.org/tactics/TA0105).(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011). An adversary could also misuse control system devices to store data collected from the network for later use.\\n\\nIn the Dallas Siren incident, adversaries were able to send command messages to activate tornado alarm systems across the city without an impending tornado or other disaster.(Citation: Zack Whittaker April 2017)(Citation: Benjamin Freed March 2019)\", \"old_value\": \"Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an [Impact](https://attack.mitre.org/tactics/TA0105).(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)\\n\\nIn the Dallas Siren incident, adversaries were able to send command messages to activate tornado alarm systems across the city without an impending tornado or other disaster.(Citation: Zack Whittaker April 2017)(Citation: Benjamin Freed March 2019)\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an [Impact](https://attack.mitre.org/tactics/TA0105).(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)\\n+Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an [Impact](https://attack.mitre.org/tactics/TA0105).(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011). An adversary could also misuse control system devices to store data collected from the network for later use.\\n \\n In the Dallas Siren incident, adversaries were able to send command messages to activate tornado alarm systems across the city without an impending tornado or other disaster.(Citation: Zack Whittaker April 2017)(Citation: Benjamin Freed March 2019)\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.0\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may send unauthorized command messages to instru | t | 1 | Adversaries may send unauthorized command messages to instru |
| > | ct control system assets to perform actions outside of their | > | ct control system assets to perform actions outside of their | ||
| > | intended functionality, or without the logical precondition | > | intended functionality, or without the logical precondition | ||
| > | s to trigger their expected function. Command messages are u | > | s to trigger their expected function. Command messages are u | ||
| > | sed in ICS networks to give direct instructions to control s | > | sed in ICS networks to give direct instructions to control s | ||
| > | ystems devices. If an adversary can send an unauthorized com | > | ystems devices. If an adversary can send an unauthorized com | ||
| > | mand message to a control system, then it can instruct the c | > | mand message to a control system, then it can instruct the c | ||
| > | ontrol systems device to perform an action outside the norma | > | ontrol systems device to perform an action outside the norma | ||
| > | l bounds of the device's actions. An adversary could potenti | > | l bounds of the device's actions. An adversary could potenti | ||
| > | ally instruct a control systems device to perform an action | > | ally instruct a control systems device to perform an action | ||
| > | that will cause an [Impact](https://attack.mitre.org/tactics | > | that will cause an [Impact](https://attack.mitre.org/tactics | ||
| > | /TA0105).(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sast | > | /TA0105).(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sast | ||
| > | ry 2011) In the Dallas Siren incident, adversaries were abl | > | ry 2011). An adversary could also misuse control system devi | ||
| > | e to send command messages to activate tornado alarm systems | > | ces to store data collected from the network for later use. | ||
| > | across the city without an impending tornado or other disas | > | In the Dallas Siren incident, adversaries were able to send | ||
| > | ter.(Citation: Zack Whittaker April 2017)(Citation: Benjamin | > | command messages to activate tornado alarm systems across t | ||
| > | Freed March 2019) | > | he city without an impending tornado or other disaster.(Cita | ||
| > | tion: Zack Whittaker April 2017)(Citation: Benjamin Freed Ma | ||||
| > | rch 2019) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may transfer tools or other files from one syste | t | 1 | Adversaries may transfer tools or other files from one syste |
| > | m to another to stage adversary tools or other files over th | > | m to another to stage adversary tools or other files over th | ||
| > | e course of an operation. (Citation: Enterprise ATT&CK) Copy | > | e course of an operation.(Citation: Enterprise ATT&CK) Copyi | ||
| > | ing of files may also be performed laterally between interna | > | ng of files may also be performed laterally between internal | ||
| > | l victim systems to support Lateral Movement with remote Exe | > | victim systems to support Lateral Movement with remote Exec | ||
| > | cution using inherent file sharing protocols such as file sh | > | ution using inherent file sharing protocols such as file sha | ||
| > | aring over SMB to connected network shares. (Citation: Enter | > | ring over SMB to connected network shares.(Citation: Enterpr | ||
| > | prise ATT&CK) In control systems environments, malware may | > | ise ATT&CK) In control systems environments, malware may us | ||
| > | use SMB and other file sharing protocols to move laterally t | > | e SMB and other file sharing protocols to move laterally thr | ||
| > | hrough industrial networks. | > | ough industrial networks. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [APT38](https://attack.mitre.org/groups/G0082) is a North Ko | t | 1 | [APT38](https://attack.mitre.org/groups/G0082) is a North Ko |
| > | rean state-sponsored threat group that specializes in financ | > | rean state-sponsored threat group that specializes in financ | ||
| > | ial cyber operations; it has been attributed to the Reconnai | > | ial cyber operations; it has been attributed to the Reconnai | ||
| > | ssance General Bureau.(Citation: CISA AA20-239A BeagleBoyz A | > | ssance General Bureau.(Citation: CISA AA20-239A BeagleBoyz A | ||
| > | ugust 2020) Active since at least 2014, [APT38](https://atta | > | ugust 2020) Active since at least 2014, [APT38](https://atta | ||
| > | ck.mitre.org/groups/G0082) has targeted banks, financial ins | > | ck.mitre.org/groups/G0082) has targeted banks, financial ins | ||
| > | titutions, casinos, cryptocurrency exchanges, SWIFT system e | > | titutions, casinos, cryptocurrency exchanges, SWIFT system e | ||
| > | ndpoints, and ATMs in at least 38 countries worldwide. Signi | > | ndpoints, and ATMs in at least 38 countries worldwide. Signi | ||
| > | ficant operations include the 2016 Bank of Bangladesh heist, | > | ficant operations include the 2016 Bank of Bangladesh heist, | ||
| > | during which [APT38](https://attack.mitre.org/groups/G0082) | > | Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de C | ||
| > | stole $81 million, as well as attacks against Bancomext (Ci | > | hile (Citation: FireEye APT38 Oct 2018), along with software | ||
| > | tation: FireEye APT38 Oct 2018) and Banco de Chile (Citation | > | supply chain compromises and destructive malware attacks.(C | ||
| > | : FireEye APT38 Oct 2018); some of their attacks have been d | > | itation: CISA AA20-239A BeagleBoyz August 2020)(Citation: Fi | ||
| > | estructive.(Citation: CISA AA20-239A BeagleBoyz August 2020) | > | reEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment F | ||
| > | (Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea | > | eb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 201 | ||
| > | Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The | > | 7)(Citation: Microsoft Axios Compromise APR 2026)(Citation: | ||
| > | Hood Blog 2017) North Korean group definitions are known to | > | Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastr | ||
| > | have significant overlap, and some security researchers rep | > | a npm Compromise JUN 2026) North Korean group definitions a | ||
| > | ort all North Korean state-sponsored cyber activity under th | > | re known to have significant overlap, and some security rese | ||
| > | e name [Lazarus Group](https://attack.mitre.org/groups/G0032 | > | archers report all North Korean state-sponsored cyber activi | ||
| > | ) instead of tracking clusters or subgroups. | > | ty under the name [Lazarus Group](https://attack.mitre.org/g | ||
| > | roups/G0032) instead of tracking clusters or subgroups. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for API calls that can be used to install a hook pro | t | 1 | Real-time monitoring identifies an unsigned or unexpected pr |
| > | cedure, such as the SetWindowsHookEx and SetWinEventHook fun | > | ocess calling Windows hooking Application Programming Interf | ||
| > | ctions.(Citation: Microsoft Hook Overview)(Citation: Volatil | > | aces (APIs) (SetWindowsHookEx, SetWinEventHook) targeting an | ||
| > | ity Detecting Hooks Sept 2012) Also consider analyzing hook | > | Industrial Control System (ICS) engineering or Human-Machin | ||
| > | chains (which hold pointers to hook procedures for each type | > | e Interface (HMI) process, immediately followed by that targ | ||
| > | of hook) using tools(Citation: Volatility Detecting Hooks S | > | et process loading a Dynamic Link Library (DLL) not present | ||
| > | ept 2012)(Citation: PreKageo Winhook Jul 2011)(Citation: Jay | > | in the vendor's signed module baseline. Confirmed in the wil | ||
| > | GetHooks Sept 2011) or by programmatically examining intern | > | d: Stuxnet replaced Siemens' s7otbxdx.dll on engineering wor | ||
| > | al kernel structures.(Citation: Zairon Hooking Dec 2006)(Cit | > | kstations to intercept and falsify Programmable Logic Contro | ||
| > | ation: EyeofRa Detecting Hooking June 2017) Verify integrity | > | ller (PLC) read/write calls between WinCC/STEP7 and the cont | ||
| > | of live processes by comparing code in memory to that of co | > | roller. OT operational-fidelity gate: Alert only when execut | ||
| > | rresponding static binaries, specifically checking for jumps | > | ion violates an approved signer/hash/path/parent/process or | ||
| > | and other instructions that redirect code flow. | > | tool allowlist, or originates from an unauthorized user/tool | ||
| > | , and is tied to an OT asset or follow-on OT-relevant action | ||||
| > | . Suppress vendor-signed software, approved engineering util | ||||
| > | ities, diagnostics, patching, backup, and documented mainten | ||||
| > | ance. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor and analyze traffic patterns and packet inspection a | t | 1 | Real-time network monitoring identifies a sustained spike in |
| > | ssociated to protocol(s) that do not follow the expected pro | > | malformed or high-volume Industrial Control System (ICS) pr | ||
| > | tocol standards and traffic flows (e.g., extraneous packets | > | otocol traffic directed at a single field device from a sour | ||
| > | that do not belong to established flows, gratuitous or anoma | > | ce not in the approved control server list, immediately foll | ||
| > | lous traffic patterns, anomalous syntax, or structure). Cons | > | owed by that device dropping out of the supervisory poll cyc | ||
| > | ider correlation with process monitoring and command line to | > | le. Documented precedent: Sandworm's Industroyer malware sen | ||
| > | detect anomalous processes execution and command line argum | > | t a crafted 18-byte proprietary User Datagram Protocol (UDP) | ||
| > | ents associated to traffic patterns (e.g., monitor anomalies | > | packet to port 50000 on Siemens Protection Technology (SIPR | ||
| > | in use of files that do not normally initiate connections f | > | OTEC) relays (CVE-2015-5374), causing the device to hang and | ||
| > | or respective protocol(s)). Monitor network data for uncommo | > | require a manual reboot. OT operational-fidelity gate: Aler | ||
| > | n data flows. Processes utilizing the network that do not no | > | t only when a device-specific traffic/resource threshold is | ||
| > | rmally have network communication or have never been seen be | > | exceeded and the same window shows service degradation, fail | ||
| > | fore are suspicious. Monitor for application logging, messag | > | ed polling, device alarm/restart, resource exhaustion, or ma | ||
| > | ing, and/or other artifacts that may result from Denial of | > | lformed/out-of-spec protocol behavior. Suppress planned load | ||
| > | Service (DoS) attacks which degrade or block the availabilit | > | tests, maintenance, network convergence/failover, and known | ||
| > | y of services to users. In addition to network level detecti | > | equipment faults after operator confirmation. | ||
| > | ons, endpoint logging and instrumentation can be useful for | ||||
| > | detection. Monitor operational data for indicators of tempor | ||||
| > | ary data loss which may indicate a Denial of Service. This w | ||||
| > | ill not directly detect the technique\u2019s execution, but inste | ||||
| > | ad may provide additional evidence that the technique has be | ||||
| > | en used and may complement other detections. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for an authentication attempt by a user that may obt | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | ain and abuse credentials of existing accounts as a means of | > | (ICS)-role account authenticating via interactive or remote | ||
| > | gaining Initial Access, Persistence, Privilege Escalation, | > | logon from a workstation not in the approved host inventory | ||
| > | or Defense Evasion. Monitor for logon behavior that may abus | > | , or outside the account's established usage pattern, immedi | ||
| > | e credentials of existing accounts as a means of gaining Lat | > | ately followed within a short window by that session connect | ||
| > | eral Movement or Persistence. Correlate other security syste | > | ing to the field device network or ICS application. OT opera | ||
| > | ms with login information (e.g., a user has an active login | > | tional-fidelity gate: Alert only when the account/device/ses | ||
| > | session but has not entered the building or does not have VP | > | sion violates the approved identity + source host/jump path/ | ||
| > | N access). Monitor for suspicious account behavior across s | > | zone policy and is corroborated by access to a protected OT | ||
| > | ystems that share accounts, either user, admin, or service a | > | asset, execution, configuration change, or another security- | ||
| > | ccounts. Examples: one account logged into multiple systems | > | relevant follow-on event. Suppress approved shift activity, | ||
| > | simultaneously; multiple accounts logged into the same machi | > | vendor support, break-glass use, commissioning, and document | ||
| > | ne simultaneously; accounts logged in at odd times or outsid | > | ed remote-access windows. | ||
| > | e of business hours. Activity may be from interactive login | ||||
| > | sessions or process ownership from accounts being used to ex | ||||
| > | ecute binaries on a remote system as a particular account. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for newly constructed services/daemons that may atte | t | 1 | Real-time monitoring identifies a process or scheduled task |
| > | mpt to manipulate features of their artifacts to make them a | > | whose displayed name matches a known Industrial Control Syst | ||
| > | ppear legitimate or benign to users and/or security tools. M | > | em (ICS) vendor application but whose on-disk binary hash or | ||
| > | onitor for changes made to files outside of an update or pat | > | file path does not match the vendor-signed baseline. The mi | ||
| > | ch that may attempt to manipulate features of their artifact | > | smatch -- name says one thing, binary integrity says another | ||
| > | s to make them appear legitimate or benign to users and/or s | > | -- is the defining signal. OT operational-fidelity gate: Al | ||
| > | ecurity tools. Monitor for file names that are mismatched be | > | ert only when execution violates an approved signer/hash/pat | ||
| > | tween the file name on disk and that of the binary's metadat | > | h/parent/process or tool allowlist, or originates from an un | ||
| > | a. This is a likely indicator that a binary was renamed afte | > | authorized user/tool, and is tied to an OT asset or follow-o | ||
| > | r it was compiled. For added context on adversary procedures | > | n OT-relevant action. Suppress vendor-signed software, appro | ||
| > | and background see [Masquerading](https://attack.mitre.org/ | > | ved engineering utilities, diagnostics, patching, backup, an | ||
| > | techniques/T1036) and applicable sub-techniques. Monitor exe | > | d documented maintenance. | ||
| > | cuted commands and arguments that may attempt to manipulate | ||||
| > | features of their artifacts to make them appear legitimate o | ||||
| > | r benign to users and/or security tools.(Citation: Twitter I | ||||
| > | tsReallyNick Masquerading Update) Monitor for changes made t | ||||
| > | o scheduled jobs that may attempt to manipulate features of | ||||
| > | their artifacts to make them appear legitimate or benign to | ||||
| > | users and/or security tools. Monitor for changes made to ser | ||||
| > | vices that may attempt to manipulate features of their artif | ||||
| > | acts to make them appear legitimate or benign to users and/o | ||||
| > | r security tools. Collect file hashes. Monitor for file name | ||||
| > | s that do not match their expected hash. Perform file monito | ||||
| > | ring. Files with known names but in unusual locations are su | ||||
| > | spect. Look for indications of common characters that may i | ||||
| > | ndicate an attempt to trick users into misidentifying the fi | ||||
| > | le type, such as a space as the last character of a file nam | ||||
| > | e or the right-to-left override characters\"\\u202E\", \"[U+202E | ||||
| > | ]\", and \"%E2%80%AE\". For added context on adversary procedur | ||||
| > | es and background see [Masquerading](https://attack.mitre.or | ||||
| > | g/techniques/T1036) and applicable sub-techniques. Monitor f | ||||
| > | or newly constructed scheduled jobs that may attempt to mani | ||||
| > | pulate features of their artifacts to make them appear legit | ||||
| > | imate or benign to users and/or security tools. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor login sessions for new or unexpected devices or sess | t | 1 | Real-time monitoring identifies a previously unseen wireless |
| > | ions on wireless networks. Monitor application logs for new | > | device identity joining or authenticating to an ICS wireles | ||
| > | or unexpected devices or sessions on wireless networks. New | > | s segment\u2014such as Wi-Fi/802.1X, WirelessHART, ISA100.11a, or | ||
| > | or irregular network traffic flows may indicate potentially | > | a vendor radio mesh\u2014when its MAC/EUI, certificate, or devic | ||
| > | unwanted devices or sessions on wireless networks. In Wi-Fi | > | e identifier is absent from the approved wireless asset inve | ||
| > | networks monitor for changes such as rogue access points or | > | ntory. OT operational-fidelity gate: Alert only when the acc | ||
| > | low signal strength, indicating a device is further away fro | > | ount/device/session violates the approved identity + source | ||
| > | m the access point then expected and changes in the physical | > | host/jump path/zone policy and is corroborated by access to | ||
| > | layer signal.(Citation: Nzyme Alerts Intro) (Citation: Wire | > | a protected OT asset, execution, configuration change, or an | ||
| > | less Intrusion Detection) Network traffic content will provi | > | other security-relevant follow-on event. Suppress approved s | ||
| > | de important context, such as hardware (e.g., MAC) addresses | > | hift activity, vendor support, break-glass use, commissionin | ||
| > | , user accounts, and types of messages sent. | > | g, and documented remote-access windows. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor ICS automation network protocols for functions relat | t | 1 | Real-time network monitoring identifies a source issuing rea |
| > | ed to reading an operational process state (e.g., \u201cRead\u201d fun | > | d-only Industrial Control System (ICS) protocol requests to | ||
| > | ction codes in protocols like DNP3 or Modbus). In some cases | > | multiple field devices at a polling rate exceeding the legit | ||
| > | , there may be multiple ways to monitor an operational proce | > | imate Supervisory Control and Data Acquisition (SCADA) basel | ||
| > | ss\u2019 state, one of which is typically used in the operational | > | ine, from a source not in the approved control server allowl | ||
