MITRE ATT&CK - Revision history

NKirnbauer: gendering

2024-10-03T08:10:09Z

gendering

← Older revision		Revision as of 08:10, 3 October 2024
Line 14:		Line 14:

	==MITRE ATT&CK Techniques==		==MITRE ATT&CK Techniques==
	Techniques in the context of the MITRE ATT&CK knowledge base describe how an attacker achieves a tactical objective, i.e. which actions ~~he performs~~ to achieve it. As a striking example, the threat actor can, for example, dump credentials in order to gain access to the victim's credentials. As of January 2023, a total of 201 techniques are documented with a total of 424 sub-techniques. <ref name=”RE2”>"Enterprise Techniques" - available under: https://attack.mitre.org/techniques/enterprise/ - Retrieved 2024-01-01.</ref>		Techniques in the context of the MITRE ATT&CK knowledge base describe how an attacker achieves a tactical objective, i.e. which actions they perform to achieve it. As a striking example, the threat actor can, for example, dump credentials in order to gain access to the victim's credentials. As of January 2023, a total of 201 techniques are documented with a total of 424 sub-techniques. <ref name=”RE2”>"Enterprise Techniques" - available under: https://attack.mitre.org/techniques/enterprise/ - Retrieved 2024-01-01.</ref>

	==MITRE ATT&CK Tactics==		==MITRE ATT&CK Tactics==

NKirnbauer: fixed link

2024-09-23T15:59:53Z

fixed link

← Older revision		Revision as of 15:59, 23 September 2024
Line 68:		Line 68:

	===Command and Controll===		===Command and Controll===
	Command and control is used to ensure that the compromised system can be communicated with in the victim network and can therefore be controlled. An attempt is made to package the C2 traffic in such a way that it imitates normal traffic. For example, different application layer protocols such as FTP, MAIL or DNS can be used for obfuscation. <ref name=”RE19”>"Command and Controll" - available under: https://attack.mitre.org/tactics/~~TA00011~~/ - Retrieved 2024-01-01.</ref>.		Command and control is used to ensure that the compromised system can be communicated with in the victim network and can therefore be controlled. An attempt is made to package the C2 traffic in such a way that it imitates normal traffic. For example, different application layer protocols such as FTP, MAIL or DNS can be used for obfuscation. <ref name=”RE19”>"Command and Controll" - available under: https://attack.mitre.org/tactics/TA0011/ - Retrieved 2024-01-01.</ref>.

	===Exfiltration===		===Exfiltration===

ALanners: /* Lateral Movement */

2024-01-04T12:57:26Z

Lateral Movement

← Older revision		Revision as of 12:57, 4 January 2024
Line 62:		Line 62:

	===Lateral Movement===		===Lateral Movement===
			Lateral movement consists of techniques to compromise other systems in the victim network and make their way through the system landscape to the target. This involves repeatedly gaining access to the various systems that have been discovered. This can be done using own tools for lateral movement or using stolen credentials, which allows the use of native OS tools and is therefore less conspicuous. Examples of techniques include internal spearphishing and remote services such as RDP.<ref name=”RE17”>"Lateral Movement" - available under: https://attack.mitre.org/tactics/TA0008/ - Retrieved 2024-01-01.</ref>.
	<ref name=”RE17”>"Lateral Movement" - available under: https://attack.mitre.org/tactics/TA0008/ - Retrieved 2024-01-01.</ref>.

	===Collection===		===Collection===

ALanners: /* Collection */

2024-01-04T12:52:01Z

Collection

← Older revision		Revision as of 12:52, 4 January 2024
Line 66:		Line 66:

	===Collection===		===Collection===
			In the course of the collection, information is gathered as potentially useful sources. The second step after collection often consists of exfiltration, i.e. stealing data. Classic files such as audio, video, email, browsers etc. are often of interest here. Screenshots or keyboard input can also be exfiltrated. <ref name=”RE18”>"Collection" - available under: https://attack.mitre.org/tactics/TA0009/ - Retrieved 2024-01-01.</ref>.
	<ref name=”RE18”>"Collection" - available under: https://attack.mitre.org/tactics/TA0009/ - Retrieved 2024-01-01.</ref>.

	===Command and Controll===		===Command and Controll===

ALanners: /* Command and Controll */

2024-01-04T12:48:24Z

Command and Controll

← Older revision		Revision as of 12:48, 4 January 2024
Line 70:		Line 70:

	===Command and Controll===		===Command and Controll===
			Command and control is used to ensure that the compromised system can be communicated with in the victim network and can therefore be controlled. An attempt is made to package the C2 traffic in such a way that it imitates normal traffic. For example, different application layer protocols such as FTP, MAIL or DNS can be used for obfuscation. <ref name=”RE19”>"Command and Controll" - available under: https://attack.mitre.org/tactics/TA00011/ - Retrieved 2024-01-01.</ref>.
	<ref name=”RE19”>"Command and Controll" - available under: https://attack.mitre.org/tactics/TA00011/ - Retrieved 2024-01-01.</ref>.

