Técnicas MITRE ATT&CK

Phishing for Information: Spearphishing Link

Gather Victim Org Information: Identify Roles

Acquire Infrastructure: Domains

Acquire Infrastructure: Web Services

Establish Accounts: Social Media Accounts

Establish Accounts: Email Accounts

Compromise Accounts: Email Accounts

Develop Capabilities: Malware

Obtain Capabilities: Malware

Obtain Capabilities: Tool

Phishing: Spearphishing Attachment

Exploit Public-Facing Application

Phishing: Spearphishing Link

External Remote Services

Supply Chain Compromise: Compromise Software Supply Chain

Valid Accounts: Cloud Accounts

Phishing: Spearphishing via Service

Valid Accounts

Valid Accounts: Domain Accounts

Trusted Relationship

Wi-Fi Networks

Command and Scripting Interpreter: PowerShell

Scheduled Task/Job: Scheduled Task

Windows Management Instrumentation

Command and Scripting Interpreter: Visual Basic

User Execution: Malicious File

Hijack Execution Flow: DLL

User Execution: Malicious Copy and Paste

Command and Scripting Interpreter: JavaScript

Exploitation for Client Execution

User Execution: Malicious Link

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Server Software Component: Web Shell

Account Manipulation: Additional Cloud Credentials

Account Manipulation: Additional Email Delegate Permissions

Office Application Startup: Office Test

Software Extensions: Browser Extensions

Pre-OS Boot: Bootkit

Create or Modify System Process: Systemd Service

Create or Modify System Process: Windows Service

Event Triggered Execution: Windows Management Instrumentation Event Subscription

Modify Authentication Process: Hybrid Identity

Process Injection: Process Hollowing

Exploitation for Privilege Escalation

Domain or Tenant Policy Modification: Group Policy Modification

Domain or Tenant Policy Modification: Trust Modification

Abuse Elevation Control Mechanism: Bypass User Account Control

Indicator Removal: File Deletion

Obfuscated Files or Information: Steganography

Obfuscated Files or Information: HTML Smuggling

Obfuscated Files or Information: Command Obfuscation

Obfuscated Files or Information: Encrypted/Encoded File

Masquerading: Masquerade Task or Service

Masquerading: Double File Extension

System Binary Proxy Execution: Mshta

System Binary Proxy Execution: Rundll32

Template Injection

Execution Guardrails

Social Engineering: Impersonation

Subvert Trust Controls: Code Signing

OS Credential Dumping: LSASS Memory

Brute Force: Password Spraying

OS Credential Dumping: NTDS

Steal Web Session Cookie

Credentials from Password Stores: Credentials from Web Browsers

OS Credential Dumping: DCSync

Network Sniffing

Input Capture: Keylogging

Adversary-in-the-Middle: Evil Twin

Steal or Forge Kerberos Tickets: Kerberoasting

Forge Web Credentials: SAML Tokens

Multi-Factor Authentication Request Generation

Remote System Discovery

System Information Discovery

Remote Services: SMB/Windows Admin Shares

Remote Services: Remote Desktop Protocol

Remote Services: Cloud Services

Internal Spearphishing

Use Alternate Authentication Material: Pass the Hash

Lateral Tool Transfer

Email Collection: Remote Email Collection

Email Collection: Email Forwarding Rule

Data from Information Repositories: Databases

Archive Collected Data: Archive via Utility

Web Service: Bidirectional Communication

Application Layer Protocol: Web Protocols

Ingress Tool Transfer

Remote Access Tools: Remote Desktop Software

Proxy

Proxy: External Proxy

Proxy: Multi-hop Proxy

Proxy: Domain Fronting

Web Service: Dead Drop Resolver

Remote Access Tools

Dynamic Resolution

Non-Standard Port

Protocol Tunneling

Hide Infrastructure

Exfiltration Over Web Service: Exfiltration to Cloud Storage

Exfiltration Over Web Service

Data Destruction

Data Encrypted for Impact

Inhibit System Recovery

Defacement: External Defacement

Resource Hijacking: Compute Hijacking

Endpoint Denial of Service

System Shutdown/Reboot

Disk Wipe: Disk Structure Wipe