| > | environment. Monitor for the operating mode being checked i | > | ist. Because the action is read-only, source-identity and ra | ||
| > | n unexpected ways. Monitor applications logs for any access | > | te deviation are the only available distinguishing signals. | ||
| > | attempts to operational databases (e.g., historians) or othe | > | OT operational-fidelity gate: Do not alert on novelty, scan/ | ||
| > | r sources of operational data within the ICS environment. Th | > | read volume, or enumeration alone. Alert when the source rol | ||
| > | ese devices should be monitored for adversary collection usi | > | e is not authorized for discovery/polling and the target sco | ||
| > | ng techniques relevant to the underlying technologies (e.g., | > | pe, address/tag range, protocol, or rate deviates from the e | ||
| > | Windows, Linux). | > | stablished operational baseline. Suppress normal SCADA/HMI/h | ||
| > | istorian polling, commissioning, asset inventory, backup, di | ||||
| > | agnostics, and approved engineering activity. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for loss of network traffic which could indicate ala | t | 1 | Real-time monitoring of the alarm and process historian laye |
| > | rms are being suppressed. A loss of expected communications | > | r identifies an alarm status transitioning to suppressed, sh | ||
| > | associated with network protocols used to communicate alarm | > | elved, disabled, or acknowledged without a corresponding ope | ||
| > | events or process data could indicate this technique is bein | > | rator action recorded within a grace period, correlated with | ||
| > | g used. This will not directly detect the technique\u2019s execut | > | Industrial Control System (ICS) protocol write traffic to a | ||
| > | ion, but instead may provide additional evidence that the te | > | larm configuration or threshold registers arriving in the sa | ||
| > | chnique has been used and may complement other detections. M | > | me window from a source not in the approved engineering list | ||
| > | onitor for loss of operational process data which could indi | > | . OT operational-fidelity gate: Alert only when the action i | ||
| > | cate alarms are being suppressed. This will not directly det | > | s not attributable to an authorized operator/engineering sou | ||
| > | ect the technique\u2019s execution, but instead may provide addit | > | rce for the specific target and function, and it is either o | ||
| > | ional evidence that the technique has been used and may comp | > | utside an approved change/maintenance window or lacks matchi | ||
| > | lement other detections. Monitor for loss of expected device | > | ng change-control context; where telemetry permits, require | ||
| > | alarms which could indicate alarms are being suppressed. As | > | corroborating device, configuration, or process-state effect | ||
| > | noted in the technique description, there may be multiple s | > | . Suppress activity that fully matches approved maintenance, | ||
| > | ources of alarms in an ICS environment. Discrepancies betwee | > | commissioning, failover, recovery, or tested control proced | ||
| > | n alarms may indicate the adversary is suppressing some but | > | ures. | ||
| > | not all the alarms in the environment. This will not directl | ||||
| > | y detect the technique\u2019s execution, but instead may provide | ||||
| > | additional evidence that the technique has been used and may | ||||
| > | complement other detections. Monitor for loss of expected o | ||||
| > | perational process alarms which could indicate alarms are be | ||||
| > | ing suppressed. As noted in the technique description, there | ||||
| > | may be multiple sources of alarms in an ICS environment. Di | ||||
| > | screpancies between alarms may indicate the adversary is sup | ||||
| > | pressing some but not all the alarms in the environment. Th | ||||
| > | is will not directly detect the technique\u2019s execution, but i | ||||
| > | nstead may provide additional evidence that the technique ha | ||||
| > | s been used and may complement other detections. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Use verification of distributed binaries through hash checki | t | 1 | Real-time monitoring identifies a vendor-distributed softwar |
| > | ng or other integrity checking mechanisms. Scan downloads fo | > | e update package that, upon execution, exhibits behavior inc | ||
| > | r malicious signatures. | > | onsistent with the vendor's documented installation profile: | ||
| > | spawning unexpected child processes, writing files outside | ||||
| > | the vendor's standard manifest, or loading unsigned Dynamic | ||||
| > | Link Libraries (DLLs). OT operational-fidelity gate: Alert o | ||||
| > | nly when execution violates an approved signer/hash/path/par | ||||
| > | ent/process or tool allowlist, or originates from an unautho | ||||
| > | rized user/tool, and is tied to an OT asset or follow-on OT- | ||||
| > | relevant action. Suppress vendor-signed software, approved e | ||||
| > | ngineering utilities, diagnostics, patching, backup, and doc | ||||
| > | umented maintenance. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for firmware changes which may be observable via ope | t | 1 | Real-time monitoring identifies a field device entering firm |
| > | rational alarms from devices. Monitor device application log | > | ware update mode and receiving a large data transfer on its | ||
| > | s for firmware changes, although not all devices will produc | > | firmware-capable protocol port from a source not in the appr | ||
| > | e such logs. Monitor firmware for unexpected changes. Asset | > | oved engineering workstation list, followed by a device rebo | ||
| > | management systems should be consulted to understand known-g | > | ot, with post-reboot firmware hash not matching the authoriz | ||
| > | ood firmware versions. Dump and inspect BIOS images on vulne | > | ed inventory. OT operational-fidelity gate: Alert only when | ||
| > | rable systems and compare against known good images.(Citatio | > | the action is not attributable to an authorized operator/eng | ||
| > | n: MITRE Copernicus) Analyze differences to determine if mal | > | ineering source for the specific target and function, and it | ||
| > | icious changes have occurred. Log attempts to read/write to | > | is either outside an approved change/maintenance window or | ||
| > | BIOS and compare against known patching behavior. Likewise, | > | lacks matching change-control context; where telemetry permi | ||
| > | EFI modules can be collected and compared against a known-cl | > | ts, require corroborating device, configuration, or process- | ||
| > | ean list of EFI executable binaries to detect potentially ma | > | state effect. Suppress activity that fully matches approved | ||
| > | licious modules. The CHIPSEC framework can be used for analy | > | maintenance, commissioning, failover, recovery, or tested co | ||
| > | sis to determine if firmware modifications have been perform | > | ntrol procedures. | ||
| > | ed.(Citation: McAfee CHIPSEC Blog)(Citation: Github CHIPSEC) | ||||
| > | (Citation: Intel HackingTeam UEFI Rootkit) Monitor ICS manag | ||||
| > | ement protocols / file transfer protocols for protocol funct | ||||
| > | ions related to firmware changes. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for newly executed processes that execute from remov | t | 1 | Real-time monitoring identifies a Universal Serial Bus (USB) |
| > | able media after it is mounted or when initiated by a user. | > | storage device insertion event on an Industrial Control Sys | ||
| > | If a remote access tool is used in this manner to move later | > | tem (ICS) engineering or Human-Machine Interface (HMI) works | ||
| > | ally, then additional actions are likely to occur after exec | > | tation where the device's hardware identifier (ID) is not in | ||
| > | ution, such as opening network connections for Command and C | > | the authorized USB allowlist, immediately followed by proce | ||
| > | ontrol and system and network information Discovery. Monito | > | ss execution from the removable drive's path. Documented as | ||
| > | r for newly constructed files copied to or from removable me | > | the primary infection vector for Stuxnet, which specifically | ||
| > | dia. Monitor for newly constructed drive letters or mount po | > | targeted air-gapped Siemens engineering environments via in | ||
| > | ints to removable media. Monitor for files accessed on remov | > | fected USB drives. OT operational-fidelity gate: Alert only | ||
| > | able media, particularly those with executable content. | > | when the account/device/session violates the approved identi | ||
| > | ty + source host/jump path/zone policy and is corroborated b | ||||
| > | y access to a protected OT asset, execution, configuration c | ||||
| > | hange, or another security-relevant follow-on event. Suppres | ||||
| > | s approved shift activity, vendor support, break-glass use, | ||||
| > | commissioning, and documented remote-access windows. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for any suspicious attempts to enable script executi | t | 1 | Real-time network monitoring identifies a source issuing sys |
| > | on on a system. If scripts are not commonly used on a system | > | tematic, sequential Industrial Control System (ICS) protocol | ||
| > | , but enabled, scripts running out of cycle from patching or | > | reads sweeping the full register/address range across multi | ||
| > | other administrator functions are suspicious. Scripts shoul | > | ple field devices within a short time window, from a source | ||
| > | d be captured from the file system when possible, to determi | > | not in the approved control server list. OT operational-fide | ||
| > | ne their actions and intent. Monitor executed commands and a | > | lity gate: Do not alert on novelty, scan/read volume, or enu | ||
| > | rguments for actions that could be taken to collect internal | > | meration alone. Alert when the source role is not authorized | ||
| > | data. Monitor for unexpected files (e.g., .pdf, .docx, .jpg | > | for discovery/polling and the target scope, address/tag ran | ||
| > | ) viewed for collecting internal data. Monitor for informati | > | ge, protocol, or rate deviates from the established operatio | ||
| > | on collection on assets that may indicate deviations from st | > | nal baseline. Suppress normal SCADA/HMI/historian polling, c | ||
| > | andard operational tools. Examples include unexpected indust | > | ommissioning, asset inventory, backup, diagnostics, and appr | ||
| > | rial automation protocol functions, new high volume communic | > | oved engineering activity. | ||
| > | ation sessions, or broad collection across many hosts within | ||||
| > | the network. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Analyze network data for uncommon data flows (e.g., new prot | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | ocols in use between hosts, unexpected ports in use). Proces | > | (ICS) host or server establishing outbound connections on a | ||
| > | ses utilizing the network that do not normally have network | > | commonly-allowed port (e.g., 443, 80, 8080, 53, etc.) to a | ||
| > | communication or have never been seen before are suspicious. | > | destination not in the approved vendor/business domain list, | ||
| > | Monitor for mismatches between protocols and their expecte | > | where that host's documented network role does not require | ||
| > | d ports (e.g., non-HTTP traffic on tcp:80). Analyze packet c | > | external connectivity. Documented real-world use: Sandworm's | ||
| > | ontents to detect communications that do not follow the expe | > | 2015 Ukraine power grid attack used port 443 for Command an | ||
| > | cted protocol behavior for the port that is being used.(Cita | > | d Control (C2) communications. OT operational-fidelity gate: | ||
| > | tion: University of Birmingham C2) | > | Alert only when the asset's documented role does not permit | ||
| > | the connection and the destination/proxy/service is outside | ||||
| > | the approved communications profile, with process/service i | ||||
| > | dentity used as corroboration where available. Suppress appr | ||||
| > | oved vendor support, update repositories, remote operations, | ||||
| > | failover paths, and documented temporary connectivity. SNI | ||||
| > | and certificate attributes are TLS/session metadata; do not | ||||
| > | treat them as decrypted payload content. Encrypted applicati | ||||
| > | on content requires a separate inspection point. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor operational process data for write commands for an e | t | 1 | Real-time network monitoring identifies a source issuing wri |
| > | xcessive number of I/O points or manipulating a single value | > | te commands to the same Input/Output (I/O) point or register | ||
| > | an excessive number of times. This will not directly detect | > | address at a rate significantly exceeding the device's conf | ||
| > | the technique\u2019s execution, but instead may provide addition | > | igured scan cycle. The write rate itself is the signature, w | ||
| > | al evidence that the technique has been used and may complem | > | ith source identity retained as corroborating context; treat | ||
| > | ent other detections. Some asset application logs may provid | > | the rate deviation as suspicious only after excluding tunin | ||
| > | e information on I/O points related to write commands. Monit | > | g, commissioning, failover, and fault-recovery activity. OT | ||
| > | or for write commands for an excessive number of I/O points | > | operational-fidelity gate: Alert only when the action is not | ||
| > | or manipulating a single value an excessive number of times. | > | attributable to an authorized operator/engineering source f | ||
| > | Monitor network traffic for ICS functions related to write | > | or the specific target and function, and it is either outsid | ||
| > | commands for an excessive number of I/O points or manipulati | > | e an approved change/maintenance window or lacks matching ch | ||
| > | ng a single value an excessive number of times. | > | ange-control context; where telemetry permits, require corro | ||
| > | borating device, configuration, or process-state effect. Sup | ||||
| > | press activity that fully matches approved maintenance, comm | ||||
| > | issioning, failover, recovery, or tested control procedures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Detecting software exploitation may be difficult depending o | t | 1 | Real-time monitoring identifies Industrial Control System (I |
| > | n the tools available. Software exploits may not always succ | > | CS) protocol commands succeeding against protected device fu | ||
| > | eed or may cause the exploited process to become unstable or | > | nctions from a source or session context that the device's d | ||
| > | crash. | > | ocumented access control model should reject, indicating exp | ||
| > | loitation of a vulnerability to bypass the device's privileg | ||||
| > | e model. Documented as the core mechanism of the Triton atta | ||||
| > | ck, which exploited a zero-day in Triconex firmware while in | ||||
| > | PROGRAM mode. OT operational-fidelity gate: Alert only when | ||||
| > | execution violates an approved signer/hash/path/parent/proc | ||||
| > | ess or tool allowlist, or originates from an unauthorized us | ||||
| > | er/tool, and is tied to an OT asset or follow-on OT-relevant | ||||
| > | action. Suppress vendor-signed software, approved engineeri | ||||
| > | ng utilities, diagnostics, patching, backup, and documented | ||||
| > | maintenance. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for files (such as /etc/hosts) being accessed that m | t | 1 | Real-time monitoring identifies execution of network discove |
| > | ay attempt to get a listing of other systems by IP address, | > | ry tools (nmap, PLCScan, redpoint NSE scripts) or Industrial | ||
| > | hostname, or other logical identifier on a network that may | > | Control System (ICS)-specific scanners from an Industrial C | ||
| > | be used for Lateral Movement from the current system. Monito | > | ontrol System (ICS) Windows host, from a process not associa | ||
| > | r for newly executed processes that can be used to discover | > | ted with a recognized network management or engineering tool | ||
| > | remote systems, such as ping.exe and tracert.exe , especial | > | . OT operational-fidelity gate: Do not alert on novelty, sca | ||
| > | ly when executed in quick succession.(Citation: Elastic - Ko | > | n/read volume, or enumeration alone. Alert when the source r | ||
| > | adiac Detection with EQL) Consider monitoring for new proces | > | ole is not authorized for discovery/polling and the target s | ||
| > | ses engaging in scanning activity or connecting to multiple | > | cope, address/tag range, protocol, or rate deviates from the | ||
| > | systems by correlating process creation network data. Monito | > | established operational baseline. Suppress normal SCADA/HMI | ||
| > | r for anomalies related to discovery related ICS functions, | > | /historian polling, commissioning, asset inventory, backup, | ||
| > | including devices that have not previously used these functi | > | diagnostics, and approved engineering activity. | ||
| > | ons or for functions being sent to many outstations. Note th | ||||
| > | at some ICS protocols use broadcast or multicast functionali | ||||
| > | ty, which may produce false positives. Also monitor for host | ||||
| > | s enumerating network connected resources using non-ICS ente | ||||
| > | rprise protocols. Monitor for new ICS protocol connections t | ||||
| > | o existing assets or for device scanning (i.e., a host conne | ||||
| > | cting to many devices) over ICS and enterprise protocols (e. | ||||
| > | g., ICMP, DCOM, WinRM). For added context on adversary enter | ||||
| > | prise procedures and background see [Remote System Discovery | ||||
| > | ](https://attack.mitre.org/techniques/T1018). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Detecting software exploitation may be difficult depending o | t | 1 | Real-time monitoring identifies an internet-facing Industria |
| > | n the tools available. Software exploits may not always succ | > | l Control System (ICS) application server, web Human-Machine | ||
| > | eed or may cause the exploited process to become unstable or | > | Interface (HMI), historian web interface, vendor remote acc | ||
| > | crash. Web Application Firewalls may detect improper inputs | > | ess portal) process spawning an unexpected child process imm | ||
| > | attempting exploitation. Use deep packet inspection to look | > | ediately following an inbound web request containing exploit | ||
| > | for artifacts of common exploit traffic, such as known payl | > | -pattern content. Documented across multiple incidents invol | ||
| > | oads. | > | ving internet-exposed ICS web interfaces. OT operational-fid | ||
| > | elity gate: Alert only when execution violates an approved s | ||||
| > | igner/hash/path/parent/process or tool allowlist, or origina | ||||
| > | tes from an unauthorized user/tool, and is tied to an OT ass | ||||
| > | et or follow-on OT-relevant action. Suppress vendor-signed s | ||||
| > | oftware, approved engineering utilities, diagnostics, patchi | ||||
| > | ng, backup, and documented maintenance. Analyst implementati | ||||
| > | on must limit predicates to fields actually retained by the | ||||
| > | web server/WAF (for example URI/path/query/header/status/sou | ||||
| > | rce); request-body or payload signatures require WAF/DPI or | ||||
| > | request-body logging and must not be inferred from a basic a | ||||
| > | ccess log. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor asset application logs for information that indicate | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | task parameters have changed. Monitor device alarms that in | > | (ICS) protocol write to a controller's task/organization-bl | ||
| > | dicate controller task parameters have changed, although not | > | ock configuration from a source not in the approved engineer | ||
| > | all devices produce such alarms. [Program Download](https | > | ing workstation list, correlated against post-modification c | ||
| > | ://attack.mitre.org/techniques/T0843) may be used to enable | > | ycle timing deviation. Documented precedent: Stuxnet infecte | ||
| > | this technique. Monitor for program downloads which may be n | > | d Siemens OB1 (main execution cycle block) so its malicious | ||
| > | oticeable via operational alarms. Asset management systems s | > | payload ran every cycle, and infected OB35 (watchdog/interru | ||