	===Exfiltration===		===Exfiltration===

ALanners at 12:45, 4 January 2024

2024-01-04T12:45:31Z

← Older revision		Revision as of 12:45, 4 January 2024
Line 56:		Line 56:

	===Credential Access===		===Credential Access===
	The aim of the attacker is to steal credentials in order to be able to move laterally in the network, for example. Techniques such as keylogging or credential dumping using Mimikatz are used for this purpose. If the attackers obtain legitimate credentials, it is also much more difficult to track down the attackers in their own systems and networks. <ref name=~~”RE16”~~>"Credential Access" - available under: https://attack.mitre.org/tactics/TA0006/ - Retrieved 2024-01-01.</ref>.		The aim of the attacker is to steal credentials in order to be able to move laterally in the network, for example. Techniques such as keylogging or credential dumping using Mimikatz are used for this purpose. If the attackers obtain legitimate credentials, it is also much more difficult to track down the attackers in their own systems and networks. <ref name=”RE20”>"Credential Access" - available under: https://attack.mitre.org/tactics/TA0006/ - Retrieved 2024-01-01.</ref>.

	===Discovery===		===Discovery===

ALanners at 12:44, 4 January 2024

2024-01-04T12:44:55Z

← Older revision		Revision as of 12:44, 4 January 2024
Line 63:		Line 63:
	===Lateral Movement===		===Lateral Movement===

	<ref name=~~”RE16”~~>"Lateral Movement" - available under: https://attack.mitre.org/tactics/TA0008/ - Retrieved 2024-01-01.</ref>.		<ref name=”RE17”>"Lateral Movement" - available under: https://attack.mitre.org/tactics/TA0008/ - Retrieved 2024-01-01.</ref>.

	===Collection===		===Collection===

	<ref name=~~”RE16”~~>"Collection" - available under: https://attack.mitre.org/tactics/TA0009/ - Retrieved 2024-01-01.</ref>.		<ref name=”RE18”>"Collection" - available under: https://attack.mitre.org/tactics/TA0009/ - Retrieved 2024-01-01.</ref>.

	===Command and Controll===		===Command and Controll===

	<ref name=~~”RE16”~~>"Command and Controll" - available under: https://attack.mitre.org/tactics/TA00011/ - Retrieved 2024-01-01.</ref>.		<ref name=”RE19”>"Command and Controll" - available under: https://attack.mitre.org/tactics/TA00011/ - Retrieved 2024-01-01.</ref>.

	===Exfiltration===		===Exfiltration===

ALanners at 12:44, 4 January 2024

2024-01-04T12:44:30Z

← Older revision		Revision as of 12:44, 4 January 2024
Line 62:		Line 62:

	===Lateral Movement===		===Lateral Movement===

			<ref name=”RE16”>"Lateral Movement" - available under: https://attack.mitre.org/tactics/TA0008/ - Retrieved 2024-01-01.</ref>.

	===Collection===		===Collection===

			<ref name=”RE16”>"Collection" - available under: https://attack.mitre.org/tactics/TA0009/ - Retrieved 2024-01-01.</ref>.

	===Command and Controll===		===Command and Controll===

			<ref name=”RE16”>"Command and Controll" - available under: https://attack.mitre.org/tactics/TA00011/ - Retrieved 2024-01-01.</ref>.

	===Exfiltration===		===Exfiltration===

ALanners: /* Discovery */

2024-01-04T12:43:32Z

Discovery

← Older revision		Revision as of 12:43, 4 January 2024
Line 59:		Line 59:

	===Discovery===		===Discovery===
	<ref name=”RE16”>"Discovery" - available under: https://attack.mitre.org/tactics/TA0007/ - Retrieved 2024-01-01.</ref>.		In order to obtain further information about the system landscape and the network, the perpetrators observe the digital environment so that they can then plan further steps. They always look at what the attackers can currently control and what they can gain from this or how they can use it to achieve their goals.<ref name=”RE16”>"Discovery" - available under: https://attack.mitre.org/tactics/TA0007/ - Retrieved 2024-01-01.</ref>.

	===Lateral Movement===		===Lateral Movement===

ALanners at 12:34, 4 January 2024

2024-01-04T12:34:15Z

← Older revision		Revision as of 12:34, 4 January 2024
Line 56:		Line 56:

	===Credential Access===		===Credential Access===
			The aim of the attacker is to steal credentials in order to be able to move laterally in the network, for example. Techniques such as keylogging or credential dumping using Mimikatz are used for this purpose. If the attackers obtain legitimate credentials, it is also much more difficult to track down the attackers in their own systems and networks. <ref name=”RE16”>"Credential Access" - available under: https://attack.mitre.org/tactics/TA0006/ - Retrieved 2024-01-01.</ref>.

	===Discovery===		===Discovery===
			<ref name=”RE16”>"Discovery" - available under: https://attack.mitre.org/tactics/TA0007/ - Retrieved 2024-01-01.</ref>.

	===Lateral Movement===		===Lateral Movement===