| > | hould be consulted to understand expected program versions. | > | pt block) to suppress error reporting. OT operational-fideli | ||
| > | Engineering and asset management software will often maintai | > | ty gate: Alert only when the action is not attributable to a | ||
| > | n a copy of the expected program loaded on a controller and | > | n authorized operator/engineering source for the specific ta | ||
| > | may also record any changes made to controller programs and | > | rget and function, and it is either outside an approved chan | ||
| > | tasks. Data from these platforms can be used to identify mod | > | ge/maintenance window or lacks matching change-control conte | ||
| > | ified controller tasking. | > | xt; where telemetry permits, require corroborating device, c | ||
| > | onfiguration, or process-state effect. Suppress activity tha | ||||
| > | t fully matches approved maintenance, commissioning, failove | ||||
| > | r, recovery, or tested control procedures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Devices that provide user access to the underlying operating | t | 1 | Real-time monitoring identifies an unrecognized process on a |
| > | system may allow the installation of custom software to mon | > | n ICS Linux host loading an ICS/vendor shared library that i | ||
| > | itor OS API execution. Monitoring API calls may generate a s | > | s normally restricted to approved control or engineering app | ||
| > | ignificant amount of data and may not be useful for defense | > | lications. OT operational-fidelity gate: Alert only when exe | ||
| > | unless collected under specific circumstances, since benign | > | cution violates an approved signer/hash/path/parent/process | ||
| > | use of API functions are common and may be difficult to dist | > | or tool allowlist, or originates from an unauthorized user/t | ||
| > | inguish from malicious behavior. Correlation of other events | > | ool, and is tied to an OT asset or follow-on OT-relevant act | ||
| > | with behavior surrounding API function calls using API moni | > | ion. Suppress vendor-signed software, approved engineering u | ||
| > | toring will provide additional context to an event that may | > | tilities, diagnostics, patching, backup, and documented main | ||
| > | assist in determining if it is due to malicious behavior. | > | tenance. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Purely passive network sniffing cannot be detected effective | t | 1 | Real-time monitoring identifies indirect evidence of passive |
| > | ly. In cases where the adversary interacts with the wireless | > | RF capture on Industrial Control System (ICS) wireless freq | ||
| > | network (e.g., joining a Wi-Fi network) detection may be po | > | uencies -- an unassociated device's RF signature detected wi | ||
| > | ssible. Monitor for new or irregular network traffic flows w | > | thout a completed association sequence, or a known device's | ||
| > | hich may indicate potentially unwanted devices or sessions o | > | Media Access Control (MAC) address detected from a location/ | ||
| > | n wireless networks. In Wi-Fi networks monitor for changes | > | signal strength inconsistent with its registered installatio | ||
| > | such as rogue access points or low signal strength, indicati | > | n point. OT operational-fidelity gate: Do not alert on novel | ||
| > | ng a device is further away from the access point then expec | > | ty, scan/read volume, or enumeration alone. Alert when the s | ||
| > | ted and changes in the physical layer signal.(Citation: Nzym | > | ource role is not authorized for discovery/polling and the t | ||
| > | e Alerts Intro) (Citation: Wireless Intrusion Detection) Ne | > | arget scope, address/tag range, protocol, or rate deviates f | ||
| > | twork traffic content will provide important context, such a | > | rom the established operational baseline. Suppress normal SC | ||
| > | s hardware (e.g., MAC) addresses, user accounts, and types o | > | ADA/HMI/historian polling, commissioning, asset inventory, b | ||
| > | f messages sent. | > | ackup, diagnostics, and approved engineering activity. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for network traffic originating from unknown/unexpec | t | 1 | Real-time monitoring identifies a device establishing its fi |
| > | ted hardware devices. Local network traffic metadata (such a | > | rst network connection to Industrial Control System (ICS) ap | ||
| > | s source MAC addressing) may be helpful in identifying trans | > | plication servers from an Internet Protocol (IP) address or | ||
| > | ient assets. Networking devices such as switches may log whe | > | Media Access Control (MAC) address not previously seen in th | ||
| > | n new client devices connect (e.g., SNMP notifications). Mon | > | e environment, immediately following a new device associatio | ||
| > | itor for any logs documenting changes to network connection | > | n event on the network. OT operational-fidelity gate: Alert | ||
| > | status to determine when a new connection has occurred, incl | > | only when the account/device/session violates the approved i | ||
| > | uding the resulting addresses (e.g., IP, MAC) of devices on | > | dentity + source host/jump path/zone policy and is corrobora | ||
| > | that network. | > | ted by access to a protected OT asset, execution, configurat | ||
| > | ion change, or another security-relevant follow-on event. Su | ||||
| > | ppress approved shift activity, vendor support, break-glass | ||||
| > | use, commissioning, and documented remote-access windows. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for unexpected network share access, such as files t | t | 1 | Real-time monitoring identifies a file written to an Industr |
| > | ransferred between shares within a network using protocols s | > | ial Control System (ICS) host from a remote network share, w | ||
| > | uch as Server Message Block (SMB). Monitor for alike file ha | > | here the file has an executable or script extension, immedia | ||
| > | shes or characteristics (ex: filename) that are created on m | > | tely followed by execution of that file from the same path. | ||
| > | ultiple hosts. Monitor for file creation in conjunction wit | > | Documented in the PIPEDREAM toolkit's modular design, where | ||
| > | h other techniques (e.g., file transfers using [Remote Servi | > | components transfer files to compromised Programmable Logic | ||
| > | ces](https://attack.mitre.org/techniques/T0886)). Monitor fo | > | Controllers (PLCs) and engineering workstations. OT operatio | ||
| > | r unusual processes with internal network connections creati | > | nal-fidelity gate: Alert only when execution violates an app | ||
| > | ng files on-system which may be suspicious. Monitor execute | > | roved signer/hash/path/parent/process or tool allowlist, or | ||
| > | d commands and arguments for abnormal usage of utilities and | > | originates from an unauthorized user/tool, and is tied to an | ||
| > | command-line arguments that may be used in support of remot | > | OT asset or follow-on OT-relevant action. Suppress vendor-s | ||
| > | e transfer of files. Monitor newly constructed processes tha | > | igned software, approved engineering utilities, diagnostics, | ||
| > | t assist in lateral tool transfers, such as file transfer pr | > | patching, backup, and documented maintenance. | ||
| > | ograms. Monitor for network traffic originating from unknown | ||||
| > | /unexpected hosts. Local network traffic metadata (such as s | ||||
| > | ource MAC addressing) as well as usage of network management | ||||
| > | protocols such as DHCP may be helpful in identifying hardwa | ||||
| > | re. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Various techniques enable spoofing a reporting message. Cons | t | 1 | Real-time monitoring identifies a process on an Industrial C |
| > | ider monitoring for [Rogue Master](https://attack.mitre.org/ | > | ontrol System (ICS) Windows host injecting spoofed reporting | ||
| > | techniques/T0848) and [Adversary-in-the-Middle](https://atta | > | messages into the Supervisory Control and Data Acquisition | ||
| > | ck.mitre.org/techniques/T0830) activity which may precede th | > | (SCADA) data path -- Open Platform Communications Unified Ar | ||
| > | is technique. Monitor asset logs for alarms or other informa | > | chitecture (OPC UA) data change notifications with fabricate | ||
| > | tion the adversary is unable to directly suppress. Relevant | > | d values, or historian tag writes that override device-sourc | ||
| > | alarms include those from a loss of communications due to [A | > | ed values -- from a process that is not the recognized data | ||
| > | dversary-in-the-Middle](https://attack.mitre.org/techniques/ | > | acquisition process. OT operational-fidelity gate: Alert onl | ||
| > | T0830) activity. Various techniques enable spoofing a report | > | y when the action is not attributable to an authorized opera | ||
| > | ing message. Monitor for LLMNR/NBT-NS poisoning via new serv | > | tor/engineering source for the specific target and function, | ||
| > | ices/daemons which may be used to enable this technique. For | > | and it is either outside an approved change/maintenance win | ||
| > | added context on adversary procedures and background see [N | > | dow or lacks matching change-control context; where telemetr | ||
| > | ame Resolution Poisoning and SMB Relay](https://attack.mitre | > | y permits, require corroborating device, configuration, or p | ||
| > | .org/techniques/T1557/001). Spoofed reporting messages may b | > | rocess-state effect. Suppress activity that fully matches ap | ||
| > | e detected by reviewing the content of automation protocols, | > | proved maintenance, commissioning, failover, recovery, or te | ||
| > | either through detecting based on expected values or compar | > | sted control procedures. | ||
| > | ing to other out of band process data sources. Spoofed messa | ||||
| > | ges may not precisely match legitimate messages which may le | ||||
| > | ad to malformed traffic, although traffic may be malformed f | ||||
| > | or many benign reasons. Monitor reporting messages for chang | ||||
| > | es in how they are constructed. Various techniques enable s | ||||
| > | poofing a reporting message. Consider monitoring for [Rogue | ||||
| > | Master](https://attack.mitre.org/techniques/T0848) and [Adve | ||||
| > | rsary-in-the-Middle](https://attack.mitre.org/techniques/T08 | ||||
| > | 30) activity. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for unexpected/abnormal access to files that may be | t | 1 | Monitor Windows Security Event ID 4663 on explicitly audited |
| > | malicious collection of local data, such as user files (e.g. | > | ICS data paths and correlate repeated ReadData/ListDirector | ||
| > | , .pdf, .docx, .jpg, .dwg ) or local databases. Monitor fo | > | y access across multiple sensitive files or directories by a | ||
| > | r newly executed processes that may search local system sour | > | n account/process outside the approved engineering, backup, | ||
| > | ces, such as file systems or local databases, to find files | > | or application baseline. This requires Object Access auditin | ||
| > | of interest and sensitive data. Monitor for any suspicious a | > | g and SACLs on the monitored paths; Sysmon does not provide | ||
| > | ttempts to enable scripts running on a system. If scripts ar | > | generic file-read telemetry. Alert when the bulk-read patter | ||
| > | e not commonly used on a system, but enabled, scripts runnin | > | n occurs outside an approved backup/export window or is foll | ||
| > | g out of cycle from patching or other administrator function | > | owed by staging, compression, or network transfer. | ||
| > | s are suspicious. Scripts should be captured from the file s | ||||
| > | ystem when possible to determine their actions and intent. D | ||||
| > | ata may also be acquired through Windows system management t | ||||
| > | ools such as [Windows Management Instrumentation](https://at | ||||
| > | tack.mitre.org/techniques/T1047) and [PowerShell](https://at | ||||
| > | tack.mitre.org/techniques/T1059/001). Monitor for API calls | ||||
| > | that may search local system sources, such as file systems o | ||||
| > | r local databases, to find files of interest and sensitive d | ||||
| > | ata. Monitor executed commands and arguments that may searc | ||||
| > | h and collect local system sources, such as file systems or | ||||
| > | local databases, to find files of interest and sensitive dat | ||||
| > | a. Remote access tools with built-in features may interact d | ||||
| > | irectly with the Windows API to gather data. Data may also b | ||||
| > | e acquired through Windows system management tools such as [ | ||||
| > | Windows Management Instrumentation](https://attack.mitre.org | ||||
| > | /techniques/T1047) and [PowerShell](https://attack.mitre.org | ||||
| > | /techniques/T1059/001). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor executed commands and arguments that may delete or a | t | 1 | Real-time monitoring identifies an audit log clearing event |
| > | lter generated artifacts on a host system, including logs or | > | or deletion/truncation of an Industrial Control System (ICS) | ||
| > | captured files such as quarantined malware. Monitor for API | > | vendor application log file, immediately preceded by other | ||
| > | calls that may delete or alter generated artifacts on a hos | > | suspicious activity on the same host within a short lookback | ||
| > | t system, including logs or captured files such as quarantin | > | window. Documented in the CaddyWiper deployment alongside I | ||
| > | ed malware. Monitor for changes made to Windows Registry key | > | ndustroyer2, explicitly intended to destroy evidence and slo | ||
| > | s or values that may delete or alter generated artifacts on | > | w forensic recovery. OT operational-fidelity gate: Alert onl | ||
| > | a host system, including logs or captured files such as quar | > | y when execution violates an approved signer/hash/path/paren | ||
| > | antined malware. For added context on adversary procedures a | > | t/process or tool allowlist, or originates from an unauthori | ||
| > | nd background see [Indicator Removal](https://attack.mitre.o | > | zed user/tool, and is tied to an OT asset or follow-on OT-re | ||
| > | rg/techniques/T1070) and applicable sub-techniques. Monitor | > | levant action. Suppress vendor-signed software, approved eng | ||
| > | for contextual file data that may show signs of deletion or | > | ineering utilities, diagnostics, patching, backup, and docum | ||
| > | alter generated artifacts on a host system, including logs o | > | ented maintenance. | ||
| > | r captured files such as quarantined malware. Monitor Window | ||||
| > | s registry keys that may be deleted or alter generated artif | ||||
| > | acts on a host system, including logs or captured files such | ||||
| > | as quarantined malware. For added context on adversary proc | ||||
| > | edures and background see [Indicator Removal](https://attack | ||||
| > | .mitre.org/techniques/T1070) and applicable sub-techniques. | ||||
| > | Monitor for a file that may delete or alter generated artifa | ||||
| > | cts on a host system, including logs or captured files such | ||||
| > | as quarantined malware. Monitor for changes made to a file m | ||||
| > | ay delete or alter generated artifacts on a host system, inc | ||||
| > | luding logs or captured files such as quarantined malware. M | ||||
| > | onitor for newly executed processes that may delete or alter | ||||
| > | generated artifacts on a host system, including logs or cap | ||||
| > | tured files such as quarantined malware. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor executed commands and arguments that may attempt to | t | 1 | Real-time monitoring identifies execution of screenshot util |
| > | take screen captures of the desktop to gather information ov | > | ities (scrot, import, xwd) on an Industrial Control System ( | ||
| > | er the course of an operation. Monitoring for screen capture | > | ICS) Linux Human-Machine Interface (HMI), from a User Identi | ||
| > | behavior will depend on the method used to obtain data from | > | fier (UID) that does not normally perform display operations | ||
| > | the operating system and write output files. Detection meth | > | . OT operational-fidelity gate: Do not alert on novelty, sca | ||
| > | ods could include collecting information from unusual proces | > | n/read volume, or enumeration alone. Alert when the source r | ||
| > | ses using API calls used to obtain image data, and monitorin | > | ole is not authorized for discovery/polling and the target s | ||
| > | g for image files written to disk, such as CopyFromScreen, x | > | cope, address/tag range, protocol, or rate deviates from the | ||
| > | wd, or screencapture.(Citation: CopyFromScreen .NET)(Citatio | > | established operational baseline. Suppress normal SCADA/HMI | ||
| > | n: Antiquated Mac Malware) The data may need to be correlate | > | /historian polling, commissioning, asset inventory, backup, | ||
| > | d with other events to identify malicious activity, dependin | > | diagnostics, and approved engineering activity. | ||
| > | g on the legitimacy of this behavior within a given network | ||||
| > | environment. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor device alarms for program downloads, although not al | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | l devices produce such alarms. Monitor for protocol function | > | (ICS) protocol session consistent with a program download t | ||
| > | s related to program download or modification. Program downl | > | o a field device from a source not in the approved engineeri | ||
| > | oads may be observable in ICS automation protocols and remot | > | ng workstation list, correlated with a device mode-change al | ||
| > | e management protocols. Consult asset management systems to | > | arm transitioning to PROGRAM/STOP immediately preceding the | ||
| > | understand expected program versions. Monitor devices config | > | transfer. Documented in Stuxnet (code/data block download to | ||
| > | uration logs which may contain alerts that indicate whether | > | alter programmable logic controller behavior) and Triton (T | ||
| > | a program download has occurred. Devices may maintain applic | > | riStation protocol program download to the Triconex Safety I | ||
| > | ation logs that indicate whether a full program download, on | > | nstrumented System). OT operational-fidelity gate: Alert onl | ||
| > | line edit, or program append function has occurred. | > | y when the action is not attributable to an authorized opera | ||
| > | tor/engineering source for the specific target and function, | ||||
| > | and it is either outside an approved change/maintenance win | ||||
| > | dow or lacks matching change-control context; where telemetr | ||||
| > | y permits, require corroborating device, configuration, or p | ||||
| > | rocess-state effect. Suppress activity that fully matches ap | ||||
| > | proved maintenance, commissioning, failover, recovery, or te | ||||
| > | sted control procedures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Devices that provide user access to the underlying operating | t | 1 | Real-time monitoring identifies a process on an Industrial C |
| > | system may allow the installation of custom software to mon | > | ontrol System (ICS) Windows host making direct native Operat | ||
| > | itor OS API execution. Monitoring API calls may generate a s | > | ing System (OS) Application Programming Interface (API) call | ||
| > | ignificant amount of data and may not be useful for defense | > | s that bypass the normal ICS vendor Software Development Kit | ||
| > | unless collected under specific circumstances, since benign | > | (SDK) abstraction layer -- direct CreateFile calls against | ||
| > | use of API functions are common and may be difficult to dist | > | raw device paths, DeviceIoControl calls to ICS hardware driv | ||
| > | inguish from malicious behavior. Correlation of other events | > | er handles -- from a process not a recognized vendor applica | ||
| > | with behavior surrounding API function calls using API moni | > | tion. OT operational-fidelity gate: Alert only when executio | ||
| > | toring will provide additional context to an event that may | > | n violates an approved signer/hash/path/parent/process or to | ||
| > | assist in determining if it is due to malicious behavior. | > | ol allowlist, or originates from an unauthorized user/tool, | ||
| > | and is tied to an OT asset or follow-on OT-relevant action. | ||||
| > | Suppress vendor-signed software, approved engineering utilit | ||||
| > | ies, diagnostics, patching, backup, and documented maintenan | ||||
| > | ce. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for newly constructed logon behavior within Microsof | t | 1 | Real-time monitoring identifies access to Industrial Control |
| > | t's SharePoint can be configured to report access to certain | > | System (ICS) documentation repositories by an account or se | ||
| > | pages and documents.(Citation: Microsoft SharePoint Logging | > | ssion context not associated with documented engineering rol | ||
| > | ) Sharepoint audit logging can also be configured to report | > | es, immediately followed by bulk file access or archive crea | ||
| > | when a user shares a resource.(Citation: Sharepoint Sharing | > | tion. OT operational-fidelity gate: Do not alert on novelty, | ||
| > | Events) The user access logging within Atlassian's Confluenc | > | scan/read volume, or enumeration alone. Alert when the sour | ||
| > | e can also be configured to report access to certain pages a | > | ce role is not authorized for discovery/polling and the targ | ||
| > | nd documents through AccessLogFilter.(Citation: Atlassian Co | > | et scope, address/tag range, protocol, or rate deviates from | ||
| > | nfluence Logging) Additional log storage and analysis infras | > | the established operational baseline. Suppress normal SCADA | ||
| > | tructure will likely be required for more robust detection c | > | /HMI/historian polling, commissioning, asset inventory, back | ||
| > | apabilities. In the case of detecting collection from share | > | up, diagnostics, and approved engineering activity. | ||
| > | d network drives monitor for unexpected and abnormal accesse | ||||
| > | s to network shares. Monitor for third-party application lo | ||||
| > | gging, messaging, and/or other artifacts that may leverage i | ||||
| > | nformation repositories to mine valuable information. Inform | ||||
| > | ation repositories generally have a considerably large user | ||||
| > | base, detection of malicious use can be non-trivial. At mini | ||||
| > | mum, access to information repositories performed by privile | ||||
| > | ged users (for example, Active Directory Domain, Enterprise, | ||||
| > | or Schema Administrators) should be closely monitored and a | ||||
| > | lerted upon, as these types of accounts should generally not | ||||
| > | be used to access information repositories. If the capabili | ||||
| > | ty exists, it may be of value to monitor and alert on users | ||||
| > | that are retrieving and viewing a large number of documents | ||||
| > | and pages; this behavior may be indicative of programmatic m | ||||
| > | eans being used to retrieve all data within the repository. | ||||
| > | In environments with high-maturity, it may be possible to le | ||||
| > | verage User-Behavioral Analytics (UBA) platforms to detect a | ||||
| > | nd alert on user-based anomalies. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor ICS management protocols for functions that change a | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | n asset\u2019s operating mode. Monitor device application logs wh | > | (ICS) protocol mode-change command targeting a field device | ||
| > | ich may contain information related to operating mode change | > | from a source not in the approved engineering workstation l | ||
| > | s, although not all devices produce such logs. Monitor alarm | > | ist, where the transition is not immediately followed by a c | ||
| > | s for information about when an operating mode is changed, a | > | orresponding operator acknowledgment. Documented in Triton ( | ||
| > | lthough not all devices produce such logs. | > | the Tricon controller had to be placed in PROGRAM mode befor | ||
| > | e the attack could inject its payload). OT operational-fidel | ||||
| > | ity gate: Alert only when the action is not attributable to | ||||
| > | an authorized operator/engineering source for the specific t | ||||
| > | arget and function, and it is either outside an approved cha | ||||
| > | nge/maintenance window or lacks matching change-control cont | ||||
| > | ext; where telemetry permits, require corroborating device, | ||||
| > | configuration, or process-state effect. Suppress activity th | ||||
| > | at fully matches approved maintenance, commissioning, failov | ||||
| > | er, recovery, or tested control procedures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor network traffic for default credential use in protoc | t | 1 | Real-time monitoring identifies successful authentication to |
| > | ols that allow unencrypted authentication. Monitor logon ses | > | an Industrial Control System (ICS) application such as a Hu | ||
| > | sions for default credential use. | > | man-Machine Interface (HMI), historian, Supervisory Control | ||
| > | and Data Acquisition (SCADA) server using credentials matchi | ||||
| > | ng known default vendor passwords, from a logon source not a | ||||
| > | ssociated with any authorized user. OT operational-fidelity | ||||
| > | gate: Alert only when the account/device/session violates th | ||||
| > | e approved identity + source host/jump path/zone policy and | ||||
| > | is corroborated by access to a protected OT asset, execution | ||||
| > | , configuration change, or another security-relevant follow- | ||||
| > | on event. Suppress approved shift activity, vendor support, | ||||
| > | break-glass use, commissioning, and documented remote-access | ||||
| > | windows. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for changes made to a large quantity of files for un | t | 1 | Real-time monitoring identifies a process performing rapid, |
| > | expected modifications in both user directories and director | > | bulk deletion or overwrite of files across multiple Industri | ||
| > | ies used to store programs and OS components (e.g., C:\\Windo | > | al Control System (ICS)-relevant directories within a short | ||
| > | ws\\System32). Monitor for newly executed processes of binar | > | time window, by a process not associated with documented dat | ||
| > | ies that could be involved in data destruction activity, suc | > | a retention management, correlated with a system crash short | ||
| > | h as SDelete. Monitor for unexpected deletion of files. Moni | > | ly after. Documented in CaddyWiper, deployed via GPO alongsi | ||
| > | tor executed commands and arguments for binaries that could | > | de Industroyer2. OT operational-fidelity gate: Alert only wh | ||
| > | be involved in data destruction activity, such as SDelete. | > | en the action is not attributable to an authorized operator/ | ||
| > | engineering source for the specific target and function, and | ||||
| > | it is either outside an approved change/maintenance window | ||||
| > | or lacks matching change-control context; where telemetry pe | ||||
| > | rmits, require corroborating device, configuration, or proce | ||||
| > | ss-state effect. Suppress activity that fully matches approv | ||||
| > | ed maintenance, commissioning, failover, recovery, or tested | ||||
| > | control procedures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor and analyze traffic patterns and packet inspection a | t | 1 | Real-time monitoring identifies a Linux process with both a |
| > | ssociated to protocol(s) that do not follow the expected pro | > | listening socket on an Industrial Control System (ICS) proto | ||
| > | tocol standards and traffic flows (e.g., extraneous packets | > | col port and an outbound connection to a non-ICS destination | ||
| > | that do not belong to established flows, gratuitous or anoma | > | , or iptables DNAT/REDIRECT rules added on ICS protocol port | ||
| > | lous traffic patterns, anomalous syntax, or structure). Cons | > | s. OT operational-fidelity gate: Alert only when the asset's | ||
| > | ider correlation with process monitoring and command line to | > | documented role does not permit the connection and the dest | ||
| > | detect anomalous processes execution and command line argum | > | ination/proxy/service is outside the approved communications | ||
| > | ents associated to traffic patterns (e.g., monitor anomalies | > | profile, with process/service identity used as corroboratio | ||
| > | in use of files that do not normally initiate connections f | > | n where available. Suppress approved vendor support, update | ||
| > | or respective protocol(s)). Monitor for known proxy protocol | > | repositories, remote operations, failover paths, and documen | ||
| > | s (e.g., SOCKS, Tor, peer-to-peer protocols) and tool usage | > | ted temporary connectivity. | ||
| > | (e.g., Squid, peer-to-peer software) on the network that ar | ||||
| > | e not part of normal operations. Also monitor network data f | ||||
| > | or uncommon data flows. Processes utilizing the network that | ||||
| > | do not normally have network communication or have never be | ||||
| > | en seen before are suspicious. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Program uploads may be observable in ICS management protocol | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | s or file transfer protocols. Note when protocol functions r | > | (ICS) protocol session reading back the user program from a | ||
| > | elated to program uploads occur. In cases where the ICS prot | > | field device to a source not in the approved engineering wo | ||
| > | ocols is not well understood, one option is to examine netwo | > | rkstation list, where the session byte count is consistent w | ||
| > | rk traffic for the program files themselves using signature- | > | ith a substantial portion of the device's program memory. OT | ||
| > | based tools. Monitor device communication patterns to identi | > | operational-fidelity gate: Do not alert on novelty, scan/re | ||
| > | fy irregular bulk transfers of data between the embedded ICS | > | ad volume, or enumeration alone. Alert when the source role | ||
| > | asset and other nodes within the network. Note these indica | > | is not authorized for discovery/polling and the target scope | ||
| > | tors are dependent on the profile of normal operations and t | > | , address/tag range, protocol, or rate deviates from the est | ||
| > | he capabilities of the industrial automation protocols invol | > | ablished operational baseline. Suppress normal SCADA/HMI/his | ||
| > | ved (e.g., partial program uploads). Monitor for device alar | > | torian polling, commissioning, asset inventory, backup, diag | ||
| > | ms produced when program uploads occur, although not all dev | > | nostics, and approved engineering activity. | ||
| > | ices will produce such alarms. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor HKLM\\Software\\Policies\\Microsoft\\Windows NT\\DNSClien | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | t for changes to the \"EnableMulticast\" DWORD value. A value | > | (ICS) Windows host simultaneously holding connections to bo | ||
| > | of \"0\" indicates LLMNR is disabled. Host-based implementatio | > | th the field device subnet and an unexpected external or int | ||
| > | ns of this technique may utilize networking-based system cal | > | er-zone destination, combined with proxy-capable process spa | ||
| > | ls or network utility commands (e.g., iptables) to locally i | > | wning and ICS vendor application logs showing endpoint or ce | ||
| > | ntercept traffic. Monitor for relevant process creation even | > | rtificate changes. OT operational-fidelity gate: Alert only | ||
| > | ts. Monitor for network traffic originating from unknown/une | > | when the asset's documented role does not permit the connect | ||
| > | xpected hosts. Local network traffic metadata (such as sourc | > | ion and the destination/proxy/service is outside the approve | ||
| > | e MAC addressing) as well as usage of network management pro | > | d communications profile, with process/service identity used | ||
| > | tocols such as DHCP may be helpful in identifying hardware. | > | as corroboration where available. Suppress approved vendor | ||
| > | For added context on adversary procedures and background see | > | support, update repositories, remote operations, failover pa | ||
| > | [Adversary-in-the-Middle](https://attack.mitre.org/techniqu | > | ths, and documented temporary connectivity. | ||
| > | es/T1557) and applicable sub-techniques. Monitor for newly c | ||||
| > | onstructed services/daemons through Windows event logs for e | ||||
| > | vent IDs 4697 and 7045. Monitor network traffic for anomalie | ||||
| > | s associated with known AiTM behavior. For Collection activi | ||||
| > | ty where transmitted data is not manipulated, anomalies may | ||||
| > | be present in network management protocols (e.g., ARP, DHCP) | ||||
| > | . Monitor application logs for changes to settings and other | ||||
| > | events associated with network protocols and other services | ||||
| > | commonly abused for AiTM. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for changes made to files that may stop or disable s | t | 1 | Real-time monitoring identifies a service control command ta |
| > | ervices on a system to render those services unavailable to | > | rgeting a critical Industrial Control System (ICS) services | ||
| > | legitimate users. Monitor executed commands and arguments th | > | such as Open Platform Communications (OPC) server, historian | ||
| > | at may stop or disable services on a system to render those | > | , Supervisory Control and Data Acquisition (SCADA) polling f | ||
| > | services unavailable to legitimate users. Remote access tool | > | rom an account not in the authorized service administration | ||
| > | s with built-in features may interact directly with the Wind | > | role, without a preceding change-control ticket, immediately | ||
| > | ows API to perform these functions outside of typical system | > | followed by the service transitioning to Stopped state. OT | ||
| > | utilities. For example, ChangeServiceConfigW may be used by | > | operational-fidelity gate: Alert only when the action is not | ||
| > | an adversary to prevent services from starting. For added c | > | attributable to an authorized operator/engineering source f | ||
| > | ontext on adversary procedures and background see [Service S | > | or the specific target and function, and it is either outsid | ||
| > | top](https://attack.mitre.org/techniques/T1489). Monitor pro | > | e an approved change/maintenance window or lacks matching ch | ||
| > | cesses and command-line arguments to see if critical process | > | ange-control context; where telemetry permits, require corro | ||
| > | es are terminated or stop running. For added context on adve | > | borating device, configuration, or process-state effect. Sup | ||
| > | rsary procedures and background see [Service Stop](https://a | > | press activity that fully matches approved maintenance, comm | ||
| > | ttack.mitre.org/techniques/T1489). Alterations to the servic | > | issioning, failover, recovery, or tested control procedures. | ||
| > | e binary path or the service startup type changed to disable | ||||
| > | d may be suspicious. Monitor for changes made to Windows reg | ||||
| > | istry keys and/or values that may stop or disable services o | ||||
| > | n a system to render those services unavailable to legitimat | ||||
| > | e users. Monitor for newly executed processes that may stop | ||||
| > | or disable services on a system to render those services una | ||||
| > | vailable to legitimate users. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for unexpected changes to project files, although if | t | 1 | Configured Windows object-access monitoring identifies a wri |
| > | the malicious modification occurs in tandem with legitimate | > | te to an Industrial Control System (ICS) engineering project | ||
| > | changes it will be difficult to isolate the unintended chan | > | file by a process that is not the recognized vendor enginee | ||
| > | ges by analyzing only file systems modifications. | > | ring software, or by the vendor engineering software immedia | ||
| > | tely after loading a project file from an untrusted source. | ||||
| > | Documented mechanism in Havex (trojanized vendor software/in | ||||
| > | stallers distributed via compromised vendor websites). OT op | ||||
| > | erational-fidelity gate: Alert only when execution violates | ||||
| > | an approved signer/hash/path/parent/process or tool allowlis | ||||
| > | t, or originates from an unauthorized user/tool, and is tied | ||||
| > | to an OT asset or follow-on OT-relevant action. Suppress ve | ||||
| > | ndor-signed software, approved engineering utilities, diagno | ||||
| > | stics, patching, backup, and documented maintenance. Collect | ||||
| > | ion requirement: use Windows Security Event ID 4663 with Obj | ||||
| > | ect Access auditing and SACLs on approved project repositori | ||||
| > | es; Sysmon FileCreate events can corroborate writes/overwrit | ||||
| > | es but do not report generic file-open/read activity. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Detecting software exploitation may be difficult depending o | t | 1 | Real-time monitoring identifies a network-accessible service |
| > | n the tools available. Software exploits may not always succ | > | process (lsass.exe, a vendor remote management service) spa | ||
| > | eed or may cause the exploited process to become unstable or | > | wning an unexpected child process or exhibiting cross-proces | ||
| > | crash, which may be recorded in the application log. Use de | > | s memory access patterns immediately following inbound conne | ||
| > | ep packet inspection to look for artifacts of common exploit | > | ction from an unusual source. OT operational-fidelity gate: | ||
| > | traffic, such as known payloads. | > | Alert only when execution violates an approved signer/hash/p | ||
| > | ath/parent/process or tool allowlist, or originates from an | ||||
| > | unauthorized user/tool, and is tied to an OT asset or follow | ||||
| > | -on OT-relevant action. Suppress vendor-signed software, app | ||||
| > | roved engineering utilities, diagnostics, patching, backup, | ||||
| > | and documented maintenance. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor ICS automation network protocols for functions relat | t | 1 | Real-time monitoring identifies Industrial Control System (I |
| > | ed to reading an asset\u2019s operating mode. In some cases, ther | > | CS) protocol requests specifically targeting mode/status reg | ||
| > | e may be multiple ways to detect a device\u2019s operating mode, | > | isters from a source not in the approved control server or e | ||
| > | one of which is typically used in the operational environmen | > | ngineering workstation list, where the request pattern is na | ||
| > | t. Monitor for the operating mode being checked in unexpecte | > | rrowly focused on mode/state data rather than broader proces | ||
| > | d ways. | > | s value polling. Directly documented in the Triton attack ch | ||
| > | ain's 'Get Control Program Status' request. OT operational-f | ||||
| > | idelity gate: Do not alert on novelty, scan/read volume, or | ||||
| > | enumeration alone. Alert when the source role is not authori | ||||
| > | zed for discovery/polling and the target scope, address/tag | ||||
| > | range, protocol, or rate deviates from the established opera | ||||
| > | tional baseline. Suppress normal SCADA/HMI/historian polling | ||||
| > | , commissioning, asset inventory, backup, diagnostics, and a | ||||
| > | pproved engineering activity. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor executed commands and arguments that may look for de | t | 1 | Real-time monitoring identifies execution of network enumera |
| > | tails about the network configuration and settings, such as | > | tion commands (netstat, arp -a, Get-NetTCPConnection) on an | ||
| > | IP and/or MAC addresses, of systems they access or through i | > | Industrial Control System (ICS) host from an account not ass | ||
| > | nformation discovery of remote systems. Also monitor execute | > | ociated with documented network administration, where multip | ||
| > | d commands and arguments that may attempt to get a listing o | > | le such commands execute in sequence within a short window. | ||
| > | f network connections to or from the compromised system they | > | OT operational-fidelity gate: Do not alert on novelty, scan/ | ||
| > | are currently accessing or from remote systems by querying | > | read volume, or enumeration alone. Alert when the source rol | ||
| > | for information over the network. Information may also be ac | > | e is not authorized for discovery/polling and the target sco | ||
| > | quired through Windows system management tools such as [Wind | > | pe, address/tag range, protocol, or rate deviates from the e | ||
| > | ows Management Instrumentation](https://attack.mitre.org/tec | > | stablished operational baseline. Suppress normal SCADA/HMI/h | ||
| > | hniques/T1047) and [PowerShell](https://attack.mitre.org/tec | > | istorian polling, commissioning, asset inventory, backup, di | ||
| > | hniques/T1059/001). Monitor for executed processes (such as | > | agnostics, and approved engineering activity. | ||
| > | ipconfig/ifconfig and arp) with arguments that may look for | ||||
| > | details about the network configuration and settings, such a | ||||
| > | s IP and/or MAC addresses. Also monitor for executed process | ||||
| > | es that may attempt to get a listing of network connections | ||||
| > | to or from the compromised system they are currently accessi | ||||
| > | ng or from remote systems by querying for information over t | ||||
| > | he network. Monitor for any suspicious attempts to enable sc | ||||
| > | ript execution on a system. If scripts are not commonly used | ||||
| > | on a system, but enabled, scripts running out of cycle from | ||||
| > | patching or other administrator functions are suspicious. S | ||||
| > | cripts should be captured from the file system when possible | ||||
| > | to determine their actions and intent. Monitor for API call | ||||
| > | s (such as GetAdaptersInfo() and GetIpNetTable()) that may g | ||||
| > | ather details about the network configuration and settings, | ||||
| > | such as IP and/or MAC addresses. Also monitor for API calls | ||||
| > | that may attempt to get a listing of network connections to | ||||
| > | or from the compromised system they are currently accessing | ||||
| > | or from remote systems by querying for information over the | ||||
| > | network. For added context on adversary procedures and backg | ||||
| > | round see [System Network Configuration Discovery](https://a | ||||
| > | ttack.mitre.org/techniques/T1016) and [System Network Connec | ||||
| > | tions Discovery](https://attack.mitre.org/techniques/T1049). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for device alarms produced when device management pa | t | 1 | Real-time monitoring identifies Industrial Control System (I |
| > | sswords are changed, although not all devices will produce s | > | CS) protocol commands changing device-level credentials or a | ||
| > | uch alarms. Monitor for device credential changes observable | > | ccess codes from a source not in the approved security admin | ||
| > | in automation or management network protocols. | > | istration list, where the device subsequently rejects connec | ||
| > | tions from legitimate control system components. OT operatio | ||||
| > | nal-fidelity gate: Alert only when the action is not attribu | ||||
| > | table to an authorized operator/engineering source for the s | ||||
| > | pecific target and function, and it is either outside an app | ||||
| > | roved change/maintenance window or lacks matching change-con | ||||
| > | trol context; where telemetry permits, require corroborating | ||||
| > | device, configuration, or process-state effect. Suppress ac | ||||
| > | tivity that fully matches approved maintenance, commissionin | ||||
| > | g, failover, recovery, or tested control procedures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for newly executed processes related to services spe | t | 1 | Real-time monitoring identifies an interactive desktop sessi |
| > | cifically designed to accept remote graphical connections, s | > | on Remote Desktop Protocol (RDP), Virtual Network Computing | ||
| > | uch as RDP and VNC. [Remote Services](https://attack.mitre.o | > | (VNC), or vendor remote console to an Human-Machine Interfac | ||
| > | rg/techniques/T0886) and [Valid Accounts](https://attack.mit | > | e (HMI) or engineering station from a source Internet Protoc | ||
| > | re.org/techniques/T0859) may be used to access a host\u2019s GUI. | > | ol (IP) addresses outside the approved Network Management Sy | ||
| > | Monitor executed commands and arguments related to services | > | stem (NMS) Classless Inter-Domain Routing (CIDR) subnet, or | ||
| > | specifically designed to accept remote graphical connection | > | from an account not in the approved operator/engineer list, | ||
| > | s, such as RDP and VNC. [Remote Services](https://attack.mit | > | where the session subsequently interacts with Industrial Con | ||
| > | re.org/techniques/T0886) and [Valid Accounts](https://attack | > | trol System (ICS) control elements. OT operational-fidelity | ||
| > | .mitre.org/techniques/T0859) may be used to access a host\u2019s | > | gate: Alert only when the account/device/session violates th | ||
| > | GUI. Monitor DLL file events, specifically creation of these | > | e approved identity + source host/jump path/zone policy and | ||
| > | binary files as well as the loading of DLLs into processes | > | is corroborated by access to a protected OT asset, execution | ||
| > | associated with remote graphical connections, such as RDP an | > | , configuration change, or another security-relevant follow- | ||
| > | d VNC. [Remote Services](https://attack.mitre.org/techniques | > | on event. Suppress approved shift activity, vendor support, | ||
| > | /T0886) may be used to access a host\u2019s GUI. Monitor for user | > | break-glass use, commissioning, and documented remote-access | ||
| > | accounts logged into systems they would not normally access | > | windows. | ||
| > | or abnormal access patterns, such as multiple systems over | ||||
| > | a relatively short period of time. Correlate use of login ac | ||||
| > | tivity related to remote services with unusual behavior or o | ||||
| > | ther malicious or suspicious activity. [Remote Services](htt | ||||
| > | ps://attack.mitre.org/techniques/T0886) may be used to acces | ||||
| > | s a host\u2019s GUI. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | A manipulated I/O image requires analyzing the application p | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | rogram running on the PLC for specific data block writes. De | > | (ICS) protocol write to output register addresses on a fiel | ||
| > | tecting this requires obtaining and analyzing a PLC\u2019s applic | > | d device from a source not in the approved write-source list | ||
| > | ation program, either directly from the device or from asset | > | , correlated with a discrepancy between the value reported b | ||
| > | management platforms. | > | y the Input/Output (I/O) image and an independent measuremen | ||
| > | t of the actual physical output state. OT operational-fideli | ||||
| > | ty gate: Alert only when the action is not attributable to a | ||||
| > | n authorized operator/engineering source for the specific ta | ||||
| > | rget and function, and it is either outside an approved chan | ||||
| > | ge/maintenance window or lacks matching change-control conte | ||||
| > | xt; where telemetry permits, require corroborating device, c | ||||
| > | onfiguration, or process-state effect. Suppress activity tha | ||||
| > | t fully matches approved maintenance, commissioning, failove | ||||
| > | r, recovery, or tested control procedures. The independent m | ||||
| > | easurement is process-state telemetry, not network-flow evid | ||||
| > | ence; implementation requires a separately trusted sensor/hi | ||||
| > | storian/measurement path with time alignment and an engineer | ||||
| > | ing-defined tolerance. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Collecting information from the I/O image requires analyzing | t | 1 | Real-time monitoring identifies a single Industrial Control |
| > | the application program running on the PLC for specific dat | > | System (ICS) protocol session reading the complete Input/Out | ||
| > | a block reads. Detecting this requires obtaining and analyzi | > | put (I/O) image from a field device, rather than the sparse, | ||
| > | ng a PLC\u2019s application program, either directly from the dev | > | fixed tag subset that legitimate Supervisory Control and Da | ||
| > | ice or from asset management platforms. | > | ta Acquisition (SCADA) polling queries, from a source not in | ||
| > | the approved control server list. OT operational-fidelity g | ||||
| > | ate: Do not alert on novelty, scan/read volume, or enumerati | ||||
| > | on alone. Alert when the source role is not authorized for d | ||||
| > | iscovery/polling and the target scope, address/tag range, pr | ||||
| > | otocol, or rate deviates from the established operational ba | ||||
| > | seline. Suppress normal SCADA/HMI/historian polling, commiss | ||||
| > | ioning, asset inventory, backup, diagnostics, and approved e | ||||
| > | ngineering activity. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor asset management systems for device configuration ch | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | anges which can be used to understand expected parameter set | > | (ICS) protocol write to a parameter/setpoint register where | ||
| > | tings. Monitor device application logs parameter changes, al | > | the written value falls outside the documented safe operati | ||
| > | though not all devices will produce such logs. Monitor for d | > | ng range, or where the write originates from a source not in | ||
| > | evice alarms produced when parameters are changed, although | > | the approved write-source list, correlated with subsequent | ||
| > | not all devices will produce such alarms. Monitor ICS manage | > | historian tag drift. Documented precedent: FrostyGoop direct | ||
| > | ment protocols for parameter changes, including for unexpect | > | ly modified Modbus holding register values on ENCO heating c | ||
| > | ed values, changes far exceeding standard values, or for par | > | ontrollers in Lviv, Ukraine, causing a two-day remediation o | ||
| > | ameters being changed in an unexpected way (e.g., via a new | > | utage. OT operational-fidelity gate: Alert only when the act | ||
| > | function, at an unusual time). | > | ion is not attributable to an authorized operator/engineerin | ||
| > | g source for the specific target and function, and it is eit | ||||
| > | her outside an approved change/maintenance window or lacks m | ||||
| > | atching change-control context; where telemetry permits, req | ||||
| > | uire corroborating device, configuration, or process-state e | ||||
| > | ffect. Suppress activity that fully matches approved mainten | ||||
| > | ance, commissioning, failover, recovery, or tested control p | ||||
| > | rocedures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor ICS asset application logs that indicate alarm setti | t | 1 | Real-time monitoring identifies Simple Network Management Pr |
| > | ngs have changed, although not all assets will produce such | > | otocol (SNMP) SET commands to alarm threshold Object Identif | ||
| > | logs. Consult asset management systems to understand expecte | > | iers (OIDs) on Industrial Control System (ICS) network devic | ||
| > | d alarm settings. Data about the industrial process may indi | > | es or process monitoring systems from a source not in the ap | ||
| > | cate it is operating outside of expected bounds and could he | > | proved Network Management System (NMS) Classless Inter-Domai | ||
| > | lp indicate that that an alarm setting has changed. This wil | > | n Routing (CIDR) subnet. OT operational-fidelity gate: Alert | ||
| > | l not directly detect the technique\u2019s execution, but instead | > | only when the action is not attributable to an authorized o | ||
| > | may provide additional evidence that the technique has been | > | perator/engineering source for the specific target and funct | ||
| > | used and may complement other detections. Monitor for alarm | > | ion, and it is either outside an approved change/maintenance | ||
| > | setting changes observable in automation or management netw | > | window or lacks matching change-control context; where tele | ||
| > | ork protocols. | > | metry permits, require corroborating device, configuration, | ||
| > | or process-state effect. Suppress activity that fully matche | ||||
| > | s approved maintenance, commissioning, failover, recovery, o | ||||
| > | r tested control procedures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for changes made to firmware for unexpected modifica | t | 1 | Periodic or event-triggered integrity verification identifie |
| > | tions to settings and/or data that may be used by rootkits t | > | s a discrepancy between a field device's self-reported diagn | ||
| > | o hide the presence of programs, files, network connections, | > | ostic state and an independently verified hardware/firmware | ||
| > | services, drivers, and other system components. Asset manag | > | fingerprint, indicating the device's reporting layer has bee | ||
| > | ement systems should be consulted to understand known-good f | > | n compromised. MITRE explicitly notes firmware/module rootki | ||
| > | irmware versions and configurations. | > | ts 'can also be developed for the Input/Output (I/O) that is | ||
| > | attached to an asset.'. OT operational-fidelity gate: Alert | ||||
| > | only when execution violates an approved signer/hash/path/p | ||||
| > | arent/process or tool allowlist, or originates from an unaut | ||||
| > | horized user/tool, and is tied to an OT asset or follow-on O | ||||
| > | T-relevant action. Suppress vendor-signed software, approved | ||||
| > | engineering utilities, diagnostics, patching, backup, and d | ||||
| > | ocumented maintenance. Monitoring reality: this is an integr | ||||
| > | ity/posture analytic, not a universal streaming field-device | ||||
| > | event; collection cadence depends on the vendor integrity i | ||||
| > | nterface, asset-management system, or acquisition workflow. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for suspicious descendant process spawning from Micr | t | 1 | Real-time monitoring identifies an email client process on a |
| > | osoft Office and other productivity software.(Citation: Elas | > | n Industrial Control System (ICS) Linux workstation spawning | ||
| > | tic - Koadiac Detection with EQL) For added context on adver | > | a child process inconsistent with normal email handling. OT | ||
| > | sary procedures and background see [Spearphishing Attachment | > | operational-fidelity gate: Alert only when the account/devi | ||
| > | ](https://attack.mitre.org/techniques/T1566/001). Monitor fo | > | ce/session violates the approved identity + source host/jump | ||
| > | r newly constructed files from a spearphishing emails with a | > | path/zone policy and is corroborated by access to a protect | ||
| > | malicious attachment in an attempt to gain access to victim | > | ed OT asset, execution, configuration change, or another sec | ||
| > | systems. Monitor network traffic for suspicious email attac | > | urity-relevant follow-on event. Suppress approved shift acti | ||
| > | hments. Consider correlation with process monitoring and com | > | vity, vendor support, break-glass use, commissioning, and do | ||
| > | mand line to detect anomalous processes execution and comman | > | cumented remote-access windows. | ||
| > | d line arguments associated to traffic patterns (e.g., monit | ||||
| > | or anomalies in use of files that do not normally initiate c | ||||
| > | onnections for respective protocol(s)). Use web proxies to r | ||||
| > | eview content of emails including sender information, header | ||||
| > | s, and attachments for potentially malicious content. Monito | ||||
| > | r mail server and proxy logs for evidence of messages origin | ||||
| > | ating from spoofed addresses, including records indicating f | ||||
| > | ailed DKIM+SPF validation or mismatched message headers.(Cit | ||||
| > | ation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofin | ||||
| > | g) Anti-virus can potentially detect malicious documents and | ||||
| > | attachments as they're scanned to be stored on the email se | ||||
| > | rver or on the user's computer. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for unusual network traffic that may indicate additi | t | 1 | Real-time monitoring identifies a browser process on an Indu |
| > | onal tools transferred to the system. Use network intrusion | > | strial Control System (ICS) workstation spawning an unexpect | ||
| > | detection systems, sometimes with SSL/TLS inspection, to loo | > | ed child process immediately following navigation to an exte | ||
| > | k for known malicious scripts (recon, heap spray, and browse | > | rnal website, particularly a vendor support or software-down | ||
| > | r identification scripts have been frequently reused), commo | > | load site. Documented Havex precedent: adversaries compromis | ||
| > | n script obfuscation, and exploit code. Firewalls and proxie | > | ed legitimate ICS vendor websites to serve trojanized softwa | ||
| > | s can inspect URLs for potentially known-bad domains or para | > | re downloads. OT operational-fidelity gate: Alert only when | ||
| > | meters. They can also do reputation-based analytics on websi | > | the account/device/session violates the approved identity + | ||
| > | tes and their requested resources such as how old a domain i | > | source host/jump path/zone policy and is corroborated by acc | ||
| > | s, who it's registered to, if it's on a known bad list, or h | > | ess to a protected OT asset, execution, configuration change | ||
| > | ow many other users have connected to it before. Monitor for | > | , or another security-relevant follow-on event. Suppress app | ||
| > | behaviors on the endpoint system that might indicate succes | > | roved shift activity, vendor support, break-glass use, commi | ||
| > | sful compromise, such as abnormal behaviors of browser proce | > | ssioning, and documented remote-access windows. | ||
| > | sses. This could include suspicious files written to disk. M | ||||
| > | onitor for newly constructed files written to disk through a | ||||
| > | user visiting a website over the normal course of browsing. | ||||
| > | Monitor for newly constructed network connections to untrus | ||||
| > | ted hosts that are used to send or receive data. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor device management protocols for functions that modif | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | y programs such as online edit and program append events. Mo | > | (ICS) protocol write to an existing program block from a so | ||
| > | nitor device alarms that indicate the program has changed, a | > | urce not in the approved engineering workstation list, outsi | ||
| > | lthough not all devices produce such alarms. Engineering and | > | de a scheduled change-control window, correlated against pos | ||
| > | asset management software will often maintain a copy of the | > | t-modification program hash comparison and measurable change | ||
| > | expected program loaded on a controller and may also record | > | in controller Input/Output (I/O) behavior. OT operational-f | ||
| > | any changes made to controller programs. Data from these pl | > | idelity gate: Alert only when the action is not attributable | ||
| > | atforms can be used to identify modified controller programs | > | to an authorized operator/engineering source for the specif | ||
| > | . Monitor device application logs that indicate the program | > | ic target and function, and it is either outside an approved | ||
| > | has changed, although not all devices produce such logs. | > | change/maintenance window or lacks matching change-control | ||
| > | context; where telemetry permits, require corroborating devi | ||||
| > | ce, configuration, or process-state effect. Suppress activit | ||||
| > | y that fully matches approved maintenance, commissioning, fa | ||||
| > | ilover, recovery, or tested control procedures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for the termination of processes or services associa | t | 1 | Real-time monitoring identifies the absence of expected comm |
| > | ted with ICS automation protocols and application software w | > | and-message delivery confirmation -- a Supervisory Control a | ||
| > | hich could help detect blocked communications. Monitor for l | > | nd Data Acquisition (SCADA)-issued command that does not pro | ||
| > | ack of operational process data which may help identify a lo | > | duce the expected corresponding state-change response within | ||
| > | ss of communications. This will not directly detect the tech | > | the normal response latency window, while the device remain | ||
| > | nique\u2019s execution, but instead may provide additional eviden | > | s reachable for other traffic. Documented in the 2015 Ukrain | ||
| > | ce that the technique has been used and may complement other | > | e attack, where Sandworm used malicious firmware to render s | ||
| > | detections. Monitor application logs for changes to setting | > | erial-to-Ethernet converters inoperable. OT operational-fide | ||
| > | s and other events associated with network protocols that ma | > | lity gate: Alert only when the action is not attributable to | ||
| > | y be used to block communications. Monitor for a loss of net | > | an authorized operator/engineering source for the specific | ||
| > | work communications, which may indicate this technique is be | > | target and function, and it is either outside an approved ch | ||
| > | ing used. Monitor asset alarms which may help identify a los | > | ange/maintenance window or lacks matching change-control con | ||
| > | s of communications. Consider correlating alarms with other | > | text; where telemetry permits, require corroborating device, | ||
| > | data sources that indicate traffic has been blocked, such as | > | configuration, or process-state effect. Suppress activity t | ||
| > | network traffic. In cases where alternative methods of comm | > | hat fully matches approved maintenance, commissioning, failo | ||
| > | unicating with outstations exist alarms may still be visible | > | ver, recovery, or tested control procedures. | ||
| > | even if command messages are blocked. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for new ICS protocol connections to existing assets | t | 1 | Real-time monitoring identifies remote Windows system-inform |
| > | or for device scanning (i.e., a host connecting to many devi | > | ation queries using WMI/CIM, WinRM, PowerShell remoting, or | ||
| > | ces) over ICS and enterprise protocols (e.g., ICMP, DCOM, Wi | > | equivalent management tooling where the command names a non- | ||
| > | nRM). Monitor for anomalies related to discovery related ICS | > | local target and the account/source is outside the approved | ||
| > | functions, including devices that have not previously used | > | management baseline. OT operational-fidelity gate: Do not al | ||
| > | these functions or for functions being sent to many outstati | > | ert on novelty, scan/read volume, or enumeration alone. Aler | ||
| > | ons. Note that some ICS protocols use broadcast or multicast | > | t when the source role is not authorized for discovery/polli | ||
| > | functionality, which may produce false positives. Also moni | > | ng and the target scope, address/tag range, protocol, or rat | ||
| > | tor for hosts enumerating network connected resources using | > | e deviates from the established operational baseline. Suppre | ||
| > | non-ICS enterprise protocols. Monitor for files (such as /et | > | ss normal SCADA/HMI/historian polling, commissioning, asset | ||
| > | c/hosts) being accessed that may attempt to get a listing of | > | inventory, backup, diagnostics, and approved engineering act | ||
| > | other systems by IP address, hostname, or other logical ide | > | ivity. | ||
| > | ntifier on a network that may be used for Lateral Movement f | ||||
| > | rom the current system. Monitor for newly executed processes | ||||
| > | that can be used to discover remote systems, such as ping.e | ||||
| > | xe and tracert.exe, especially when executed in quick succes | ||||
| > | sion.(Citation: Elastic - Koadiac Detection with EQL) Consid | ||||
| > | er monitoring for new processes engaging in scanning activit | ||||
| > | y or connecting to multiple systems by correlating process c | ||||
| > | reation network data. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor ICS automation protocols for anomalies related to re | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | ading point or tag data, such as new assets using these func | > | (ICS) protocol session that systematically enumerates a dev | ||
| > | tions, changes in volume or timing, or unusual information b | > | ice's full tag/object namespace from a source not in the app | ||
| > | eing queried. Many protocols provide multiple ways to achiev | > | roved control server list, where the enumeration pattern cov | ||
| > | e the same result (e.g., functions with/without an acknowled | > | ers the complete address/object space rather than the sparse | ||
| > | gment or functions that operate on a single point vs. multip | > | , fixed tag set legitimate Supervisory Control and Data Acqu | ||
| > | le points). Monitor for changes in the functions used. Monit | > | isition (SCADA) polling queries. OT operational-fidelity gat | ||
| > | or asset application logs which may provide information abou | > | e: Do not alert on novelty, scan/read volume, or enumeration | ||
| > | t requests for points or tags. Look for anomalies related to | > | alone. Alert when the source role is not authorized for dis | ||
| > | reading point or tag data, such as new assets using these f | > | covery/polling and the target scope, address/tag range, prot | ||
| > | unctions, changes in volume or timing, or unusual informatio | > | ocol, or rate deviates from the established operational base | ||
| > | n being queried. Many devices provide multiple ways to achie | > | line. Suppress normal SCADA/HMI/historian polling, commissio | ||
| > | ve the same result (e.g., functions with/without an acknowle | > | ning, asset inventory, backup, diagnostics, and approved eng | ||
| > | dgment or functions that operate on a single point vs. multi | > | ineering activity. | ||
| > | ple points). Monitor for changes in the functions used. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor asset alarms which may help identify a loss of commu | t | 1 | Real-time monitoring identifies iptables/nftables rules on I |
| > | nications. Consider correlating alarms with other data sourc | > | ndustrial Control System (ICS) Linux gateways that selective | ||
| > | es that indicate traffic has been blocked, such as network t | > | ly drop ICS reporting message traffic based on content while | ||
| > | raffic. In cases where alternative methods of communicating | > | allowing command traffic to pass. OT operational-fidelity g | ||
| > | with outstations exist alarms may still be visible even if r | > | ate: Alert only when the action is not attributable to an au | ||
| > | eporting messages are blocked. Monitor for the termination | > | thorized operator/engineering source for the specific target | ||
| > | of processes or services associated with ICS automation pro | > | and function, and it is either outside an approved change/m | ||
| > | tocols and application software which could help detect bloc | > | aintenance window or lacks matching change-control context; | ||
| > | ked communications. Monitor application logs for changes to | > | where telemetry permits, require corroborating device, confi | ||
| > | settings and other events associated with network protocols | > | guration, or process-state effect. Suppress activity that fu | ||
| > | that may be used to block communications. Monitor for a loss | > | lly matches approved maintenance, commissioning, failover, r | ||
| > | of network communications, which may indicate this techniqu | > | ecovery, or tested control procedures. | ||
| > | e is being used. Monitor for lack of operational process dat | ||||
| > | a which may help identify a loss of communications. This wil | ||||
| > | l not directly detect the technique\u2019s execution, but instead | ||||
| > | may provide additional evidence that the technique has been | ||||
| > | used and may complement other detections. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for firmware changes which may be observable via ope | t | 1 | Real-time monitoring identifies a firmware write command tar |
| > | rational alarms from devices. Monitor device application log | > | geting a specific Input/Output (I/O) module slot address wit | ||
| > | s for firmware changes, although not all devices will produc | > | hin a controller chassis from a source not in the approved e | ||
| > | e such logs. Monitor ICS management protocols / file transfe | > | ngineering workstation list, distinguishing module-level fir | ||
| > | r protocols for protocol functions related to firmware chang | > | mware modification from main-processor firmware updates by i | ||
| > | es. Monitor firmware for unexpected changes. Asset managemen | > | ts slot-addressed targeting. OT operational-fidelity gate: A | ||
| > | t systems should be consulted to understand known-good firmw | > | lert only when the action is not attributable to an authoriz | ||
| > | are versions. Dump and inspect BIOS images on vulnerable sys | > | ed operator/engineering source for the specific target and f | ||
| > | tems and compare against known good images.(Citation: MITRE | > | unction, and it is either outside an approved change/mainten | ||
| > | Copernicus) Analyze differences to determine if malicious ch | > | ance window or lacks matching change-control context; where | ||
| > | anges have occurred. Log attempts to read/write to BIOS and | > | telemetry permits, require corroborating device, configurati | ||
| > | compare against known patching behavior. Likewise, EFI modul | > | on, or process-state effect. Suppress activity that fully ma | ||
| > | es can be collected and compared against a known-clean list | > | tches approved maintenance, commissioning, failover, recover | ||
| > | of EFI executable binaries to detect potentially malicious m | > | y, or tested control procedures. | ||
| > | odules. The CHIPSEC framework can be used for analysis to de | ||||
| > | termine if firmware modifications have been performed.(Citat | ||||
| > | ion: McAfee CHIPSEC Blog)(Citation: Github CHIPSEC)(Citation | ||||
| > | : Intel HackingTeam UEFI Rootkit) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for newly executed processes that depend on user int | t | 1 | Real-time monitoring identifies a user-invoked action on an |
| > | eraction, especially for applications that can embed program | > | Industrial Control System (ICS) workstation immediately foll | ||
| > | matic capabilities (e.g., Microsoft Office products with scr | > | owed by a process execution chain inconsistent with normal I | ||
| > | ipts, installers, zip files). This includes compression appl | > | CS operations -- the user-driven trigger plus the resulting | ||
| > | ications, such as those for zip files, that can be used to [ | > | anomalous execution chain together distinguish this from gen | ||
| > | Deobfuscate/Decode Files or Information](https://attack.mitr | > | eric malware execution. OT operational-fidelity gate: Alert | ||
| > | e.org/techniques/T1140) in payloads. For added context on ad | > | only when the account/device/session violates the approved i | ||
| > | versary procedures and background see [User Execution](https | > | dentity + source host/jump path/zone policy and is corrobora | ||
| > | ://attack.mitre.org/techniques/T1204) and applicable sub-tec | > | ted by access to a protected OT asset, execution, configurat | ||
| > | hniques. Monitor for application logging, messaging, and/or | > | ion change, or another security-relevant follow-on event. Su | ||
| > | other artifacts that may rely upon specific actions by a use | > | ppress approved shift activity, vendor support, break-glass | ||
| > | r in order to gain execution. Monitor for newly constructed | > | use, commissioning, and documented remote-access windows. | ||
| > | web-based network connections that are sent to malicious or | ||||
| > | suspicious destinations (e.g., destinations attributed to ph | ||||
| > | ishing campaigns). Consider correlation with process monitor | ||||
| > | ing and command line to detect anomalous processes execution | ||||
| > | and command line arguments (e.g., monitor anomalies in use | ||||
| > | of files that do not normally initiate network connections o | ||||
| > | r unusual connections initiated by regsvr32.exe, rundll.exe, | ||||
| > | SCF, HTA, MSI, DLLs, or msiexec.exe). Anti-virus can poten | ||||
| > | tially detect malicious documents and files that are downloa | ||||
| > | ded and executed on the user's computer. Endpoint sensing or | ||||
| > | network sensing can potentially detect malicious events onc | ||||
| > | e the file is opened (such as a Microsoft Word document or P | ||||
| > | DF reaching out to the internet or spawning PowerShell). Mon | ||||
| > | itor for newly executed processes that depend on user intera | ||||
| > | ction, especially for applications that can embed programmat | ||||
| > | ic capabilities (e.g., Microsoft Office products with script | ||||
| > | s, installers, zip files). This includes compression applica | ||||
| > | tions, such as those for zip files, that can be used to [Deo | ||||
| > | bfuscate/Decode Files or Information](https://attack.mitre.o | ||||
| > | rg/techniques/T1140) in payloads. Monitor and analyze traffi | ||||
| > | c patterns and packet inspection associated with web-based n | ||||
| > | etwork connections that are sent to malicious or suspicious | ||||
| > | destinations (e.g., destinations attributed to phishing camp | ||||
| > | aigns). Consider correlation with process monitoring and com | ||||
| > | mand line to detect anomalous processes execution and comman | ||||
| > | d line arguments (e.g., monitor anomalies in use of files th | ||||
| > | at do not normally initiate network connections or unusual c | ||||
| > | onnections initiated by regsvr32.exe, rundll.exe, SCF, HTA, | ||||
| > | MSI, DLLs, or msiexec.exe). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Consult asset management systems which may help with the det | t | 1 | Real-time monitoring identifies Industrial Control System (I |
| > | ection of computer systems or network devices that should no | > | CS) master-role command traffic originating from a source no | ||
| > | t exist on a network. Monitor for network traffic originatin | > | t in the approved control server inventory, directed at mult | ||
| > | g from unknown/unexpected devices or addresses. Local netwo | > | iple field devices in a pattern consistent with control-serv | ||
| > | rk traffic metadata could be used to identify unexpected con | > | er behavior. Documented in Maroochy Water Services (falsifie | ||
| > | nections, including unknown/unexpected source MAC addresses | > | d PDS/station addresses to impersonate the master) and the 2 | ||
| > | connecting to ports associated with operational protocols. A | > | 017 Dallas Siren incident (rogue radio transmitter to 156 si | ||
| > | lso, network management protocols such as DHCP and ARP may b | > | rens). OT operational-fidelity gate: Alert only when the mas | ||
| > | e helpful in identifying unexpected devices. Monitor for ne | > | ter/station identity or source is not authorized for the tar | ||
| > | w master devices communicating with outstations, which may b | > | get device and command function, or when a normally authoriz | ||
| > | e visible in alarms within the ICS environment. Monitor for | > | ed master violates its configured role/sequence and produces | ||
| > | unexpected ICS protocol functions from new and existing devi | > | a corroborating device/process-state change. Suppress legit | ||
| > | ces. Monitoring known devices requires ICS function level in | > | imate redundancy/failover, hot-standby promotion, commission | ||
| > | sight to determine if an unauthorized device is issuing comm | > | ing, and approved engineering master activity. | ||
| > | ands (e.g., a historian). Monitor for new master devices com | ||||
| > | municating with outstation assets, which may be visible in a | ||||
| > | sset application logs. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for any suspicious attempts to enable script executi | t | 1 | Real-time monitoring identifies a trusted, signed Windows sy |
| > | on on a system. If scripts are not commonly used on a system | > | stem binary executing with command-line arguments inconsiste | ||
| > | , but enabled, scripts running out of cycle from patching or | > | nt with its documented administrative purpose -- specificall | ||
| > | other administrator functions are suspicious. Scripts shoul | > | y arguments indicating payload decoding, remote content exec | ||
| > | d be captured from the file system when possible to determin | > | ution, or script invocation -- on an Industrial Control Syst | ||
| > | e their actions and intent. Monitor executed commands and as | > | em (ICS) host. OT operational-fidelity gate: Alert only when | ||
| > | sociated arguments for application programs which support ex | > | execution violates an approved signer/hash/path/parent/proc | ||
| > | ecuting custom code, scripts, commands, or executables. Mon | > | ess or tool allowlist, or originates from an unauthorized us | ||
| > | itor for unusual processes execution, especially for process | > | er/tool, and is tied to an OT asset or follow-on OT-relevant | ||
| > | es that allow the proxy execution of malicious files. | > | action. Suppress vendor-signed software, approved engineeri | ||
| > | ng utilities, diagnostics, patching, backup, and documented | ||||
| > | maintenance. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor industrial process history data for events that corr | t | 1 | Real-time monitoring identifies a Windows process generating |
| > | espond with command message functions, such as setpoint modi | > | Industrial Control System (ICS) command messages to field d | ||
| > | fication or changes to system status for key devices. This w | > | evice tags representing physical outputs, from a process tha | ||
| > | ill not directly detect the technique\u2019s execution, but inste | > | t is not the recognized Supervisory Control and Data Acquisi | ||
| > | ad may provide additional evidence that the technique has be | > | tion (SCADA) or Distributed Control System (DCS) control app | ||
| > | en used and may complement other detections. Monitor for ano | > | lication, targeting safety-critical output tags. OT operatio | ||
| > | malous or unexpected commands that may result in changes to | > | nal-fidelity gate: Alert only when the action is not attribu | ||
| > | the process operation (e.g., discrete write, logic and devic | > | table to an authorized operator/engineering source for the s | ||
| > | e configuration, mode changes) observable via asset applicat | > | pecific target and function, and it is either outside an app | ||
| > | ion logs. Monitor for new or unexpected connections to contr | > | roved change/maintenance window or lacks matching change-con | ||
| > | ollers, which could indicate an Unauthorized Command Message | > | trol context; where telemetry permits, require corroborating | ||
| > | being sent via [Rogue Master](https://attack.mitre.org/tech | > | device, configuration, or process-state effect. Suppress ac | ||
| > | niques/T0848). Monitor for anomalous or unexpected commands | > | tivity that fully matches approved maintenance, commissionin | ||
| > | that may result in changes to the process operation (e.g., d | > | g, failover, recovery, or tested control procedures. | ||
| > | iscrete write, logic and device configuration, mode changes) | ||||
| > | observable via asset application logs. Monitor for unexpect | ||||
| > | ed ICS protocol command functions to controllers from existi | ||||
| > | ng master devices (including from new processes) or from new | ||||
| > | devices. The latter is like detection for [Rogue Master](ht | ||||
| > | tps://attack.mitre.org/techniques/T0848) but requires ICS fu | ||||
| > | nction level insight to determine if an unauthorized device | ||||
| > | is issuing commands (e.g., a historian). Monitoring for une | ||||
| > | xpected or problematic values below the function level will | ||||
| > | provide better insights into potentially malicious activity | ||||
| > | but at the cost of additional false positives depending on t | ||||
| > | he underlying operational process. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Detecting software exploitation may be difficult depending o | t | 1 | Real-time monitoring identifies malformed or out-of-spec ICS |
| > | n the tools available. Software exploits may not always succ | > | protocol exchanges targeting an embedded device from a sour | ||
| > | eed or may cause the exploited process to become unstable or | > | ce outside the approved communication baseline. OT operation | ||
| > | crash. | > | al-fidelity gate: Alert only when execution violates an appr | ||
| > | oved signer/hash/path/parent/process or tool allowlist, or o | ||||
| > | riginates from an unauthorized user/tool, and is tied to an | ||||
| > | OT asset or follow-on OT-relevant action. Suppress vendor-si | ||||
| > | gned software, approved engineering utilities, diagnostics, | ||||
| > | patching, backup, and documented maintenance. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor logon activity for unexpected or unusual access to d | t | 1 | Real-time monitoring identifies inbound connections to Indus |
| > | evices from the Internet. Monitor for unexpected protocols t | > | trial Control System (ICS) Windows application servers from | ||
| > | o/from the Internet. While network traffic content and logon | > | internet-routed Internet Protocol (IP) addresses. OT operati | ||
| > | session metadata may directly identify a login event, new I | > | onal-fidelity gate: Alert only when the asset's documented r | ||
| > | nternet-based network flows may also be a reliable indicator | > | ole does not permit the connection and the destination/proxy | ||
| > | of this technique. Monitor for unusual logins to Internet c | > | /service is outside the approved communications profile, wit | ||
| > | onnected devices or unexpected protocols to/from the Interne | > | h process/service identity used as corroboration where avail | ||
| > | t. Network traffic content will provide valuable context and | > | able. Suppress approved vendor support, update repositories, | ||
| > | details about the content of network flows. | > | remote operations, failover paths, and documented temporary | ||
| > | connectivity. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor asset alarms which may help identify a loss of commu | t | 1 | Real-time monitoring identifies a loss of communication with |
| > | nications. Consider correlating alarms with other data sourc | > | serially-connected field devices correlated with a configur | ||
| > | es that indicate traffic has been blocked, such as network t | > | ation change event on the serial-to-Ethernet gateway. Docume | ||
| > | raffic. In cases where alternative methods of communicating | > | nted in the 2015 Ukraine attack, where Sandworm used malicio | ||
| > | with outstations exist alarms may still be visible even if m | > | us firmware to render serial-to-Ethernet converters inoperab | ||
| > | essages over serial COM ports are blocked. Monitor for a los | > | le. OT operational-fidelity gate: Alert only when the action | ||
| > | s of network communications, which may indicate this techniq | > | is not attributable to an authorized operator/engineering s | ||
| > | ue is being used. Monitor for lack of operational process da | > | ource for the specific target and function, and it is either | ||
| > | ta which may help identify a loss of communications. This wi | > | outside an approved change/maintenance window or lacks matc | ||
| > | ll not directly detect the technique\u2019s execution, but instea | > | hing change-control context; where telemetry permits, requir | ||
| > | d may provide additional evidence that the technique has bee | > | e corroborating device, configuration, or process-state effe | ||
| > | n used and may complement other detections. Monitor applicat | > | ct. Suppress activity that fully matches approved maintenanc | ||
| > | ion logs for changes to settings and other events associated | > | e, commissioning, failover, recovery, or tested control proc | ||
| > | with network protocols that may be used to block communicat | > | edures. | ||
| > | ions. Monitor for the termination of processes or services a | ||||
| > | ssociated with ICS automation protocols and application soft | ||||
| > | ware which could help detect blocked communications. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor network traffic for hardcoded credential use in prot | t | 1 | Real-time monitoring identifies field device access using cr |
| > | ocols that allow unencrypted authentication. Monitor logon s | > | edentials matching hardcoded values extracted from Industria | ||
| > | essions for hardcoded credential use, when feasible. | > | l Control System (ICS) vendor firmware or configuration file | ||
| > | s, from a source with no legitimate operational role. Docume | ||||
| > | nted in TriStation 1131 v4.9.0 and earlier, which contained | ||||
| > | undocumented power-user accounts with hardcoded credentials. | ||||
| > | OT operational-fidelity gate: Alert only when the account/d | ||||
| > | evice/session violates the approved identity + source host/j | ||||
| > | ump path/zone policy and is corroborated by access to a prot | ||||
| > | ected OT asset, execution, configuration change, or another | ||||
| > | security-relevant follow-on event. Suppress approved shift a | ||||
| > | ctivity, vendor support, break-glass use, commissioning, and | ||||
| > | documented remote-access windows. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor and analyze traffic flows that do not follow the exp | t | 1 | Real-time monitoring identifies Domain Name System (DNS) que |
| > | ected protocol standards and traffic flows (e.g., extraneous | > | ries from Industrial Control System (ICS) host Internet Prot | ||
| > | packets that do not belong to established flows , or gra | > | ocol (IP) addresses to external resolvers for domains not as | ||
| > | tuitous or anomalous traffic patterns). Consider correlation | > | sociated with any approved ICS vendor, particularly domains | ||
| > | with process monitoring and command line to detect anomalou | > | exhibiting Domain Generation Algorithm (DGA)-like patterns. | ||
| > | s processes execution and command line arguments associated | > | OT operational-fidelity gate: Alert only when the asset's do | ||
| > | to traffic patterns (e.g., monitor anomalies in use of files | > | cumented role does not permit the connection and the destina | ||
| > | that do not normally initiate connections for respective pr | > | tion/proxy/service is outside the approved communications pr | ||
| > | otocol(s)). Monitor and analyze traffic patterns and packet | > | ofile, with process/service identity used as corroboration w | ||
| > | inspection associated to protocol(s), leveraging SSL/TLS ins | > | here available. Suppress approved vendor support, update rep | ||
| > | pection for encrypted traffic, that do not follow the expect | > | ositories, remote operations, failover paths, and documented | ||
| > | ed protocol standards and traffic flows (e.g., extraneous pa | > | temporary connectivity. | ||
| > | ckets that do not belong to established flows, gratuitous or | ||||
| > | anomalous traffic patterns, anomalous syntax, or structure) | ||||
| > | . Consider correlation with process monitoring and command l | ||||
| > | ine to detect anomalous processes execution and command line | ||||
| > | arguments associated to traffic patterns (e.g., monitor an | ||||
| > | omalies in use of files that do not normally initiate connec | ||||
| > | tions for respective protocol(s)). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for newly executed processes that can aid in sniffin | t | 1 | Real-time monitoring identifies a process loading a packet c |
| > | g network traffic to capture information about an environmen | > | apture driver or executing a known capture utility on an Ind | ||
| > | t. Monitor executed commands and arguments for actions that | > | ustrial Control System (ICS) host's network interface, from | ||
| > | aid in sniffing network traffic to capture information about | > | a process or account not associated with documented network | ||
| > | an environment. | > | analysis responsibilities. OT operational-fidelity gate: Do | ||
| > | not alert on novelty, scan/read volume, or enumeration alone | ||||
| > | . Alert when the source role is not authorized for discovery | ||||
| > | /polling and the target scope, address/tag range, protocol, | ||||
| > | or rate deviates from the established operational baseline. | ||||
| > | Suppress normal SCADA/HMI/historian polling, commissioning, | ||||
| > | asset inventory, backup, diagnostics, and approved engineeri | ||||
| > | ng activity. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for a loss of network communications, which may indi | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | cate a device has been shutdown or restarted. This will not | > | (ICS) protocol restart/reset command directed at a field de | ||
| > | directly detect the technique\u2019s execution, but instead may p | > | vice from a source not in the approved engineering workstati | ||
| > | rovide additional evidence that the technique has been used | > | on list, particularly where multiple devices receive restart | ||
| > | and may complement other detections. Device restarts and shu | > | commands within a short window. Documented precedent: Indus | ||
| > | tdowns may be observable in device application logs. Monitor | > | troyer exploited CVE-2015-5374 via a crafted 18-byte User Da | ||
| > | for unexpected device restarts or shutdowns. Devices may pr | > | tagram Protocol (UDP) packet to port 50000 on Siemens SIPROT | ||
| > | oduce alarms about restarts or shutdowns. Monitor for unexpe | > | EC relays. OT operational-fidelity gate: Alert only when the | ||
| > | cted device restarts or shutdowns. Monitor ICS automation pr | > | action is not attributable to an authorized operator/engine | ||
| > | otocols for functions that restart or shutdown a device. Com | > | ering source for the specific target and function, and it is | ||
| > | mands to restart or shutdown devices may also be observable | > | either outside an approved change/maintenance window or lac | ||
| > | in traditional IT management protocols. | > | ks matching change-control context; where telemetry permits, | ||
| > | require corroborating device, configuration, or process-sta | ||||
| > | te effect. Suppress activity that fully matches approved mai | ||||
| > | ntenance, commissioning, failover, recovery, or tested contr | ||||
| > | ol procedures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor ICS automation network protocols for information tha | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | t an asset has been placed into Firmware Update Mode. Monito | > | (ICS) protocol message sequence placing a field device into | ||
| > | r device alarms that indicate the devices has been placed in | > | firmware-update mode from a source not in the approved engi | ||
| > | to Firmware Update Mode, although not all devices produce su | > | neering workstation list, correlated with the device's alarm | ||
| > | ch alarms. Monitor asset log which may provide information t | > | telemetry going silent within a short grace period without | ||
| > | hat an asset has been placed into Firmware Update Mode. Some | > | acknowledgment. Documented precedent: Industroyer exploited | ||
| > | assets may log firmware updates themselves without logging | > | CVE-2015-5374 by sending a crafted packet that initiated an | ||
| > | that the device has been placed into update mode. | > | incomplete firmware update sequence on Siemens Protection Te | ||
| > | chnology (SIPROTEC) relays. OT operational-fidelity gate: Al | ||||
| > | ert only when the action is not attributable to an authorize | ||||
| > | d operator/engineering source for the specific target and fu | ||||
| > | nction, and it is either outside an approved change/maintena | ||||
| > | nce window or lacks matching change-control context; where t | ||||
| > | elemetry permits, require corroborating device, configuratio | ||||
| > | n, or process-state effect. Suppress activity that fully mat | ||||
| > | ches approved maintenance, commissioning, failover, recovery | ||||
| > | , or tested control procedures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for network traffic originating from unknown/unexpec | t | 1 | Real-time monitoring identifies authentication to an externa |
| > | ted systems. Monitor authentication logs and analyze for unu | > | l remote access gateway using credentials associated with In | ||
| > | sual access patterns, windows of activity, and access outsid | > | dustrial Control System (ICS)-role accounts, from a source g | ||
| > | e of normal business hours, including use of [Valid Accounts | > | eolocation or Autonomous System Number (ASN) inconsistent wi | ||
| > | ](https://attack.mitre.org/techniques/T0859). When authentic | > | th the account's established usage pattern, immediately foll | ||
| > | ation is not required to access an exposed remote service, m | > | owed by that session establishing connectivity into the ICS | ||
| > | onitor for follow-on activities such as anomalous external u | > | network zone. Documented in VPNFilter, which specifically ta | ||
| > | se of the exposed API or application. | > | rgeted routers and network edge devices. OT operational-fide | ||
| > | lity gate: Alert only when the account/device/session violat | ||||
| > | es the approved identity + source host/jump path/zone policy | ||||
| > | and is corroborated by access to a protected OT asset, exec | ||||
| > | ution, configuration change, or another security-relevant fo | ||||
| > | llow-on event. Suppress approved shift activity, vendor supp | ||||
| > | ort, break-glass use, commissioning, and documented remote-a | ||||
| > | ccess windows. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor network data for uncommon data flows (e.g., time of | t | 1 | Real-time monitoring identifies a remote service connection |
| > | day, unusual source/destination address) that may be relate | > | between two Industrial Control System (ICS) network hosts th | ||
| > | d to abuse of [Valid Accounts](https://attack.mitre.org/tech | > | at does not match the documented, approved communication mat | ||
| > | niques/T0859) to log into a service specifically designed to | > | rix, where the destination host subsequently exhibits proces | ||
| > | accept remote connections, such as RDP, Telnet, SSH, and VN | > | s execution or file access inconsistent with normal automate | ||
| > | C. Monitor DLL file events, specifically creation of these f | > | d/scheduled inter-host communication. OT operational-fidelit | ||
| > | iles as well as the loading of DLLs into processes specifica | > | y gate: Alert only when the account/device/session violates | ||
| > | lly designed to accept remote connections, such as RDP, Teln | > | the approved identity + source host/jump path/zone policy an | ||
| > | et, SSH, and VNC. Monitor for user accounts logged into syst | > | d is corroborated by access to a protected OT asset, executi | ||
| > | ems they would not normally access or abnormal access patter | > | on, configuration change, or another security-relevant follo | ||
| > | ns, such as multiple systems over a relatively short period | > | w-on event. Suppress approved shift activity, vendor support | ||
| > | of time. Correlate use of login activity related to remote s | > | , break-glass use, commissioning, and documented remote-acce | ||
| > | ervices with unusual behavior or other malicious or suspicio | > | ss windows. | ||
| > | us activity. Adversaries will likely need to learn about an | ||||
| > | environment and the relationships between systems through Di | ||||
| > | scovery techniques prior to attempting Lateral Movement. For | ||||
| > | added context on adversary procedures and background see [R | ||||
| > | emote Services](https://attack.mitre.org/techniques/T1021) a | ||||
| > | nd applicable sub-techniques. Monitor for newly executed pro | ||||
| > | cesses related to services specifically designed to accept r | ||||
| > | emote connections, such as RDP, Telnet, SSH, and VNC. The ad | ||||
| > | versary may use [Valid Accounts](https://attack.mitre.org/te | ||||
| > | chniques/T0859) to login and may perform follow-on actions t | ||||
| > | hat spawn additional processes as the user. Monitor executed | ||||
| > | commands and arguments to services specifically designed to | ||||
| > | accept remote connections, such as RDP, Telnet, SSH, and VN | ||||
| > | C. The adversary may then perform these actions using [Valid | ||||
| > | Accounts](https://attack.mitre.org/techniques/T0859). Monit | ||||
| > | or for newly constructed network connections into a service | ||||
| > | specifically designed to accept remote connections, such as | ||||
| > | RDP, Telnet, SSH, and VNC. Monitor network connections invol | ||||
| > | ving common remote management protocols, such as ports tcp:3 | ||||
| > | 283 and tcp:5900, as well as ports tcp:3389 and tcp:22 for r | ||||
| > | emote logins. The adversary may use [Valid Accounts](https:/ | ||||
| > | /attack.mitre.org/techniques/T0859) to enable remote logins. | ||||
| > | Monitor interactions with network shares, such as reads or | ||||
| > | file transfers, using remote services such as Server Message | ||||
| > | Block (SMB). For added context on adversary procedures and | ||||
| > | background see [Remote Services](https://attack.mitre.org/te | ||||
| > | chniques/T1021) and applicable sub-techniques. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Unauthorized messages may be detected by reviewing the conte | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | nt of automation protocols, either through detecting based o | > | (ICS) protocol message arriving at a device from a source w | ||
| > | n expected values or comparing to other out of band process | > | hose identity is not in the approved communication baseline | ||
| > | data sources. Unauthorized messages may not precisely match | > | for that destination, where the message is structurally vali | ||
| > | legitimate messages which may lead to malformed traffic, alt | > | d but originates outside the documented set of legitimate co | ||
| > | hough traffic may be malformed for benign reasons. Monitor m | > | mmunicators. This technique-level analytic synthesizes Comma | ||
| > | essages for changes in how they are constructed. Monitor fo | > | nd Message (T1692.001) and Reporting Message (T1692.002). OT | ||
| > | r anomalous or unexpected messages that may result in change | > | operational-fidelity gate: Alert only when the action is no | ||
| > | s to the process operation observable via asset application | > | t attributable to an authorized operator/engineering source | ||
| > | logs (e.g., discrete write, logic and device configuration, | > | for the specific target and function, and it is either outsi | ||
| > | mode changes, safety triggers). Consider monitoring for [Ro | > | de an approved change/maintenance window or lacks matching c | ||
| > | gue Master](https://attack.mitre.org/techniques/T0848) and [ | > | hange-control context; where telemetry permits, require corr | ||
| > | Adversary-in-the-Middle](https://attack.mitre.org/techniques | > | oborating device, configuration, or process-state effect. Su | ||
| > | /T0830) activity which may precede this technique. | > | ppress activity that fully matches approved maintenance, com | ||
| > | missioning, failover, recovery, or tested control procedures | ||||
| > | . |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for the termination of processes or services associa | t | 1 | Real-time monitoring identifies iptables/nftables rule chang |
| > | ted with ICS automation protocols and application software w | > | es on Industrial Control System (ICS) Linux gateways that se | ||
| > | hich could help detect blocked communications. Monitor for | > | lectively block one ICS communication traffic type. OT opera | ||
| > | lack of operational process data which may help identify a l | > | tional-fidelity gate: Alert only when the action is not attr | ||
| > | oss of communications. This will not directly detect the tec | > | ibutable to an authorized operator/engineering source for th | ||
| > | hnique\u2019s execution, but instead may provide additional evide | > | e specific target and function, and it is either outside an | ||
| > | nce that the technique has been used and may complement othe | > | approved change/maintenance window or lacks matching change- | ||
| > | r detections. Monitor application logs for changes to setti | > | control context; where telemetry permits, require corroborat | ||
| > | ngs and other events associated with network protocols that | > | ing device, configuration, or process-state effect. Suppress | ||
| > | may be used to block communications. Monitor for a loss of | > | activity that fully matches approved maintenance, commissio | ||
| > | network communications, which may indicate this technique is | > | ning, failover, recovery, or tested control procedures. | ||
| > | being used. Monitor asset alarms which may help identify a | ||||
| > | loss of communications. Consider correlating alarms with ot | ||||
| > | her data sources that indicate traffic has been blocked, suc | ||||
| > | h as network traffic. In cases where alternative methods of | ||||
| > | communicating with outstations exist alarms may still be vis | ||||
| > | ible even if messages are blocked. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for firmware changes which may be observable via ope | t | 1 | Real-time monitoring identifies the full firmware modificati |
| > | rational alarms from devices. Monitor device application lo | > | on chain: a device entering firmware-update mode, receiving | ||
| > | gs for firmware changes, although not all devices will produ | > | a large data transfer on a firmware-capable protocol port fr | ||
| > | ce such logs. Monitor ICS management protocols / file trans | > | om a source not in the approved engineering workstation list | ||
| > | fer protocols for protocol functions related to firmware cha | > | , rebooting, and reporting a post-reboot firmware hash that | ||
| > | nges. Monitor firmware for unexpected changes. Asset manage | > | does not match the authorized inventory. This technique-leve | ||
| > | ment systems should be consulted to understand known-good fi | > | l analytic synthesizes System Firmware (T1693.001) and Modul | ||
| > | rmware versions. Dump and inspect BIOS images on vulnerable | > | e Firmware (T1693.002). OT operational-fidelity gate: Alert | ||
| > | systems and compare against known good images.(Citation: MIT | > | only when the action is not attributable to an authorized op | ||
| > | RE Copernicus) Analyze differences to determine if malicious | > | erator/engineering source for the specific target and functi | ||
| > | changes have occurred. Log attempts to read/write to BIOS a | > | on, and it is either outside an approved change/maintenance | ||
| > | nd compare against known patching behavior. Likewise, EFI mo | > | window or lacks matching change-control context; where telem | ||
| > | dules can be collected and compared against a known-clean li | > | etry permits, require corroborating device, configuration, o | ||
| > | st of EFI executable binaries to detect potentially maliciou | > | r process-state effect. Suppress activity that fully matches | ||
| > | s modules. The CHIPSEC framework can be used for analysis to | > | approved maintenance, commissioning, failover, recovery, or | ||
| > | determine if firmware modifications have been performed.(Ci | > | tested control procedures. | ||
| > | tation: McAfee CHIPSEC Blog)(Citation: Github CHIPSEC)(Citat | ||||
| > | ion: Intel HackingTeam UEFI Rootkit) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor network traffic for insecure credential use in proto | t | 1 | Real-time monitoring identifies successful authentication to |
| > | cols that allow unencrypted authentication. Monitor logon s | > | Windows-hosted Industrial Control System (ICS) applications | ||
| > | essions for insecure credential use, when feasible. | > | using credentials matching known default or hardcoded vendo | ||
| > | r passwords. OT operational-fidelity gate: Alert only when t | ||||
| > | he account/device/session violates the approved identity + s | ||||
| > | ource host/jump path/zone policy and is corroborated by acce | ||||
| > | ss to a protected OT asset, execution, configuration change, | ||||
| > | or another security-relevant follow-on event. Suppress appr | ||||
| > | oved shift activity, vendor support, break-glass use, commis | ||||
| > | sioning, and documented remote-access windows. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for unexpected changes to project files, although if | t | 1 | Configured Windows object-access monitoring identifies a wri |
| > | the malicious modification occurs in tandem with legitimate | > | te to a Siemens project file by a process that is not the Si | ||
| > | changes it will be difficult to isolate the unintended chan | > | emens Totally Integrated Automation (TIA) Portal or Step7 en | ||
| > | ges by analyzing only file systems modifications. | > | gineering software, or by the legitimate Siemens tool immedi | ||
| > | ately after loading a project from an untrusted path. Direct | ||||
| > | ly documented as a Stuxnet mechanism. OT operational-fidelit | ||||
| > | y gate: Alert only when execution violates an approved signe | ||||
| > | r/hash/path/parent/process or tool allowlist, or originates | ||||
| > | from an unauthorized user/tool, and is tied to an OT asset o | ||||
| > | r follow-on OT-relevant action. Suppress vendor-signed softw | ||||
| > | are, approved engineering utilities, diagnostics, patching, | ||||
| > | backup, and documented maintenance. Collection requirement: | ||||
| > | use Windows Security Event ID 4663 with Object Access auditi | ||||
| > | ng and SACLs on approved project repositories; Sysmon FileCr | ||||
| > | eate events can corroborate writes/overwrites but do not rep | ||||
| > | ort generic file-open/read activity. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for new processes engaging in scanning activity or c | t | 1 | Real-time monitoring identifies execution of port scanning u |
| > | onnecting to multiple systems by correlating process creatio | > | tilities (nmap, masscan) with arguments targeting Industrial | ||
| > | n network data. Monitor for hosts enumerating network conne | > | Control System (ICS) protocol port ranges on an ICS Windows | ||
| > | cted resources using non-ICS enterprise protocols. | > | host. OT operational-fidelity gate: Do not alert on novelty | ||
| > | , scan/read volume, or enumeration alone. Alert when the sou | ||||
| > | rce role is not authorized for discovery/polling and the tar | ||||
| > | get scope, address/tag range, protocol, or rate deviates fro | ||||
| > | m the established operational baseline. Suppress normal SCAD | ||||
| > | A/HMI/historian polling, commissioning, asset inventory, bac | ||||
| > | kup, diagnostics, and approved engineering activity. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for anomalies related to discovery related ICS funct | t | 1 | Real-time monitoring identifies new Internet Group Managemen |
| > | ions, including devices that have not previously used these | > | t Protocol (IGMP) joins or broadcast traffic spikes on Indus | ||
| > | functions or for functions being sent to many outstations. M | > | trial Control System (ICS) Virtual Local Area Networks (VLAN | ||
| > | onitor for new ICS protocol connections to existing assets o | > | s) from a source not in the approved device inventory. OT op | ||
| > | r for device scanning (i.e., a host connecting to many devic | > | erational-fidelity gate: Do not alert on novelty, scan/read | ||
| > | es) over ICS and enterprise protocols (e.g., ICMP, DCOM, Win | > | volume, or enumeration alone. Alert when the source role is | ||
| > | RM). For added context on adversary enterprise procedures an | > | not authorized for discovery/polling and the target scope, a | ||
| > | d background see [Remote System Discovery](https://attack.mi | > | ddress/tag range, protocol, or rate deviates from the establ | ||
| > | tre.org/techniques/T1018). | > | ished operational baseline. Suppress normal SCADA/HMI/histor | ||
| > | ian polling, commissioning, asset inventory, backup, diagnos | ||||
| > | tics, and approved engineering activity. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for anomalies related to discovery related ICS funct | t | 1 | Real-time monitoring identifies Internet Group Management Pr |
| > | ions, including devices that have not previously used these | > | otocol (IGMP) membership reports for Industrial Control Syst | ||
| > | functions or for functions being sent to many outstations. | > | em (ICS) multicast groups from a source not in the approved | ||
| > | Monitor for new ICS protocol connections to existing assets | > | device inventory. OT operational-fidelity gate: Do not alert | ||
| > | or for device scanning (i.e., a host connecting to many devi | > | on novelty, scan/read volume, or enumeration alone. Alert w | ||
| > | ces) over ICS and enterprise protocols (e.g., ICMP, DCOM, Wi | > | hen the source role is not authorized for discovery/polling | ||
| > | nRM). For added context on adversary enterprise procedures a | > | and the target scope, address/tag range, protocol, or rate d | ||
| > | nd background see [Remote System Discovery](https://attack.m | > | eviates from the established operational baseline. Suppress | ||
| > | itre.org/techniques/T1018). | > | normal SCADA/HMI/historian polling, commissioning, asset inv | ||
| > | entory, backup, diagnostics, and approved engineering activi | ||||
| > | ty. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor asset alarms which may help identify a loss of commu | t | 1 | Real-time monitoring identifies a network infrastructure con |
| > | nications. Consider correlating alarms with other data sourc | > | figuration change that results in a communication gap betwee | ||
| > | es that indicate traffic has been blocked, such as network t | > | n previously-connected Industrial Control System (ICS) zones | ||
| > | raffic. In cases where alternative methods of communicating | > | , from a source not in the approved network administration l | ||
| > | with outstations exist, alarms may still be visible even if | > | ist. This technique-level analytic synthesizes Serial COM (T | ||
| > | messages are blocked. Monitor for a loss of network communi | > | 1695.001), Ethernet (T1695.002), and Wi-Fi (T1695.003). OT o | ||
| > | cations, which may indicate this technique is being used. M | > | perational-fidelity gate: Alert only when the action is not | ||
| > | onitor for lack of operational process data which may help i | > | attributable to an authorized operator/engineering source fo | ||
| > | dentify a loss of communications. This will not directly det | > | r the specific target and function, and it is either outside | ||
| > | ect the technique\u2019s execution but instead may provide additi | > | an approved change/maintenance window or lacks matching cha | ||
| > | onal evidence that the technique has been used and may compl | > | nge-control context; where telemetry permits, require corrob | ||
| > | ement other detections. Monitor application logs for change | > | orating device, configuration, or process-state effect. Supp | ||
| > | s to settings and other events associated with network proto | > | ress activity that fully matches approved maintenance, commi | ||
| > | cols that may be used to block communications. Monitor for | > | ssioning, failover, recovery, or tested control procedures. | ||
| > | the termination of processes or services associated with ICS | ||||
| > | automation protocols and application software which could h | ||||
| > | elp detect blocked communications. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor asset alarms which may help identify a loss of commu | t | 1 | Real-time monitoring identifies a Windows network-adapter di |
| > | nications. Consider correlating alarms with other data sourc | > | sable or administrative interface-down event on an ICS gatew | ||
| > | es that indicate traffic has been blocked, such as network t | > | ay or protocol-converter host outside the approved network-m | ||
| > | raffic. In cases where alternative methods of communicating | > | aintenance window. OT operational-fidelity gate: Alert only | ||
| > | with outstations exist, alarms may still be visible even if | > | when the action is not attributable to an authorized operato | ||
| > | Ethernet messages are blocked. Monitor for a loss of networ | > | r/engineering source for the specific target and function, a | ||
| > | k communications, which may indicate this technique is being | > | nd it is either outside an approved change/maintenance windo | ||
| > | used. Monitor for lack of operational process data which m | > | w or lacks matching change-control context; where telemetry | ||
| > | ay help identify a loss of communications. This will not dir | > | permits, require corroborating device, configuration, or pro | ||
| > | ectly detect the technique\u2019s execution but instead may provi | > | cess-state effect. Suppress activity that fully matches appr | ||
| > | de additional evidence that the technique has been used and | > | oved maintenance, commissioning, failover, recovery, or test | ||
| > | may complement other detections. Monitor application logs f | > | ed control procedures. | ||
| > | or changes to settings and other events associated with netw | ||||
| > | ork protocols that may be used to block communications. Mon | ||||
| > | itor for the termination of processes or services associated | ||||
| > | with ICS automation protocols and application software whic | ||||
| > | h could help detect blocked communications. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor asset alarms which may help identify a loss of commu | t | 1 | Real-time monitoring identifies wireless controller manageme |
| > | nications. Consider correlating alarms with other data sourc | > | nt log entries showing Service Set Identifier (SSID) or Medi | ||
| > | es that indicate traffic has been blocked, such as network t | > | a Access Control (MAC) address filter configuration changes | ||
| > | raffic. In cases where alternative methods of communicating | > | for the Industrial Control System (ICS) wireless network fro | ||
| > | with outstations exist, alarms may still be visible even if | > | m an account not in the authorized wireless admins. OT opera | ||
| > | Wi-Fi messages are blocked. Monitor for a loss of network c | > | tional-fidelity gate: Alert only when the action is not attr | ||
| > | ommunications, which may indicate this technique is being us | > | ibutable to an authorized operator/engineering source for th | ||
| > | ed. Monitor for lack of operational process data which may | > | e specific target and function, and it is either outside an | ||
| > | help identify a loss of communications. This will not direct | > | approved change/maintenance window or lacks matching change- | ||
| > | ly detect the technique\u2019s execution, but instead may provide | > | control context; where telemetry permits, require corroborat | ||
| > | additional evidence that the technique has been used and ma | > | ing device, configuration, or process-state effect. Suppress | ||
| > | y complement other detections. Monitor application logs for | > | activity that fully matches approved maintenance, commissio | ||
| > | changes to settings and other events associated with networ | > | ning, failover, recovery, or tested control procedures. | ||
| > | k protocols that may be used to block communications. Monit | ||||
| > | or for the termination of processes or services associated w | ||||
| > | ith ICS automation protocols and application software which | ||||
| > | could help detect blocked communications. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor device alarms for program downloads, although not al | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | l devices produce such alarms. Monitor for protocol functio | > | (ICS) protocol session reading back the complete program, c | ||
| > | ns related to program download or modification. Program down | > | onfiguration, and data block set from a field device in a si | ||
| > | loads may be observable in ICS automation protocols and remo | > | ngle session from a source not in the approved engineering w | ||
| > | te management protocols. Consult asset management systems t | > | orkstation list, distinguished from a partial Program Upload | ||
| > | o understand expected program versions. Monitor devices con | > | by the comprehensiveness of the read. OT operational-fideli | ||
| > | figuration logs which may contain alerts that indicate wheth | > | ty gate: Alert only when the action is not attributable to a | ||
| > | er a program download has occurred. Devices may maintain app | > | n authorized operator/engineering source for the specific ta | ||
| > | lication logs that indicate whether a full program download, | > | rget and function, and it is either outside an approved chan | ||
| > | online edit, or program append function has occurred. | > | ge/maintenance window or lacks matching change-control conte | ||
| > | xt; where telemetry permits, require corroborating device, c | ||||
| > | onfiguration, or process-state effect. Suppress activity tha | ||||
| > | t fully matches approved maintenance, commissioning, failove | ||||
| > | r, recovery, or tested control procedures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor device alarms for program downloads, although not al | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | l devices produce such alarms. Monitor for protocol functio | > | (ICS) protocol session adding new program blocks or routine | ||
| > | ns related to program download or modification. Program down | > | s to an existing controller program without replacing existi | ||
| > | loads may be observable in ICS automation protocols and remo | > | ng logic, from a source not in the approved engineering work | ||
| > | te management protocols. Consult asset management systems t | > | station list, correlated against the device's program invent | ||
| > | o understand expected program versions. Monitor devices con | > | ory showing a size increase without a corresponding planned | ||
| > | figuration logs which may contain alerts that indicate wheth | > | update. OT operational-fidelity gate: Alert only when the ac | ||
| > | er a program download has occurred. Devices may maintain app | > | tion is not attributable to an authorized operator/engineeri | ||
| > | lication logs that indicate whether a full program download, | > | ng source for the specific target and function, and it is ei | ||
| > | online edit, or program append function has occurred. | > | ther outside an approved change/maintenance window or lacks | ||
| > | matching change-control context; where telemetry permits, re | ||||
| > | quire corroborating device, configuration, or process-state | ||||
| > | effect. Suppress activity that fully matches approved mainte | ||||
| > | nance, commissioning, failover, recovery, or tested control | ||||
| > | procedures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor device alarms for program downloads, although not al | t | 1 | Real-time monitoring identifies an Industrial Control System |
| > | l devices produce such alarms. Monitor for protocol functio | > | (ICS) online-edit command sequence (incremental program mod | ||
| > | ns related to program download or modification. Program down | > | ification while the device remains in RUN mode) from a sourc | ||
| > | loads may be observable in ICS automation protocols and remo | > | e not in the approved engineering workstation list, outside | ||
| > | te management protocols. Consult asset management systems t | > | a scheduled change-control window. OT operational-fidelity g | ||
| > | o understand expected program versions. Monitor devices con | > | ate: Alert only when the action is not attributable to an au | ||
| > | figuration logs which may contain alerts that indicate wheth | > | thorized operator/engineering source for the specific target | ||
| > | er a program download has occurred. Devices may maintain app | > | and function, and it is either outside an approved change/m | ||
| > | lication logs that indicate whether a full program download, | > | aintenance window or lacks matching change-control context; | ||
| > | online edit, or program append function has occurred. | > | where telemetry permits, require corroborating device, confi | ||
| > | guration, or process-state effect. Suppress activity that fu | ||||
| > | lly matches approved maintenance, commissioning, failover, r | ||||
| > | ecovery, or tested control procedures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Monitor for newly constructed drive letters or mount points | t | 1 | Real-time monitoring identifies a field device loading a mod |
| > | to removable media. Monitor for newly executed processes tha | > | ified autorun image (boot read-only memory, bootloader firmw | ||
| > | t execute from removable media after it is mounted or when i | > | are) detected by a discrepancy between the device's declared | ||
| > | nitiated by a user. | > | firmware hash and the authorized firmware inventory hash, w | ||
| > | ith post-reboot device behavior diverging from expected (une | ||||
| > | xpected protocols active, unanticipated network connections) | ||||
| > | . OT operational-fidelity gate: Alert only when execution vi | ||||
| > | olates an approved signer/hash/path/parent/process or tool a | ||||
| > | llowlist, or originates from an unauthorized user/tool, and | ||||
| > | is tied to an OT asset or follow-on OT-relevant action. Supp | ||||
| > | ress vendor-signed software, approved engineering utilities, | ||||
| > | diagnostics, patching, backup, and documented maintenance. |